fn2yara
A static binary analysis framework for automated reverse engineering and security analysis of compiled executables.
What is fn2yara?
Pharos is a static binary analysis framework developed by Carnegie Mellon University's Software Engineering Institute for automated analysis of compiled executables. It provides tools to reverse engineer binary programs, recover object-oriented constructs, analyze API calls, and generate function signatures for security research and malware analysis.
Security researchers, reverse engineers, and binary analysis specialists who need to analyze compiled executables for vulnerabilities, malware, or software understanding without source code access.
Pharos offers a comprehensive, research-focused framework built on the proven ROSE compiler infrastructure, with specialized tools like OOAnalyzer for recovering C++ classes from binaries—a unique capability in open-source binary analysis.
Overview
Automated static analysis tools for binary programs
Use Cases
Best For
- Recovering object-oriented classes and methods from compiled C++ executables
- Analyzing API call sequences and parameters in binary programs
- Generating YARA signatures for function matching in malware analysis
- Performing static binary similarity analysis for threat intelligence
- Reverse engineering 32-bit x86 executables compiled with Microsoft Visual C++
- Research and academic projects in binary static analysis and program understanding
Not Ideal For
- Analyzing 64-bit binaries or executables compiled with non-Microsoft compilers, due to OOAnalyzer's limitations
- Production environments requiring stable, well-documented tools with commercial support, as Pharos is a research project with no warranties
- Quick disassembly tasks where simpler tools like objdump or Ghidra's GUI would be more efficient, avoiding Pharos's complex framework setup
- Teams without expertise in the ROSE compiler infrastructure or Prolog, as these are core dependencies for effective use
Pros & Cons
Pros
Built on the proven ROSE compiler infrastructure for disassembly, control flow analysis, and instruction semantics, providing a solid base for advanced binary static analysis.
OOAnalyzer uses Prolog rules to recover C++ classes and methods from compiled executables, a specialized capability not commonly available in open-source tools.
Includes multiple tools like APIAnalyzer for API call sequences, FN2Yara for signature generation, and CallAnalyzer for parameter analysis, covering various binary analysis needs.
Developed by Carnegie Mellon University's SEI and released under a BSD license, fostering open collaboration and transparency in binary analysis research.
Cons
Key tools such as OOAnalyzer are restricted to 32-bit x86 executables compiled by Microsoft Visual C++, limiting analysis of modern or diverse binary formats.
As an active research project, Pharos lacks extensive testing, may have bugs, and comes with no warranties, making it unsuitable for critical production use.
Installation requires building the ROSE compiler infrastructure, which can be challenging and time-consuming, with limited portability testing per the README.
Some tools like DumpMASM are not actively maintained, and users are directed to alternatives, indicating potential abandonment of certain components.
Frequently Asked Questions
Related Projects
GhidraGhidra is a software reverse engineering (SRE) framework
dnSpy.NET debugger and assembly editor
BinwalkFirmware Analysis Tool
Detect It Easy(DiE)Program for determining types of files for Windows, Linux and MacOS.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.