{
  "added_at": "2026-10-30",
  "additional_evidence_urls": [
    "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md#L5-L23",
    "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md#L25-L81",
    "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/Dockerfile",
    "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/.github/workflows/integration_test.yml",
    "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/LICENSE",
    "https://github.com/KeenSecurityLab/BinAbsInspector/releases/tag/v0.1",
    "https://keenlab.tencent.com/zh/2022/04/20/2022-BinAbsInspector-public-release/"
  ],
  "category": "native-analysis",
  "description_en": "Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. Its flow- and context-sensitive interprocedural analysis, with configurable value-set size and call-string depth, optional Z3 constraint solving and models of external functions, feeds checkers for 13 CWE classes, including command injection, buffer overflows and out-of-bounds access, format strings, integer overflow, double free, use-after-free and NULL dereference. Warnings list the instruction address and its call context, in the Ghidra console or as JSON.",
  "description_zh": "腾讯科恩实验室开发的二进制静态漏洞扫描工具，以 Ghidra 扩展或无界面脚本方式运行，在 Ghidra 的 P-code 而非汇编上进行抽象解释，支持 x86、x64、ARMv7 和 AArch64 二进制。它执行流敏感、上下文敏感的过程间分析，可配置值集合大小和调用串深度，可选用 Z3 约束求解，并对外部函数建模，在此基础上运行 13 类 CWE 检查，涵盖命令注入、缓冲区溢出与越界访问、格式化字符串、整数溢出、重复释放、释放后使用和空指针解引用等。告警会列出指令地址及其调用上下文，显示在 Ghidra 控制台中或以 JSON 输出。",
  "entry_url": "https://awesomerea.org/resources/binabsinspector/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/binabsinspector/",
  "evidence_url": "https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md",
  "group": "tools",
  "id": "binabsinspector",
  "json_url": "https://awesomerea.org/resources/binabsinspector/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/binabsinspector/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/binabsinspector/index.md",
  "name": "BinAbsInspector",
  "name_zh": "BinAbsInspector 二进制漏洞静态扫描工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The only release, v0.1 from 2022-04-20, is an extension ZIP built for Ghidra 10.1.2. The reviewed main commit is 20 commits ahead; its Dockerfile and CI workflows use Ghidra 10.4 with JDK 17, and the last commit dates from 2024-05-14, so compatibility with current Ghidra releases is not documented. Source builds use Gradle 7.x (tested with 7.4) against a local Ghidra installation.",
    "Z3 is required (tested version 4.8.15): the README suggests replacing the Java bindings bundled in lib/ with a matching package and installing the native library separately, not from Linux distribution packages. Runs use Ghidra's headless analyzer, the Script Manager after default auto-analysis in the GUI, or the provided Dockerfile, which builds Z3 from source and defaults to an Ubuntu mirror in China that the UBUNTU_MIRROR argument overrides.",
    "Binaries are supplied by the user. Warnings are leads for manual review, not confirmed vulnerabilities; Keen Lab's release article reports its own Juliet test-suite comparison with cwe_checker on x86, x64 and ARMv7 for four CWE classes, scored by true and false positives and negatives.",
    "GPL-3.0."
  ],
  "requirements_zh": [
    "唯一的发布版本 v0.1 发布于 2022-04-20，是针对 Ghidra 10.1.2 构建的扩展 ZIP。所审阅的 main 提交比它多 20 个提交；其中的 Dockerfile 和 CI 工作流使用 Ghidra 10.4 和 JDK 17，最后一次提交在 2024-05-14，因此与当前 Ghidra 版本的兼容性没有文档说明。从源码构建需使用 Gradle 7.x（测试版本 7.4），并依赖本地安装的 Ghidra。",
    "需要 Z3（测试版本 4.8.15）：README 建议用版本匹配的软件包替换 lib/ 中自带的 Java 绑定，并另行安装原生库，Linux 上不要使用发行版软件包。可通过 Ghidra 无界面分析器运行，也可在图形界面完成默认自动分析后从 Script Manager 启动，或使用项目提供的 Dockerfile；该 Dockerfile 从源码编译 Z3，默认使用国内 Ubuntu 镜像源，可通过 UBUNTU_MIRROR 参数更改。",
    "待分析的二进制由使用者自备。告警只是需要人工复核的线索，并非已确认的漏洞；科恩实验室的发布文章给出了项目自行完成的 Juliet 测试集评测，在 x86、x64 和 ARMv7 上就四类 CWE 与 cwe_checker 对比，按真／假阳性和真／假阴性计分。",
    "采用 GPL-3.0 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/KeenSecurityLab/BinAbsInspector",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}