PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From P-Code to GNN: extract binary code semantics

blog.quarkslab.com | tool | #reverse-engineering | #binary-analysis | #machine-learning | #tool | #quarkslab | #gnn | #pcode
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

pcode_graph is a Python library, published by Quarkslab, suitable to build semantic graphs from binary code. We present how to use it to detect function similarities in binaries.

Why it matters

This coverage gives security teams current context for monitoring, validation, and remediation.
Published
Collected

Related coverage

research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
Introducing TritonDSE: A framework for dynamic symbolic execution in Python
Introducing TritonDSE, a Python library atop Triton for customizable dynamic symbolic execution: high-level program exploration primitives, hooks, and the base of PASTIS's white-box fuzzer.
research · blog.quarkslab.com
Quokka: A Fast and Accurate Binary Exporter
Quarkslab open-sources Quokka, a binary exporter that extracts a program's disassembly for offline analysis, letting users write complex analyses without disassembler APIs.
research · blog.quarkslab.com
Binbloom blooms: introducing v2
Introducing binbloom v2, Quarkslab's firmware reverse-engineering tool: a new method to determine the load base address of both 32- and 64-bit firmware binaries.
research · blog.quarkslab.com
Weisfeiler-Lehman Graph Kernel for Binary Function Analysis
A method applying the Weisfeiler-Lehman graph kernel to control-flow graphs, comparing binary functions against large known-function databases for classification, clustering and near-duplicate detection.
tool · blog.quarkslab.com
Blue Galaxy Energy: a new White-box Cryptanalysis Open Source Tool
Quarkslab releases Blue Galaxy Energy, an open-source tool implementing the BGE attack against AES white-box implementations, previously lacking any public implementation.
Back