angr is a platform-agnostic binary analysis framework developed by the Shellphish research group at UC Santa Barbara. It provides a comprehensive suite of program analysis capabilities including disassembly and IR lifting (via VEX), control-flow graph construction (CFG fast/emulated), symbolic execution, data-dependency analysis, value-set analysis, and a full decompiler pipeline that produces C-like pseudocode. The framework supports multiple architectures (x86, ARM, MIPS, PowerPC, etc.) and operating systems (Linux, Windows, CGC, FreeBSD, Java VM, UEFI) through a modular SimOS layer and extensive library procedure models (libc, POSIX, Linux kernel, Windows API, C++ stdlib, Java/JNI). The architecture is built around a mixin-based engine composition pattern, where execution engines (VEX, AIL, Soot, Pcode, unicorn) are combined into an UberEngine. Analyses are registered via an AnalysesHub and instantiated as project.analyses.Name. A knowledge-base plugin system stores functions, variables, types, cross-references, and other analysis results. The decompiler is particularly sophisticated, with dozens of optimization passes, peephole optimizations, region simplifiers, and multiple structuring algorithms (SAILR, Phoenix, Dream). Native Rust components (clarirs-core, clarirs-vsa, clarirs-z3) provide high-performance symbolic reasoning and solver integration. Key entry points include angr.Project for loading binaries, project.factory for block/engine creation, project.analyses for running analyses, and simulation_manager for symbolic execution. The framework also includes an MCP server for LLM integration, a distributed analysis framework, and database persistence via AngrDB. External dependencies include claripy (solver abstraction), cle (binary loader), pyvex (VEX IR), capstone/keystone (disassembly/assembly), unicorn (concrete execution), and Z3 (SMT solver).
CoBRA is a C++ library and CLI tool for simplifying mixed Boolean-arithmetic (MBA) expressions, commonly used in software obfuscation. It ingests expressions combining arithmetic (+, -, *) with bitwise (&, |, ^, ~) and shift operators and outputs a simplified equivalent form. The core engine uses a worklist orchestrator that coordinates 36+ passes, including signature-based transforms (CoB butterfly, ANF recovery), semilinear normalization with bit partitioning, decomposition (product, polynomial, template cores), ghost residual solving, and pattern matching. An optional Z3 verifier proves full-width equivalence. The tool can be used as a standalone CLI (`cobra-cli`), as an LLVM pass for automatic deobfuscation during compilation, or as a library (`cobra::Simplify()`). The codebase is well-structured with extensive test coverage (1195+ tests) and benchmark datasets from multiple research projects. While the core is tightly coupled internally, several generic utilities (Result type, profiling stubs, math helpers) are reusable independently.
vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.
This repository implements BTD, a deep neural network (DNN) executable decompiler for x86 binaries. It recovers model specifications (operator types, topology, dimensions, parameters) from DNN executables compiled by TVM, Glow, and NNFusion frameworks. The system uses dynamic binary instrumentation via Intel Pin to collect execution traces, applies symbolic execution and taint analysis to recover tensor shapes, extracts parameters from memory dumps, and rebuilds models in PyTorch for correctness verification. The architecture consists of interconnected Python scripts and Pin tools organized around a three-phase decompilation pipeline: trace collection and filtering, shape recovery via symbolic execution, and parameter extraction. Key entry points include evaluation shell scripts (decompile_eval.sh, op_infer_eval.sh) and model-specific decompile/rebuild scripts in the evaluation/ directory. The system relies on external dependencies including Intel Pin 3.14, IDA Pro 7.5 (optional), and specific compiler versions (TVM v0.7-v0.9, Glow 2020-2022, NNFusion).