Pharos is a static binary analysis framework. It is intended primarily for automated analysis of compiled programs and research into binary-analysis techniques.
The framework builds on the ROSE compiler infrastructure for disassembly, instruction semantics and control-flow analysis. Pharos then provides a collection of specialised tools for examining API behaviour, recovering object-oriented constructs, comparing functions and generating signatures. It is therefore more of an analysis toolkit than an interactive graphical reverse-engineering environment.
This is free and open source software.
Key Features
- APIAnalyzer locates sequences of API calls with specified data and control relationships.
- Detect operating-system interaction patterns represented by related API calls.
- OOAnalyzer recovers object-oriented constructs from compiled executables.
- Track object pointers between functions to identify members and methods.
- Use Prolog rules when recovering object attributes.
- CallAnalyzer reports statically determined parameters passed to API calls.
- Provide calling-convention, parameter and type analysis.
- FN2Yara generates YARA signatures for matching executable functions.
- Support binary similarity analysis by identifying shared functions.
- FN2Hash calculates hashes and descriptive properties for functions.
- Generate function characteristics suitable for further automated analysis.
- Include experimental program path analysis.
- Support multi-threaded analysis workloads.
- Use ROSE for disassembly and control-flow infrastructure.
Website: github.com/cmu-sei/pharos
Support:
Developer: Software Engineering Institute, Carnegie Mellon University
License: BSD (SEI) License
Pharos is written in C++. Learn C++ with our recommended free books and free tutorials.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Capstone | Lightweight multi-architecture disassembly framework |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| Miasm | Reverse engineering framework for analysing and emulating binaries |
| Reko | General-purpose decompiler for machine-code binaries |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| REDasm | Cross-platform disassembler with an extensible graphical interface |
| Pharos | Framework for automated static analysis of binary programs |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
| knife | Static binary triage, disassembly and vulnerability analysis toolkit |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.