{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/README.md#L35-L97",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/README.md#L105-L140",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/CHANGES.md",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/Dockerfile",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/src/caller/Cargo.toml",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/bare_metal/stm32f407vg.json",
    "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/LICENSE",
    "https://github.com/fkie-cad/cwe_checker/releases/tag/v0.9",
    "https://docs.cwe-checker.io/index.html"
  ],
  "category": "native-analysis",
  "description_en": "Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. Ghidra disassembles the binary into a common intermediate representation on which its checks run, from simple heuristics to abstract-interpretation data-flow analysis, so it covers the CPU architectures Ghidra supports, including x86, ARM, MIPS and PowerPC. Warnings are printed as text or JSON, and a bundled Ghidra script annotates them in the disassembly for manual review.",
  "description_zh": "Fraunhofer FKIE 开发的静态分析工具，在二进制可执行文件（主要是 Linux 和 Unix 的 ELF 文件）中查找符合通用缺陷枚举（CWE）漏洞类别的代码路径，例如缓冲区溢出、释放后使用与重复释放、空指针解引用、格式化字符串和整数溢出。它先由 Ghidra 把二进制反汇编为统一的中间表示，再在其上运行从简单启发式到基于抽象解释的数据流分析等各类检查，因此适用于 Ghidra 支持的 CPU 架构，包括 x86、ARM、MIPS 和 PowerPC。告警以文本或 JSON 输出，随附的 Ghidra 脚本可把告警标注在反汇编中，便于人工复核。",
  "entry_url": "https://awesomerea.org/resources/cwe-checker/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/cwe-checker/",
  "evidence_url": "https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/README.md",
  "group": "tools",
  "id": "cwe-checker",
  "json_url": "https://awesomerea.org/resources/cwe-checker/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/cwe-checker/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/cwe-checker/index.md",
  "name": "cwe_checker",
  "name_zh": "cwe_checker 二进制漏洞模式检查工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest stable release at review: v0.9, published 2024-08-20 as a source release. Prebuilt Docker images on the GitHub container registry are tagged latest (master), stable and v0.9 and are x86 only, although the image can be built natively on ARM. The reviewed master commit is 97 commits after v0.9; CHANGES.md labels it 0.10-dev, with a rewritten P-Code extractor and support for more architectures through a Ghidra update, while the crate manifests still say 0.9.0 and the online documentation covers the stable version.",
    "Local builds need Rust 1.82+ and a Ghidra 10.2+ installation, which make all locates when GHIDRA_PATH is omitted; the Docker image builds on a Ghidra 11.2.1 headless base, and a Nix flake is also provided. Checks are tuned through src/config.json. Analysis of Linux loadable kernel modules, which runs a subset of the checks with its own configuration, and of bare-metal binaries, which needs a per-device configuration such as the bundled STM32F407VG example, is experimental.",
    "Each run takes one binary supplied by the user. The README warns that both false positives and false negatives are to be expected and keeps the CWE-78 OS command injection check disabled on standard runs, so warnings mark code paths for manual review rather than confirmed vulnerabilities. It is also integrated as a plugin in FACT.",
    "LGPL-3.0; the README notice allows version 3 or later."
  ],
  "requirements_zh": [
    "审阅时最新稳定版为 v0.9，于 2024-08-20 以源码形式发布。GitHub 容器注册表上的预构建 Docker 镜像有 latest（master 分支）、stable 和 v0.9 三个标签，仅提供 x86 版本，但可在 ARM 机器上本地构建原生镜像。所审阅的 master 提交比 v0.9 晚 97 个提交；CHANGES.md 将其标为 0.10-dev，包括重写的 P-Code 提取器以及随 Ghidra 更新而增加的架构支持，而各 crate 清单仍标为 0.9.0，在线文档对应的也是稳定版。",
    "本地构建需要 Rust 1.82+ 和 Ghidra 10.2+；未指定 GHIDRA_PATH 时，make all 会自动查找 Ghidra 安装位置。Docker 镜像基于 Ghidra 11.2.1 无界面基础镜像构建，另提供 Nix flake。各项检查可通过 src/config.json 调整。对 Linux 可加载内核模块的分析（使用单独配置运行部分检查）和对裸机二进制的分析（需要针对具体设备的配置，仓库附有 STM32F407VG 示例）均为实验性功能。",
    "每次运行分析一个由使用者提供的二进制。README 提醒误报和漏报都在所难免，CWE-78 操作系统命令注入检查在标准运行中默认关闭，因此告警只是需要人工复核的代码路径，而不是已确认的漏洞。该工具也以插件形式集成在 FACT 中。",
    "采用 LGPL-3.0 许可；README 中的声明允许使用第 3 版或任何更新版本。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/fkie-cad/cwe_checker",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}