A static binary analysis framework for automated reverse engineering and security analysis of compiled executables.
Pharos is a static binary analysis framework developed by Carnegie Mellon University's Software Engineering Institute for automated analysis of compiled executables. It provides tools to reverse engineer binary programs, recover object-oriented constructs, analyze API calls, and generate function signatures for security research and malware analysis.
Security researchers, reverse engineers, and binary analysis specialists who need to analyze compiled executables for vulnerabilities, malware, or software understanding without source code access.
Pharos offers a comprehensive, research-focused framework built on the proven ROSE compiler infrastructure, with specialized tools like OOAnalyzer for recovering C++ classes from binaries—a unique capability in open-source binary analysis.
Automated static analysis tools for binary programs
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Built on the proven ROSE compiler infrastructure for disassembly, control flow analysis, and instruction semantics, providing a solid base for advanced binary static analysis.
OOAnalyzer uses Prolog rules to recover C++ classes and methods from compiled executables, a specialized capability not commonly available in open-source tools.
Includes multiple tools like APIAnalyzer for API call sequences, FN2Yara for signature generation, and CallAnalyzer for parameter analysis, covering various binary analysis needs.
Developed by Carnegie Mellon University's SEI and released under a BSD license, fostering open collaboration and transparency in binary analysis research.
Key tools such as OOAnalyzer are restricted to 32-bit x86 executables compiled by Microsoft Visual C++, limiting analysis of modern or diverse binary formats.
As an active research project, Pharos lacks extensive testing, may have bugs, and comes with no warranties, making it unsuitable for critical production use.
Installation requires building the ROSE compiler infrastructure, which can be challenging and time-consuming, with limited portability testing per the README.
Some tools like DumpMASM are not actively maintained, and users are directed to alternatives, indicating potential abandonment of certain components.