{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/README.md#L25-L37",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/README.md#L119-L132",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/CHANGELOG",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/manual.md",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/ini_format.md",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/install_manual.md",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/install_docker.md",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/windows_build.md",
    "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/doc/COPYING",
    "https://github.com/airbus-seclab/bincat/releases/tag/v1.5"
  ],
  "category": "native-analysis",
  "description_en": "Static binary code analysis toolkit designed for reverse engineers. Starting from a chosen address and initial state, it computes register and memory values, taint and reconstructed types, with forward and backward analysis and heap use-after-free and double-free detection; bits it cannot determine are shown as unknown. It is driven from an IDA plugin, where analysts can override values or taint, skip functions or replace instructions with NOPs before re-running, or from Python and an .ini configuration for automation.",
  "description_zh": "面向逆向工程人员的二进制代码静态分析工具包。它从选定的地址和初始状态出发，计算寄存器与内存的值、污点和重建出的类型，支持前向与后向分析，并能检测堆上的释放后使用和重复释放；无法确定的位会标为未知。分析可在 IDA 插件中进行，分析人员可覆盖值或污点、跳过函数或把指令替换为 NOP 后重新运行；也可通过 Python 和 .ini 配置文件实现自动化。",
  "entry_url": "https://awesomerea.org/resources/bincat/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/bincat/",
  "evidence_url": "https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/README.md",
  "group": "tools",
  "id": "bincat",
  "json_url": "https://awesomerea.org/resources/bincat/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/bincat/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/bincat/index.md",
  "name": "BinCAT",
  "name_zh": "BinCAT 二进制静态分析工具包",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.5, published 2025-02-25; its tag is the reviewed master commit, and the repository has had no commits since. The Linux and Windows release archives bundle the analyzer and the IDA plugin, which is installed by running install_plugin.py from IDA. The plugin requires IDA 7.4 or later with Python 3; the changelog adds IDA 8.3 support in v1.3 and IDA 9.0 support in v1.4.",
    "The README lists x86-32, x86-64, ARMv7, ARMv8 and PowerPC as analysis targets; the changelog also records initial RISC-V and initial, incomplete ARMv7 Thumb support. The analyzer runs locally on Linux or Windows (macOS only “maybe”, per the README) or as a Flask web service in the airbusseclab/bincat Docker image that the plugin reaches through its remote URL option. Source builds need OCaml with dune, menhir, ocamlgraph, ppxlib and zarith plus Python 3; Windows builds use Cygwin and an opam mingw64 OCaml switch.",
    "Each analysis is described by a versioned .ini file covering the program, its sections and imports, the initial register and memory state and overrides; the IDA plugin generates it from the open database, ELF core dumps can supply the initial state, and the format documentation is partial, with the parser source as its reference. Binaries to analyze come from the user; the tutorial uses the project’s own keygen-me sample.",
    "AGPL-3.0 per the README and doc/COPYING; GitHub detects no license because there is no root license file. The OCaml code includes LGPLv2 OCaml runtime code, the plugin includes Apache-2.0 code from python-pyqt5-hexview, and a modified copy of c2newspeak is bundled. Results depend on the configured initial state, skipped functions and overrides."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.5，发布于 2025-02-25；其标签即所审阅的 master 提交，此后仓库没有新的提交。Linux 和 Windows 发布包同时包含分析器和 IDA 插件，插件通过在 IDA 中运行 install_plugin.py 安装。插件要求 IDA 7.4 或更高版本并使用 Python 3；更新日志记载 v1.3 起支持 IDA 8.3，v1.4 起支持 IDA 9.0。",
    "README 列出的分析目标架构为 x86-32、x86-64、ARMv7、ARMv8 和 PowerPC；更新日志另记有初步的 RISC-V 支持，以及初步且不完整的 ARMv7 Thumb 支持。分析器可在 Linux 或 Windows 本地运行（README 称 macOS“也许”可用），也可作为 airbusseclab/bincat Docker 镜像中的 Flask 网络服务运行，插件通过远程 URL 选项连接。从源码构建需要 OCaml 及 dune、menhir、ocamlgraph、ppxlib 和 zarith，以及 Python 3；Windows 构建使用 Cygwin 和 opam 的 mingw64 OCaml 环境。",
    "每次分析由一个带版本号的 .ini 文件描述，内容包括程序及其节区和导入、寄存器与内存的初始状态以及覆盖设置；IDA 插件会根据当前打开的数据库生成该文件，也可用 ELF 核心转储提供初始状态。该格式的文档并不完整，以解析器源码为准。待分析的二进制由使用者自行提供；教程使用的是项目自带的 keygen-me 示例程序。",
    "README 和 doc/COPYING 表明采用 AGPL-3.0；由于仓库根目录没有许可证文件，GitHub 未识别出许可证。OCaml 代码包含采用 LGPLv2 的 OCaml 运行时代码，插件包含采用 Apache-2.0 的 python-pyqt5-hexview 代码，并附带一份修改过的 c2newspeak。分析结果取决于所配置的初始状态、跳过的函数和覆盖设置。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/airbus-seclab/bincat",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}