{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md#L7-L76",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md#L140-L151",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md#L233-L296",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/cpu_rec.py#L329-L516",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/cpu_rec.py#L517-L645",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/.github/workflows/portability.yml",
    "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/LICENCE",
    "https://github.com/airbus-seclab/cpu_rec/releases/tag/v1.1",
    "https://www.sstic.org/2017/presentation/cpu_rec/"
  ],
  "category": "firmware",
  "description_en": "Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. It reports a match for the whole file, then the largest chunk that matches one architecture, and shows entropy so that encrypted or compressed regions can be discounted. It runs standalone, as a Python function or as a binwalk module.",
  "description_zh": "对任意二进制文件（例如来历不明的固件镜像）中的 CPU 指令集进行统计识别：把字节的马尔可夫链统计与默认语料库比较，语料库涵盖数十种架构，从 6502、8051 到 ARM、MIPS、PowerPC、RISC-V、x86-64 和 WebAssembly。它先给出整个文件的匹配结果，再找出与单一架构匹配的最大数据块，并显示熵值，以便排除加密或压缩区域。可独立运行，也可作为 Python 函数或 binwalk 模块使用。",
  "entry_url": "https://awesomerea.org/resources/cpu-rec/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/cpu-rec/",
  "evidence_url": "https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md",
  "group": "tools",
  "id": "cpu-rec",
  "json_url": "https://awesomerea.org/resources/cpu-rec/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/cpu-rec/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/cpu-rec/index.md",
  "name": "cpu_rec",
  "name_zh": "cpu_rec CPU 指令集统计识别工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.1, published 2024-03-19 and tagged at the reviewed commit; it adds an optional pickled corpus for faster startup and LIEF as an alternative to elfesteem. There is no package: cpu_rec.py and the cpu_rec_corpus directory are copied into the same directory. As checked on 2026-10-20, nothing has been pushed since v1.1 and the repository is not archived; the README’s Development status section holds only CI badges and does not mark the project as maintained, superseded or archived.",
    "Runs on Python 3 or Python 2; the portability workflow covers Python 3.10, PyPy 2.7 and 3.9 and GraalPy on Ubuntu and macOS. Without the lzma module the .xz corpus files must be decompressed first. Optional elfesteem or LIEF extracts the text section of ELF, PE, Mach-O or COFF files. The README reports about one minute of analysis per MB, and 1 GB of RAM to build signatures for 70 architectures, on the author's laptop.",
    "Binwalk mode installs into binwalk's module directory and needs a binwalk that includes devttys0/binwalk pull request 241; these instructions point to the earlier Python binwalk.",
    "Results are heuristic: the README warns that files can contain several architectures, small chunks can be misdetected, and results for data with entropy above 0.9 are probably meaningless. 78k and TriCore are left out of the default corpus for licensing reasons and can only be added from the user's own binaries.",
    "cpu_rec.py is Apache-2.0. The README describes the default corpus as a composite of code chunks under their own licenses, mostly from Debian, BusyBox, C-Kermit and the author's own cross-compiled open-source builds, plus a few of unknown license, including an H8S binary distributed by Dell; build_default_corpus records each origin."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.1，发布于 2024-03-19，标签正对应所审阅的提交；该版本新增可选的 pickle 语料缓存以加快启动，并可用 LIEF 代替 elfesteem。没有安装包：只需把 cpu_rec.py 和 cpu_rec_corpus 目录复制到同一目录。据 2026-10-20 核查，v1.1 发布后没有新的推送，仓库未归档；README 的“Development status”一节只有 CI 徽章，未标注项目仍在维护、已被取代或已归档。",
    "可在 Python 3 或 Python 2 上运行；可移植性工作流在 Ubuntu 和 macOS 上测试 Python 3.10、PyPy 2.7 与 3.9 以及 GraalPy。若没有 lzma 模块，需先解压 .xz 语料文件。可选的 elfesteem 或 LIEF 能提取 ELF、PE、Mach-O 或 COFF 文件的代码段。README 称在作者的笔记本上，每 MB 约需一分钟分析时间，为 70 种架构建立签名需要 1 GB 内存。",
    "binwalk 模式需安装到 binwalk 的模块目录，并要求 binwalk 包含 devttys0/binwalk 第 241 号合并请求的补丁；这些说明针对的是早期的 Python 版 binwalk。",
    "结果属于启发式判断：README 提醒，一个文件可能包含多种架构，小数据块可能被误判，熵值高于 0.9 的数据所得结果大概没有意义。78k 和 TriCore 因许可问题未收入默认语料库，只能由使用者用自有二进制补充。",
    "cpu_rec.py 采用 Apache-2.0 许可。README 说明默认语料库是由各自带有许可的代码块组成的复合作品，主要来自 Debian、BusyBox、C-Kermit 和作者自行交叉编译的开源程序，另有少数许可不明的代码块，其中包括 Dell 分发的一个 H8S 二进制；build_default_corpus 记录了每一块的来源。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/airbus-seclab/cpu_rec",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}