# GREASE

> Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution. It lifts AArch32, PowerPC or x86_64 ELF executables and shared objects, or LLVM bitcode, into a control-flow graph, simulates each function from fully symbolic registers and grows the inferred memory layout after out-of-bounds accesses, then reports likely undefined behavior such as division by zero or invalid memory access together with concretized arguments. Built-in overrides, or user overrides written in Crucible's S-expression language, model external library functions, and the plug-in presents results in Ghidra.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/GaloisInc/grease>
- Primary source: <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/overview.md>
- Catalog page: <https://awesomerea.org/resources/grease/>
- Record JSON: <https://awesomerea.org/resources/grease/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/grease/index.md)

## Requirements & limits

- No tagged releases at review: the installation guide offers a nightly Docker image built from main (ghcr.io/galoisinc/grease:nightly) or a source build, and the same documentation is published at galoisinc.github.io/grease. The reviewed main commit is dated 2026-09-24; Galois introduced the tool in a blog post dated 2025-03-19.
- Source builds need GHC 9.6, 9.8 or 9.10, cabal-install 3.6+ and the repository's git submodules, including Galois's macaw, crucible, what4 and elf-edit. A standalone binary also needs one of the SMT solvers bitwuzla, cvc4, cvc5, yices or z3; it defaults to yices, which CI tests at 2.6.5, and the Docker image includes the solvers. The Ghidra plug-in needs Ghidra 11.0+ and a local grease binary.
- Supply the ELF binary or LLVM bitcode yourself. By default every known function is analyzed; entry points can instead be chosen by symbol, address or core dump. The limitations page lists single-threaded analysis only, k-bounded data structures, loops and recursion, skipped calls through symbolic function pointers, no stack-buffer-overflow detection or heap-exhaustion modeling, limited string operations and no support for code that runs before main.
- The repository commits small test fixtures built from adjacent C or assembly sources: about 200 AArch32, PowerPC and x86_64 ELF executables and shared objects under grease-exe/tests, plus test ELFs under grease-x86/test-data, ghidra-ecfs/src/test/resources/ecfs and the bundled screach reachability tool's test-data directories.
- BSD-3-Clause (LICENSE). The README credits DARPA funding and carries Distribution Statement A, approved for public release. Reports depend on the inferred preconditions, bounds and overrides.

## Primary sources

1. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/overview.md>
2. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/README.md>
3. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/install.md>
4. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/usage.md>
5. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/dev/dev.md>
6. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/ghidra-plugin.md>
7. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/limitations.md>
8. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/overrides.md>
9. <https://github.com/GaloisInc/grease/tree/b94e1e010c289cf579fe868307857a417d6e3a2c/grease-exe/tests>
10. <https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/LICENSE>
11. <https://galoisinc.github.io/grease/>
12. <https://www.galois.com/articles/introducing-grease>

## More in Native binaries

- [PLASMA](https://awesomerea.org/resources/plasma-disassembler/index.md) · Tool
- [mobdevim](https://awesomerea.org/resources/mobdevim/index.md) · Tool
- [XPEViewer](https://awesomerea.org/resources/xpeviewer/index.md) · Tool
- [Fermion](https://awesomerea.org/resources/fermion/index.md) · Tool
- [Ghidrathon](https://awesomerea.org/resources/ghidrathon/index.md) · Tool
- [diStorm3](https://awesomerea.org/resources/distorm/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.