The Binary Analysis Platform is a reverse engineering and program analysis platform that targets binaries, i.e., compiled programs without the source code. BAP supports multiple architectures (more than 30), though the first tier architectures are x86, x86-64, and ARM. BAP operates by disassembling and lifting the binary code into the RISC-like BAP Instruction Language (BIL). Thus the analysis, implemented in BAP, is architecture independent in a sense that it will work equally well for all the supported architectures. The platform comes with a set of tools, libraries, and plugins. The main purpose of BAP is to provide a toolkit for automated program analysis. BAP is written in OCaml and it is the preferred language to write analysis, we have bindings to C, Python and Rust.
BAP is developed in CMU, Cylab and is sponsored by various grants from the United States Department of Defense, Siemens AG, and the Korea government, see sponsors for more information.
We provide binary packages packed for Debian and Red Hat derivatives. For other distributions we provide tgz archives. To install bap on a Debian derivative:
wget https://github.com/BinaryAnalysisPlatform/bap/releases/download/v1.3.0/{bap,libbap,libbap-dev}_1.3.0.deb
sudo dpkg -i {bap,libbap,libbap-dev}_1.3.0.deb
The binary release doesn't contain OCaml runtime, and is suitable only if you are not going to extend BAP using OCaml programming language (the recommended way). We recommend to use the OPAM package manager to install BAP and a development environment. After you've successfully installed OPAM, do the following:
opam init --comp=4.03.0 # install the compiler
eval `opam config env` # activate opam environment
opam depext --install bap # install bap
To use a specific version of llvm (we support 3.4, 3.8, and 4.0) specify the desired version explicitly via the conf-llvm
package, e.g.,
opam depext --install conf-llvm=3.8
opam depext --install conf-llvm=3.8 bap
Got any problems? Then visit our troubleshooting page or contact us directly via our Gitter chat.
The BAP main frontend is a command line utility called bap
. You can
use it to explore the binary, run existing analysis, plugin your own
behavior, load traces, and much more.
To dump a program in various formats use the --dump
option (or its short
equivalent, -d
), For example, let's run bap
on the
x86_64-linux-gnu-echo
file.