BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse engineers, directly from IDA.
It features:
- value analysis (registers and memory)
- taint analysis
- type reconstruction and propagation
- backward and forward analysis
You can check BinCAT in action here:
Check the tutorial out to see the corresponding tasks.
Supported host platforms:
- IDA plugin: all, version 6.9 or later (BinCAT uses PyQt, not PySide)
- analyzer (local or remote): Linux, Windows, macOS (maybe)
Supported CPU for analysis (for now):
- x86-32
The analyzer can be used locally or through a Web service.
On Windows, the binary distribution includes the analyzer.
On Linux:
- Using Docker: Docker installation instructions
- Manual: Manual installation instructions
Only IDA v6.9 or later are supported
- Unzip BinCAT
- In IDA, click on "File -> Script File..." menu (or type ALT-F7)
- Select
windows_install.py
- BinCAT is now installed in your IDA user dir
Or install manually.
-
Load the plugin by using the
Ctrl-Shift-B
shortcut, or using theEdit -> Plugins -> BinCAT
menu -
Select an instruction in any IDA view, then use the
Ctrl-Shift-A
shortcut, or theBinCAT -> Analyze from here
context menu
Global options can be configured through the Edit/BinCAT/Options
menu.
Default config and options are stored in $IDAUSR/idabincat/conf
.
- Use remote bincat: select if you are running docker in a Docker container
- Remote URL: http://localhost:5000 (or the URL of a remote BinCAT server)
- Autostart: autoload BinCAT at IDA startup
- Save to IDB: default state for the
save to idb
checkbox
Default config for analyzer.
A manual is provided.
A tutorial is provided to help you try BinCAT's features. It makes use of a sample binary and screenshots.
- basic info
- more info
- debug
- advanced debug
- SSTIC 2017, Rennes, France: article (english), slides (french), video of the presentation (french)
- REcon 2017, Montreal, Canada: slides
BinCAT is released under the GNU Affero General Public Licence.
The BinCAT OCaml code includes code from the original Ocaml runtime, released under the LGPLv2.
The BinCAT IDA plugin includes code from python-pyqt5-hexview by Willi Ballenthin, released under the Apache License 2.0.