{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/docs/usage/symbolic-and-taint-engines.md",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/docs/usage/enable-disable.md",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/docs/usage/blacklist.md",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/docs/misc/ponce-limitations.md",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/docs/misc/building.md",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/CMakeLists.txt",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/.github/workflows/ci-windows.yml",
    "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/LICENSE",
    "https://github.com/illera88/Ponce/releases/tag/v0.3.7"
  ],
  "category": "dynamic-analysis",
  "description_en": "IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. After the analyst taints or symbolizes registers, memory or inputs such as argv or a buffer read with fread, Ponce single-steps the debugged program, analyzes each instruction with Triton and renames the functions that the input influences. Its symbolic engine can solve a branch condition, or negate it and inject a satisfying input into memory, while execution snapshots restore earlier state to try that input; builds with Hex-Rays support also show the results in decompiler pseudocode.",
  "description_zh": "IDA Pro 插件，仓库简介称其获得 2016 年 IDA 插件大赛冠军，它把 Triton 框架的污点分析和符号执行引入 IDA 调试器，适用于 x86 和 x64 程序。分析人员对寄存器、内存或 argv、fread 读入的缓冲区等输入进行污点标记或符号化后，Ponce 会单步执行被调试程序，用 Triton 分析每条指令，并重命名受该输入影响的函数。其符号引擎可以求解分支条件，或将条件取反后把满足条件的输入注入内存，再借助执行快照恢复先前状态来尝试该输入；启用 Hex-Rays 支持的构建还会在反编译伪代码中显示分析结果。",
  "entry_url": "https://awesomerea.org/resources/ponce/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ponce/",
  "evidence_url": "https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/README.md",
  "group": "tools",
  "id": "ponce",
  "json_url": "https://awesomerea.org/resources/ponce/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ponce/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ponce/index.md",
  "name": "Ponce",
  "name_zh": "Ponce IDA 符号执行与污点分析插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.3.7, published 2023-06-01, with prebuilt Windows, Linux and macOS zips; the Windows zip holds Ponce.dll and Ponce64.dll builds for IDA 7.0 through 8.1, with none for later IDA releases. The README says Ponce works with any IDA version from 7.0 and that the binary built for the installed IDA version must be used. The reviewed master commit of 2025-06-06 adds only a work-in-progress CI fix after that release.",
    "Installation copies the matching build into IDA's plugins folder; the README lists native Windows, Linux and OS X support. Source builds use CMake 3.15+, the IDA SDK for the target version (IDASDK_ROOT_DIR) and Triton, which the CI installs through vcpkg; pseudocode feedback also needs hexrays.hpp from an IDA installation that includes the Hex-Rays decompiler, otherwise -DBUILD_HEXRAYS_SUPPORT=OFF. The repository contains no SDK files, and its CI clones the SDK archives from a separate repository that is not public, so source builds rely on the user's own SDK.",
    "Ponce analyzes a program the analyst runs under IDA's debugger, stepping one instruction at a time; the README cites about 3,000 instructions per second in the authors' tests, and common library functions such as printf are blacklisted from analysis by default. The limitations page says symbolic memory indexes can lose track of the input, Triton handles floating-point instructions poorly, and concolic execution only analyzes instructions that actually execute.",
    "Ponce's own terms are a BSD-style license, and LICENSE also reproduces Triton's BSD and Z3's MIT licenses; GitHub does not classify the file."
  ],
  "requirements_zh": [
    "审阅时的最新版本为 v0.3.7，发布于 2023-06-01，提供 Windows、Linux 和 macOS 的预编译压缩包；Windows 压缩包包含适用于 IDA 7.0 至 8.1 的 Ponce.dll 和 Ponce64.dll，没有更新 IDA 版本的构建。README 称 Ponce 适用于 IDA 7.0 及以上任意版本，但必须使用为所装 IDA 版本编译的二进制。所审阅的 master 提交（2025-06-06）在该版本之后只增加了一项尚未完成的 CI 修复。",
    "安装时将对应构建复制到 IDA 的 plugins 目录；README 称原生支持 Windows、Linux 和 OS X。从源码构建需要 CMake 3.15+、目标版本的 IDA SDK（IDASDK_ROOT_DIR）以及 Triton，CI 通过 vcpkg 安装 Triton；伪代码反馈功能还需要来自附带 Hex-Rays 反编译器的 IDA 安装中的 hexrays.hpp，否则需使用 -DBUILD_HEXRAYS_SUPPORT=OFF。仓库中不含任何 SDK 文件，其 CI 从另一个非公开仓库克隆 SDK 压缩包，因此从源码构建需使用者自备 SDK。",
    "Ponce 分析的是分析人员在 IDA 调试器中运行的程序，并逐条指令单步执行；README 称在作者测试中每秒约可处理 3000 条指令，printf 等常见库函数默认被列入黑名单、不参与分析。局限性文档指出，符号化的内存索引可能导致丢失对输入的跟踪，Triton 对浮点指令支持不佳，且混合执行只分析实际执行过的指令。",
    "Ponce 本身采用 BSD 风格许可，LICENSE 中还收录了 Triton 的 BSD 许可和 Z3 的 MIT 许可；GitHub 未能识别该文件的许可类型。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/illera88/Ponce",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}