ablation

<img src="assets/ablation-1b-riveted-plate-wordmark-transparent-2560.png" width="520" alt="ABLATION">  Ablation is a reverse engineering framework. It carries no dependency on legacy tools or any MCP server. Combined with Codex or Claude Code, it runs as an autonomous reverse engineering tool. ---  ## Capabilities <details> <summary><strong>Analysis:</strong> semantic search, binary lifting, hypothesis engine, C++ vtable reconstruction, cross-library tracing, DAG adapter</summary> | Capability | | |:---|:---| | [**Semantic Code Search**](docs/module-reference/semantic-search.md) | Uses a BERT-family encoder to find functions by meaning in stripped binaries without symbols. | | [**On-Demand Analysis**](docs/module-reference/on-demand-analysis.md) | Loads in seconds because it only analyzes the code being examined; Ghidra and IDA Pro parse the entire file upfront. | | [**Binary Lifting**](docs/module-reference/binary-lifter.md) | Pseudo-C IR across 19 ISA targets and runtimes; ARM64 and x86-64 receive register-level taint propagation. | | [**Hypothesis Engine**](docs/module-reference/hypothesis-engine.md) | Tracks competing RE hypotheses, scores evidence across four families, and auto-executes probes; sessions persist across engagements. | | [**C++ Vtable Reconstruction**](docs/module-reference/cpp-vtable-reconstructor.md) | Reconstructs vtable slots from any ELF on any architecture and emits an IDAPython script that injects the producer-to-consumer type chain into IDA. | | [**Cross-Library Analysis**](docs/module-reference/taint-analysis.md) | Traces an argument across up to three shared library hops, so taint paths that cross library boundaries reach their sink rather than stopping at the first boundary. | | [**DAG Adapter Language**](docs/module-reference/encoding-dag.md) | Describes instruction set encodings as directed acyclic graphs so every architecture shares the same analysis code path. Without it, each ISA requires its own exception handler and the analyzer count scales with the architecture count. | </details> <details> <summary><strong>Security Analysis:</strong> taint analysis, exposure mapping, finding validation, source code auditing, compiler defect detection, cryptographic analysis</summary> | Capability | | |:---|:---| | [**Taint Analysis**](docs/module-reference/taint-analysis.md) | Follows data from network-facing entry points through the call graph to security-sensitive sinks across 14 architectures, interprocedurally and across shared library boundaries. Register-level tracking resolves PLT stubs so the trace does not stop at library call sites. | | [**Pre-Authentication Exposure**](docs/module-reference/preauth-exposure.md) | Traverses the control flow graph from the network entry point and identifies every code path that reaches a security-sensitive operation before an authentication gate. Produces a reachability map so manual review starts at the authentication boundary, not before it. | | [**Finding Validation**](docs/module-reference/preauth-exposure.md) | Generates a minimal curl-based HTTP request that reproduces each confirmed finding at the protocol level. Output includes the expected response delta and CWE classification so the PSIRT submission contains working proof. | | [**Source Code Auditing**](docs/module-reference/source-audit.md) | Runs a source-level sink and source scanner without an LLM. A profile compressor assigns each file a 5-bit security profile based on sink density, data flow indicators, and import surface, then batches low-risk files so only the highest-risk files need individual reads. | | [**Compiler Defect Detection**](docs/module-reference/compiler-defects.md) | Finds security defects the compiler introduced through miscompilation. The GCC 12.3.1.7 max-not-min defect, a four-instruction sltu/masknez/maskeqz/or sequence that selects the wrong comparison operand, produced 172 confirmed findings in TencentOS 4.6. | | [**Cryptographic Analysis**](docs/module-reference/crypto.md) | Eight tools make the cryptographic layer of a compiled binary readable. They recover XOR keys by known-plaintext attack, locate embedded PKCS#1 v1.5 key blocks, reconstruct Lagrange-shared secrets from LSB-steganographic channels, and audit TLS and JWT configurations. | </details> <details> <summary><strong>Runtimes & Formats:</strong> LoongArch64, nanoMIPS, Windows PE, BYOVD drivers, Android, Erlang/BEAM, Go, game engines, firmware</summary> | Capability | | |:---|:---| | [**LoongArch64**](docs/module-reference/loongarch64.md) | The only public RE tool with a dedicated LoongArch64 toolchain: taint tracking, heap overflow scanning, compiler bug detection, and pseudo-C decompilation. | | [**nanoMIPS**](docs/module-reference/nanomips.md) | Interprocedural taint tracker with P32/P16 BALC branch target resolution and 12-byte PLT stub unwrapping; no other public tool does this. | | [**Windows PE Security Analysis**](docs/module-reference/windows-pe.md) | Seven analyzers in one pass: CFG bypass exports, SafeSEH gaps, unauthenticated RPC, COM hijacking candidates, and kernel pool overflows. | | [**Windows Kernel Driver & BYOVD**](docs/module-reference/kernel-drivers.md) | Detects eight BYOVD capability classes in signed drivers, including physical memory read/write, token stealing, and callback removal. | | [**Android / APK Analysis**](docs/module-reference/android.md) | Maps APK attack surfaces and ranks internal libraries by security risk before any manual analysis begins. | | [**Erlang / BEAM Analysis**](docs/module-reference/beam.md) | Decodes BEAM bytecode to function-level pseudo-IR: calls with resolved import names, arithmetic via gc_bif, exception handling, send, and select_val branch tables. Also surfaces dangerous import patterns and obfuscation indicators without executing the application. | | [**Go Binary Reverse Engineering**](docs/workflows/go-binaries.md) | Recovers function names from stripped and garble-obfuscated Go binaries by reading the Go runtime metadata table. | | [**Game & Legacy RE**](docs/module-reference/game-re.md) | Labels stripped game binaries by engine, covering UE4, id Tech, Unity, Source2, and CryEngine; also decodes PS3 Cell SPU and Mac OS 8/9 PEF binaries. | | [**Firmware Extraction**](docs/module-reference/firmware-analysis.md) | Decrypts proprietary firmware through outer XOR, PKCS#1 v1.5 key block scan, and RC4 known-plaintext attack; Huawei VRP squashfs with ARM64 BCJ filter also supported. | | [**Firmware Key Corpus**](docs/module-reference/firmware-analysis.md) | Classifies recovered keys against a cross-firmware family table; flags anomalous key counts from the firmware filename before decryption begins. | </details> <details> <summary><strong>Workflow:</strong> version diffing, cross-target learning, module quality gate</summary> | Capability | | |:---|:---| | [**Version Diffing**](docs/workflows/cross-version.md) | Checks whether the logic changed, not whether the file changed, so a cosmetic recompile cannot hide an unpatched vulnerability. | | [**Cross-Target Learning**](docs/module-reference/cross-target-learning.md) | Every confirmed finding seeds future semantic searches, so the tool gets sharper with each engagement. | | [**Module Quality Gate**](docs/module-reference/forge.md) | FORGE audits every user-written module before it can be stored, so local extensions meet the same standard as the modules that ship with Ablation. | </details> --- ## 19 Decompilers | ISA / Runtime | Variants | |---|---| | x86 | x86-32 · x86-64 | | ARM | ARM-32 · ARM-64 | | MIPS | MIPS-32 · nanoMIPS · MIPS-64 | | PowerPC | PPC-32 · PPC-64 | | RISC-V | RISC-V 32 · RISC-V 64 | | ARC | ARC EM/HS | | V850 | V850-32 | | LoongArch | LoongArch64 | | DEX | Dalvik · ART | | ARK | ArkTS | | BEAM | Erlang · Elixir | --- ## Real-World Results Ablation has been used to analyze production firmware and kernel drivers from Fortinet, Cisco, Juniper, IBM, PlayStation 3, Apple macOS, Microsoft Windows, Axis Communications, HPE, Fujitsu, MikroTik, Orka by MacStadium, Acronis, TencentOS, Huawei, Enigma2, Skydio, Intel, NVIDIA, Dahua Security System, Tuya, and [more](docs/company-index/). Following coordinated disclosure on Cisco FMC and ISE, the Cisco Product Security Incident Response Team (PSIRT) has adopted Ablation for internal vulnerability triage. Cisco PSIRT is actively using it to triage ongoing disclosure reports across Firepower Threat Defense (FTD), Cisco Secure Client (AnyConnect), HyperFlex, and Catalyst. Cisco Adaptive Security Appliance (ASA) LINA has also been reverse engineered using Ablation, with findings currently under coordinated triage via CERT/CC VINCE. | CVE | Product | Title | CVSS | Advisory | |---|---|---|---|---| | CVE-2026-76420 | Secure Firewall Management Center (FMC) | Peer Impersonation | 9.0 Critical | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | | CVE-2026-76412 | Secure Firewall Management Center (FMC) | Privilege Escalation to root | 8.5 High | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | | CVE-2026-76413 | Secure Firewall Management Center (FMC) | Single Sign-On Token Forgery | 8.5 High | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | | CVE-2026-76447 | Identity Services Engine (ISE) | OCSP Responder Authentication Bypass | 5.3 Medium | [cisco-sa-ise-multiauth-bypass-sgD2HbL4](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4) --- ## Acknowledgments This project was greatly informed and inspired by several key literary works. **Research Papers** | Title | Authors | |---|---| | [Reverse Compilation Techniques](https://scholar.google.com/citations?view_op=view_citation&hl=en&user=iseZ69MAAAAJ&citation_for_view=iseZ69MAAAAJ:u-x6o8ySG0sC) · [Specifying the Semantics of Machine Instructions](https://ieeexplore.ieee.org/document/693702) · [UQBT: Adaptable Binary Translation at Low Cost](https://ieeexplore.ieee.org/document/825697) · [Machine-Adaptable Dynamic Binary Translation](https://dl.acm.org/doi/10.1145/351397.351414) | [Dr. Cristina Cifuentes](https://scholar.google.com/citations?hl=en&user=iseZ69MAAAAJ) | | [Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis](https://www.researchgate.net/publication/220849941_Design_of_a_Retargetable_Decompiler_for_a_Static_Platform-Independent_Malware_Analysis) | [Petr Zemek](https://github.com/s3rvac), Lukáš Ďurfina, Jakub Křoustek, Dušan Kolář, Tomas Hruska, Karel Masařík, Alexander Meduna | | [Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias Analysis](https://arxiv.org/abs/2109.12209) | Cheng, Zheng, Liu, Guan, Liu, Li, Zhu, Ye, Sun | | [iResolveX: Multi-Layered Indirect Call Resolution via Static Reasoning and Learning-Augmented Refinement](https://arxiv.org/abs/2601.17888) | Monika Santra, Bokai Zhang, Mark Lim, [Vishnu Asutosh Dasu](https://github.com/vdasu), Dongrui Zeng, [Gang Tan](https://github.com/gangtan) | | [Extracting Protocol Format as State Machine via Controlled Static Loop Analysis](https://arxiv.org/abs/2305.13483) | [Qingkai Shi](https://github.com/qingkaishi), Xiangzhe Xu, Xiangyu Zhang | | [NEMETYL: Message Type Identification of Binary Network Protocols using Continuous Segment Similarity](https://arxiv.org/abs/2002.03391) | [Stephan Kleber](https://github.com/vs-uulm), Rens Wouter van der Heijden, [Frank Kargl](https://github.com/fkargl) | | [Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice](https://dl.acm.org/doi/10.1145/2810103.2813707) | [David Adrian](https://github.com/dadrian), Karthikeyan Bhargavan, [Zakir Durumeric](https://github.com/zakird), Pierrick Gaudry, Matthew Green, [J. Alex Halderman](https://github.com/jhalderm), [Nadia Heninger](https://github.com/factorable), Drew Springall, Emmanuel Thomé, [Luke Valenta](https://github.com/lukevalenta) | | [Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS](https://www.usenix.org/conference/woot16/workshop-program/presentation/bock) | [Hanno Böck](https://github.com/hannob), [Aaron Zauner](https://github.com/azet), Sean Devlin, [Juraj Somorovsky](https://github.com/jurajsomorovsky), [Philipp Jovanovic](https://github.com/Daeinar) | | [Whitening Sentence Representations for Better Semantics and Faster Retrieval](https://arxiv.org/abs/2103.15316) | [Jianlin Su](https://github.com/bojone), [Jiarun Cao](https://github.com/jiaruncao), Weijie Liu, Yangyiwen Ou | | [Constant Propagation with Conditional Branches](https://dl.acm.org/doi/abs/10.1145/103135.103136) | Mark N. Wegman, F. Kenneth Zadeck | | [A Simple, Fast Dominance Algorithm](https://www.cs.princeton.edu/techreports/2005/737.pdf) | Cooper, Harvey, Kennedy | | [libdft: Practical Dynamic Data Flow Tracking for Commodity Systems](https://dl.acm.org/doi/10.1145/2151024.2151042) | [Vasileios P. Kemerlis](https://github.com/vkemerlis), [Georgios Portokalidis](https://github.com/portokalidis), [Kangkook Jee](https://github.com/jikk), Angelos D. Keromytis | **Books** supplied by [www.oreilly.com](https://www.oreilly.com) | [github.com/oreillymedia](https://github.com/oreillymedia) | Title | Authors | |---|---| | The Art of Software Security Assessment | [Mark Dowd](https://github.com/mdowd79), John McDonald, [Justin Schuh](https://github.com/jschuh) | | Practical Binary Analysis | [Dennis Andriesse](https://github.com/dennisaa) | | Practical Malware Analysis | Michael Sikorski, Andrew Honig | | Practical Reverse Engineering | Bruce Dang, Alexandre Gazet, [Elias Bachaalany](https://github.com/0xeb) | | Hacking: The Art of Exploitation (2e) | Jon Erickson | | Learning Linux Binary Analysis | [Ryan O'Neill](https://github.com/elfmaster) | | Windows Internals Part 1 & 2 | [Pavel Yosifovich](https://github.com/zodiacon), [Mark Russinovich](https://github.com/markrussinovich), David Solomon, [Alex Ionescu](https://github.com/ionescu007), [Andrea Allievi](https://github.com/AaLl86) | | Rootkits: Subverting the Windows Kernel | Greg Hoglund, Jamie Butler | | Advanced Compiler Design and Implementation | Steven Muchnick | | Engineering a Compiler | Keith Cooper, Linda Torczon | | Practical IoT Hacking | [Fotios Chantzis](https://github.com/ithilgore), Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Woods | | Inside the Android OS: Building, Customizing, Managing and Operating Android System Services | [G. Blake Meike](https://github.com/bmeike) | | Malware Analysis and Detection Engineering | [Abhijit Mohanta](https://github.com/amohanta), Anoop Saldanha | | Evasive Malware | [Kyle Cucci](https://github.com/d4rksystem) | | Hacking Cryptography | [Kamran Khan](https://github.com/krkhan), [Bill Cox](https://github.com/waywardgeek) | | Real-World Cryptography | David Wong | **Honorable Mention** [Microsoft Excel (Data Analysis ToolPak)](https://support.microsoft.com/en-us/office/use-the-analysis-toolpak-to-perform-complex-data-analysis-6c67ccf0-f4a9-487c-8dec-bdb5a2cefab6) When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs. --- ## Framework Architecture & Module Orchestration ```mermaid flowchart TD Binary(["<b>Target Binary</b><br/><i>ELF · PE · firmware</i>"]) Claude(["<b>Claude Code (Orchestrator)</b><br/><i>Central Agent Controller</i>"]) Binary -->|"load"| BCtx["<b>BinaryContext</b><br/><i>PLT · Strings · Call Graph · XRefs</i>"] BCtx -->|"context"| Corpus["<b>Corpus Builder</b><br/><i>Semantic Embedding DB</i>"] BCtx -->|"context"| Taint["<b>Taint Engine</b><br/><i>Data Flow / Sinks</i>"] BCtx -->|"context"| Diffing["<b>Diffing Engine</b><br/><i>DTW / Version Delta</i>"] BCtx -->|"context"| FmtStr["<b>Format String</b><br/><i>Specifier Scanner</i>"] BCtx -->|"context"| Heap["<b>Heap Scanner</b><br/><i>Chunk / UAF Audit</i>"] BCtx -->|"context"| MultiArch["<b>Multi-Arch Engine</b><br/><i>MIPS · PPC · RISC-V · ARC · V850 · LoongArch64</i>"] BCtx -->|"context"| Driver["<b>Driver Engine</b><br/><i>Kernel IOCTL / BYOVD Audit</i>"] Corpus -->|"embeddings"| Semantic["<b>Semantic Search</b><br/><i>BERT Behavioral Fingerprints</i>"] Semantic -. "candidates" .-> Claude Taint -. "findings" .-> Claude Diffing -. "findings" .-> Claude FmtStr -. "findings" .-> Claude Heap -. "findings" .-> Claude MultiArch -. "findings" .-> Claude Driver -. "findings" .-> Claude Claude -->|"confirmed finding"| Registry["<b>Finding Registry</b><br/><i>Cross-Target Corpus</i>"] Registry -->|"seeds future sweeps"| Semantic classDef primary fill:#2a1a4a,stroke:#7c3aed,stroke-width:2px,color:#fff classDef foundation fill:#0d1117,stroke:#58a6ff,stroke-width:2px,color:#e5e7eb classDef engine fill:#171717,stroke:#404040,stroke-width:1px,color:#e5e7eb classDef feedback fill:#0d2818,stroke:#238636,stroke-width:2px,color:#e5e7eb class Claude,Binary primary class BCtx foundation class Corpus,Semantic,Taint,Diffing,FmtStr,Heap,MultiArch,Driver engine class Registry feedback ``` --- ## Example RE Workflow End-to-end analysis of stripped binaries from an RPM bundle. Extraction through BinaryContext, string xrefs, and capstone disassembly to confirmed findings. ```mermaid flowchart TD RPM["target-package.rpm<br/>third-party bundle · x86-64"] RPM -->|rpm2cpio / cpio| EXTRACT["platform/linux-x86_64/"] EXTRACT --> PI["bin/inference_engine<br/>stripped PIE · x86-64"] EXTRACT --> CTRL["bin/controller<br/>stripped PIE · x86-64"] EXTRACT --> LIBS["lib/libcore.so<br/>lib/libruntime.so"] subgraph TRACK_PI ["inference engine track"] direction TB BCI["BinaryContext.load_or_build()<br/>32 func starts · 551 strings · PLT built"] BCI --> SS["ctx.strings scan<br/>api_op_read VA 0x51560<br/>api_op_write VA 0x51570<br/>license_key_flag 0x52e08"] SS --> XREF["ctx.string_xrefs()<br/>both ops xref → 0x17499, 0x174af<br/>ctx.func_containing() → init fn 0x10000"] XREF --> DA1["capstone disasm 0x17450<br/>lea rsi → api_op_read · call set::insert<br/>lea rsi → api_op_write · call set::insert<br/>CONFIRMED: exactly 2 blocklist entries"] DA1 --> DA2["capstone disasm 0x16511<br/>cmp qword ptr [r9], 0<br/>je → model loads · ne → handleFatal<br/>empty set = bypass confirmed"] end subgraph TRACK_LIBS ["library analysis"] direction TB NM["nm -D libcore.so<br/>spawn at 0xfdb20 · ctor at 0xfcfd0"] NM --> DA3["capstone disasm libcore.so:0xfdbc7<br/>cmp entry length == exe_path length<br/>memcmp at 0xfdbdb<br/>proper equality check · no prefix bypass"] LSCAN["re.findall api_op:: in libruntime.so<br/>2481 distinct ops found<br/>2 blocked · 2479 unblocked"] end subgraph TRACK_CTRL ["controller track"] direction TB BCC["BinaryContext.load_or_build()<br/>18 func starts · PLT · strings"] BCC --> XREF2["ctx.string_xrefs() on 5 path strings<br/>./worker1 · ./worker2<br/>./worker3 · ./worker4<br/>./inference_engine<br/>all xref at 0x9a04-0x9a5e"] XREF2 --> DA4["capstone disasm 0x99e9<br/>call CApp::progDir()<br/>call OsUtils::chdir()<br/>chdir to binary dir before spawn"] DA4 --> DA5["capstone disasm 0x11500<br/>args vector from command pipe tokens<br/>passed raw to spawn() at 0x11699<br/>no validation"] end PI --> BCI PI --> BCC LIBS --> NM LIBS --> LSCAN DA2 --> F1 LSCAN --> F1["F1 · HIGH<br/>blocklist covers 2 of 2481 ops<br/>upload malicious model via API<br/>seccomp BPF not decoded — CIA open"] DA3 --> F2 XREF2 --> F2["F2 · LOW<br/>controller spawn allowlist is sound<br/>but args vector unchecked<br/>requires service user pipe access"] DA5 --> F2 SS --> F3["F3 · INFO<br/>license gate = JSON field only<br/>no cryptographic verification"] classDef finding fill:#1a1a2e,stroke:#e94560,stroke-width:2px,color:#fff classDef tool fill:#16213e,stroke:#0f3460,stroke-width:1px,color:#e5e7eb classDef binary fill:#0f3460,stroke:#533483,stroke-width:2px,color:#fff classDef input fill:#533483,stroke:#7c3aed,stroke-width:2px,color:#fff class F1,F2,F3 finding class BCI,BCC,NM,LSCAN,SS,XREF,XREF2,DA1,DA2,DA3,DA4,DA5 tool class PI,CTRL,LIBS binary class RPM,EXTRACT input ``` --- ## Install ```bash pip install git+https://github.com/Ablation-Tool/ablation ``` --- ## Requirements - Python >= 3.10 - `capstone`, `numpy`, `lief`, `sentence-transformers`, `pyelftools` --- ## Responsible Use Ablation is built for authorized security research. Use it only against systems you own or have explicit written permission to test. Running it against systems without authorization violates computer fraud laws in most jurisdictions. The authors are not responsible for misuse.