{
  "added_at": "2026-10-30",
  "additional_evidence_urls": [
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/README.md#L115-L159",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/Cargo.toml",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/bias-vulhunt/Cargo.toml",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/bias-vulhunt-mcp/src/tools.rs",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/bias-loader-bndb/Cargo.toml",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/README.BIAS.md",
    "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/LICENSE",
    "https://github.com/vulhunt-re/vulhunt/releases/tag/v1.0.0",
    "https://github.com/vulhunt-re/data/blob/7015639969be34151c790b3ba8e8e74e0911aa3d/README.md",
    "https://github.com/vulhunt-re/rules/tree/9da95ac19b0e2a4d9c1b816b9e7dd0b40fe07c7f",
    "https://vulhunt.re/",
    "https://vulhunt.re/docs/user-guide/vulhunt-cli/installation/"
  ],
  "category": "native-analysis",
  "description_en": "Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. Lua rules run on the Rust BIAS framework, which lifts code to Ghidra's P-code and bundles Ghidra's C++ decompiler, and combine taint and dataflow tracking, Weggli-based queries over decompiled code, byte patterns, FLIRT signatures and type libraries; findings are written as JSON with annotated decompiled code. The CLI scans single binaries, Binarly BA2 archives or Binary Ninja databases, and can also run as an MCP server that lets AI assistants open a project, query it with Lua, rename functions and keep notes.",
  "description_zh": "Binarly REsearch 团队 VulHunt 引擎的开源社区版，用于在 x86 和 ARM 架构的 POSIX 二进制和 UEFI 固件中挖掘漏洞。Lua 规则运行在 Rust 编写的 BIAS 框架之上（该框架将代码提升为 Ghidra P-code，并内置 Ghidra 的 C++ 反编译器），可结合污点与数据流追踪、基于 Weggli 的反编译代码查询、字节模式、FLIRT 签名和类型库进行检测；结果以 JSON 输出，并附带标注后的反编译代码。命令行可扫描单个二进制、Binarly BA2 归档或 Binary Ninja 数据库，也可作为 MCP 服务器运行，让 AI 助手打开项目、用 Lua 查询、重命名函数并记录注释。",
  "entry_url": "https://awesomerea.org/resources/vulhunt/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/vulhunt/",
  "evidence_url": "https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/README.md",
  "group": "tools",
  "id": "vulhunt",
  "json_url": "https://awesomerea.org/resources/vulhunt/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/vulhunt/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/vulhunt/index.md",
  "name": "VulHunt Community Edition",
  "name_zh": "VulHunt 社区版漏洞挖掘框架",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Release at review: v1.0.0, published 2026-03-07, with Linux x86_64/aarch64, macOS arm64 and Windows x86_64 ZIPs; the reviewed dev commit is 7 commits ahead and its CLI crate declares 1.0.1. The documentation recommends its install scripts or a Docker image built from the repository; source builds need Rust, cargo-make, a recent CMake, Clang 20+ and a patched static LuaJIT 2.1, which cargo-make builds.",
    "Scans need auxiliary data from the separate vulhunt-re/data repository (processor specifications and type libraries, fetched with git-lfs and, for source installs, built with bias-lutil and bias-tutil) and a rules directory, such as the community rules repository with POSIX and UEFI rules; the rules, data and agent-skills repositories had no license file at review. The Binary Ninja loader needs a build with the bndb feature, which links against the Binary Ninja 5.2 stable API, and the btp commands need a Binarly Transparency Platform account.",
    "Binaries and BA2 archives are supplied by the user. The component loader takes one binary at a time; this repository has no loader for whole UEFI firmware images, since the UEFITool-based loader is published separately and is not part of the reviewed workspace. Binarly describes a commercial Enterprise Edition with further features. Rule findings are analysis aids for manual review, and the reviewed sources report no accuracy evaluation.",
    "GPL-3.0 for VulHunt; the BIAS framework crates are dual-licensed MIT OR Apache-2.0 according to README.BIAS.md."
  ],
  "requirements_zh": [
    "审阅时的版本为 v1.0.0，发布于 2026-03-07，提供 Linux x86_64/aarch64、macOS arm64 和 Windows x86_64 的 ZIP 包；所审阅的 dev 提交比它多 7 个提交，命令行 crate 已标为 1.0.1。文档推荐使用官方安装脚本，或从仓库构建 Docker 镜像；从源码构建需要 Rust、cargo-make、较新的 CMake、Clang 20+ 以及打过补丁的静态 LuaJIT 2.1（由 cargo-make 自动构建）。",
    "扫描需要独立的 vulhunt-re/data 仓库提供辅助数据（处理器规范和类型库，需用 git-lfs 获取；源码安装时还要用 bias-lutil 和 bias-tutil 构建），以及一个规则目录，例如收录 POSIX 和 UEFI 规则的社区规则仓库；审阅时规则、数据和智能体技能仓库均没有许可证文件。Binary Ninja 加载器需启用 bndb 特性构建，并链接 Binary Ninja 5.2 稳定版 API；btp 系列命令需要 Binarly Transparency Platform 账户。",
    "二进制和 BA2 归档由使用者自备。component 加载器每次处理一个二进制；本仓库没有针对完整 UEFI 固件镜像的加载器，基于 UEFITool 的加载器另行发布，不在所审阅的工作区内。Binarly 称另有功能更多的商业企业版。规则命中结果只是辅助分析的线索，需要人工复核；所审阅的资料未给出准确率评估。",
    "VulHunt 采用 GPL-3.0；据 README.BIAS.md，BIAS 框架各 crate 采用 MIT 或 Apache-2.0 双重许可。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/vulhunt-re/vulhunt",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}