# BinAbsInspector

> Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. Its flow- and context-sensitive interprocedural analysis, with configurable value-set size and call-string depth, optional Z3 constraint solving and models of external functions, feeds checkers for 13 CWE classes, including command injection, buffer overflows and out-of-bounds access, format strings, integer overflow, double free, use-after-free and NULL dereference. Warnings list the instruction address and its call context, in the Ghidra console or as JSON.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-30
- Original resource: <https://github.com/KeenSecurityLab/BinAbsInspector>
- Primary source: <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md>
- Catalog page: <https://awesomerea.org/resources/binabsinspector/>
- Record JSON: <https://awesomerea.org/resources/binabsinspector/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/binabsinspector/index.md)

## Requirements & limits

- The only release, v0.1 from 2022-04-20, is an extension ZIP built for Ghidra 10.1.2. The reviewed main commit is 20 commits ahead; its Dockerfile and CI workflows use Ghidra 10.4 with JDK 17, and the last commit dates from 2024-05-14, so compatibility with current Ghidra releases is not documented. Source builds use Gradle 7.x (tested with 7.4) against a local Ghidra installation.
- Z3 is required (tested version 4.8.15): the README suggests replacing the Java bindings bundled in lib/ with a matching package and installing the native library separately, not from Linux distribution packages. Runs use Ghidra's headless analyzer, the Script Manager after default auto-analysis in the GUI, or the provided Dockerfile, which builds Z3 from source and defaults to an Ubuntu mirror in China that the UBUNTU_MIRROR argument overrides.
- Binaries are supplied by the user. Warnings are leads for manual review, not confirmed vulnerabilities; Keen Lab's release article reports its own Juliet test-suite comparison with cwe_checker on x86, x64 and ARMv7 for four CWE classes, scored by true and false positives and negatives.
- GPL-3.0.

## Primary sources

1. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md>
2. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md#L5-L23>
3. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md#L25-L81>
4. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/Dockerfile>
5. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/.github/workflows/integration_test.yml>
6. <https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/LICENSE>
7. <https://github.com/KeenSecurityLab/BinAbsInspector/releases/tag/v0.1>
8. <https://keenlab.tencent.com/zh/2022/04/20/2022-BinAbsInspector-public-release/>

## More in Native binaries

- [VulHunt Community Edition](https://awesomerea.org/resources/vulhunt/index.md) · Tool
- [BinSync](https://awesomerea.org/resources/binsync/index.md) · Tool
- [class-dump](https://awesomerea.org/resources/class-dump/index.md) · Tool
- [Lucid](https://awesomerea.org/resources/lucid-microcode-explorer/index.md) · Tool
- [r2dec](https://awesomerea.org/resources/r2dec/index.md) · Tool
- [Runtime Mobile Security (RMS)](https://awesomerea.org/resources/rms-runtime-mobile-security/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.