https://github.com/BinaryAnalysisPlatform

https://github.com/BinaryAnalysisPlatform/bap

BAP

BAP is a platform for binary analysis. It is written in OCaml, but can be used from other languages. After BAP and python bindings are properly installed.

QIRA

???

Google's/Zynamics'

https://github.com/google/binnavi/tree/3c72c7f8fd5f6265f37e2d33246329dbf...

BinNavi

Python scripts for BinNavi.

???

???

Jurriaan Bremer (@skier_t)

https://github.com/jbremer/darm

Darm

A light-weight and efficient disassembler written in C for the ARMv7 instruction set.

Durmu
sefi
freezing-bear

Description

Rodrigo Chiossi

https://github.com/rchiossi/dexterity

dexterity

dexterity is a C library intended for manipulation and analysis of DEX files. It has python bindings for all basic DEX structures and most of the manipulation functions.

???

???

EreTIk

https://diabind.codeplex.com/

Python binding of DIA (Debug Interface Access) SDK.

???

???

EiNSTeiN-

https://github.com/EiNSTeiN-/hexrays-python

Hexrays Decompiler

This is an IDA Pro plugin which provides python bindings around the Hexrays Decompiler SDK API.

hexrays-python-plugins

???

Numba

https://github.com/numba/llvmlite

LLVM

A lightweight LLVM python binding for writing JIT compilers.

???

???

Wesley Shields (wxs@atarininja.org)

https://github.com/trailofbits/pe-parse/tree/master/python

pe-parse

pepy (pronounced p-pie) is a python binding to the pe-parse parser.

pe-parse is a principled, lightweight parser for windows portable executable files. It was created to assist in compiled program analysis, potentially of programs of unknown origins. This means that it should be resistant to malformed or maliciously crafted PE files, and it should support questions that analysis software would ask of an executable program container. For example, listing relocations, describing imports and exports, and supporting byte reads from virtual addresses as well as file offsets.

???

???

Romain Gaucher (@rgaucher), Haris Andrianakis (@tl0gic)

https://github.com/neuroo/pinpy

PIN

PinPy essentially allows you to to run Python scripts inside whatever programs, just educate it using the XML config file, what you want to hook. You'll need to get some information so that pin can properly install the hooks such as signature, etc. This is done by embedding a Python runtime in a pin tool.

???

???

Jurriaan Bremer (@skier_t)

https://github.com/jbremer/pyn

PIN

Awesome Python bindings for Pintool. Pyn aims to offer an extremely easy API for quickly writing Pintools.
Pyn features a raw API close to the original Pintool API as well as a more Pythonic API. It's important to understand that Pyn hides various aspects of regular Pintools, allowing one to make full-featured Pintools in just a handful lines of code.

???

???

Dmytro Oleksiuk

https://github.com/Cr4sh/openreil

OpenREIL

OpenREIL is open source library that implements translator and tools for REIL (Reverse Engineering Intermediate Language).
pyopenreil − OpenREIL Python API.

???

Automated algebraic cryptanalysis with OpenREIL and Z3

blankwall

https://github.com/blankwall/Python_Pin

PIN

Python bindings for pin.

???

Video

zardus

https://github.com/zardus/pyvex

Valgrind

Python bindings for Valgrind's VEX IR.

Angr
rop_compiler

???

???

https://github.com/huku-/pyxed

pyxed is a Python extension that uses Intel's XED2 library to decode x86 instructions. It is designed to be a wrapper around XED's C API and, as such, it doesn't provide any high level abstractions.

XDE

???

Jonathan Salwan

https://github.com/JonathanSalwan/Triton

PIN

Triton is a concolic execution framework based on Pin. It provides components like a taint engine, a dynamic symbolic execution engine, a snapshot engine, translation of x64 instructions into the SMT2-LIB representation, a Z3 interface to solve constraints and Python bindings.

???

Code coverage using a dynamic symbolic execution
Dynamic Binary Analysis and Obfuscated Codes

Sascha Böhme

http://www4.in.tum.de/~boehmes/z3-python.html

Z3

This is a Python binding to the SMT solver Z3. Since it is based on Python's dynamic foreign function interface ctypes, no compilation is required. Z3 is a high-performance theorem prover being developed at Microsoft Research. Z3 supports linear real and integer arithmetic, fixed-size bit-vectors, extensional arrays, uninterpreted functions, and quantifiers. Z3 is integrated with a number of program analysis, testing, and verification tools from Microsoft Research. These include: Spec#/Boogie, Pex, Yogi, Vigilante, SLAM, F7, SAGE, VS3, FORMULA, and HAVOC. It can read problems in SMT-LIB and Simplify formats.

???

site Z3