Catalog PyPI
PACKAGE EXPLORERView in registry

ablation-tool

PyPI

Semantic function matching for stripped firmware. No symbols. No source. No setup.

Versions collected1
Direct dependencies8From release 2.81.0
Last observed20 Oct, 17:28 UTC

README

Version 2.81.0 documentation
ABLATION

NIST SP 800-218 CISA Secure by Design MIL-HDBK-115C

Ablation is a self-contained reverse engineering framework.

It depends on neither legacy tools nor an MCP server, which removes the attack surface associated with MCP.

When used with Codex or Claude Code, it operates as an autonomous reverse engineering system.


Claude Code Setup & Configuration

Quick Start

1. Launch Session

cd ~/ablation && claude

2. Set Model

/model claude-sonnet-4-6

or

/model claude-sonnet-4-5

3. Define Objective

/goal reverse engineer [whatever you want]

4. Check Effort Level

Not sure what effort level to be set on? Ask inline without interrupting the main context:

/btw What effort level should we be set on right now?

Auto-compact                             true
Continue automatically at usage limit    true
Switch models when a message is flagged  Switch automatically
Show tips                                false
Claude-drafted feedback                  off
Reduce motion                            false
Thinking mode                            true
Fast mode (Opus 5.5)                     false
Prompt suggestions                       true
Session recap                            true
Rewind code (checkpoints)                true
Dynamic workflows                        true
Ultracode keyword trigger                false
Dynamic workflow size                    unrestricted
Artifacts                                false
Verbose output                           true
Terminal progress bar                    true
Show turn duration                       true
Time format                              auto
Default permission mode                  Manual
Worktree base ref                        fresh
Use auto mode during plan                true
Respect .gitignore in file picker        true
Skip the /copy picker                    false
Copy on select                           true
Auto-scroll                              true
Open agents view by default              false
← opens agents                           false
Auto-update channel                      disabled (config)
Theme                                    Dark mode (colorblind-friendly)
Local notifications                      Auto
Push when actions required               true
Push when Claude decides                 true
Output style                             Explanatory
Language                                 Default (English)
Editor mode                              normal
Question auto-continue timeout           never
Show last response in external editor    true
Show PR status footer                    true
Model                                    claude-sonnet-4-6
Auto-connect to IDE (external terminal)  true
Claude in Chrome enabled by default      true
Enable Remote Control for all sessions   false
Dialog expiry                            never
Messages from your other sessions        accept

demo

Capabilities

Core Analysis Engine
Capability
On-Demand AnalysisLoads in seconds because it only analyzes the code being examined. A 2 GB firmware image opens as fast as a small one because nothing is parsed until it is needed.
Binary LiftingTranslates machine code to readable pseudo-C across 31 architectures. ARM64 and x86-64 get register-level taint tracking so data flow is visible in the lifted output.
Semantic Code SearchFinds functions by describing what they do because stripped binaries have no symbols to search. Queries are scoped to the target binary so results return in under a second.
Hypothesis EngineTracks competing theories about what a function does and scores evidence against each one. Sessions persist across engagements so analysis resumes where it left off.
DAG Adapter LanguageEvery architecture shares the same analysis code path because each ISA compiles to a directed acyclic graph. Adding a new ISA takes one grammar file, so the architecture count grows without multiplying the codebase.
Entropy MapperMaps binary sections by Shannon entropy to classify encrypted, compressed, and plaintext regions before analysis begins. Sections approaching H=8.0 indicate AES or compressed data so analysis effort concentrates on decrypted plaintext regions first.
Learning & Continuity
Capability
The FlywheelEvery confirmed finding replays as a search pattern on every future binary. A vulnerability confirmed on one vendor's firmware surfaces automatically when sweeping a different vendor's binary because confirmed findings are stored and replayed at engagement start.
Cross-Target LearningExtracts a transferable signature from every confirmed finding and stores it in the pattern library so the tool grows sharper across targets. The Flywheel replays those signatures; this module generates them.
KASAN-OracleScans a KASAN debug build first because debug builds expose control flow that stripping removes. Confirmed candidates from the debug build then validate against the stripped production binary, so the debug image acts as a ground-truth oracle rather than a secondary target.
Vulnerability Discovery & Validation
Capability
Taint AnalysisFollows network input through the call graph to security-sensitive sinks across 16 architectures. Library call sites do not stop the trace because register-level tracking resolves shared library stubs.
Cross-Library AnalysisTraces an argument across up to three shared library hops so taint paths that cross library boundaries reach their sink rather than stopping at the first call.
Pre-Authentication ExposureFinds every code path from the network entry point to a security-sensitive operation that runs before authentication. Manual review starts at the authentication boundary because the output is a reachability map, not a raw disassembly.
Sink Arg ClassifierClassifies what value reaches each exec-class sink so a taint hit is either confirmed as externally controlled or eliminated as a constant before manual review begins.
Finding ValidationGenerates a working HTTP request that reproduces each confirmed finding at the protocol level. The request includes the expected response delta and CWE classification so a PSIRT submission arrives with working proof.
Compiler Defect DetectionFinds security defects that the compiler introduced through miscompilation. Optimizer defects that silently select the wrong comparison operand can produce hundreds of confirmed vulnerabilities across a single firmware image.
Source Code AuditingScores every source file by risk and batches the low-risk ones so manual review covers only the files most likely to contain vulnerabilities.
Cryptographic AnalysisRecovers cryptographic key material directly from compiled firmware and audits TLS and JWT configurations, so cryptographic findings do not require source access or a decryption oracle.
Protocol FSM ExtractorExtracts the handshake state machine from network protocols in stripped ARM64 binaries using static loop and BSS state-variable analysis. Authentication state transitions become explicit without a running server or traffic capture.
BMP LSB Key ExtractorRecovers cryptographic key material hidden in BMP pixel LSBs using a Shamir-style Lagrange polynomial secret-sharing scheme. Firmware and APK packages that conceal keys in image assets are handled without prior knowledge of the encoding.
Format String ScannerIdentifies format string vulnerabilities across the full printf family, syslog, and custom logging functions by tracing format argument provenance in x86-64 ELF binaries. Every call site where the format argument is not a .rodata string literal is a finding.
Heap Vulnerability ScannerDetects heap use-after-free, double-free, and overflow patterns in x86-64 and LoongArch64 binaries using a forward symbolic pass tracking pointer state across allocation and free operations. Static analysis produces heap findings in firmware that cannot be fuzz-tested.
SQL Injection ScannerDetects raw SQL injection in C/C++ binaries that call the MySQL C API or SQLite3 directly without a prepared-statement layer. Chains format-string builder analysis to SQL sink tracing so snprintf-to-mysql_query patterns surface that a format string scanner alone would miss.
RPC Server AnalyzerEnumerates Windows RPC server interfaces and flags those registered with RPC_C_AUTHN_LEVEL_NONE so any caller can reach the interface without credentials. Pairs with Windows PE Security Analysis for RPC coverage.
IOCTL Attack SurfaceMaps the IOCTL dispatch surface of a Windows kernel driver and flags METHOD_NEITHER codes before manual review begins. An integer-overflow path from a user-supplied length to a kernel allocation is a HIGH finding.
Length Underflow ScannerDetects integer underflow in protocol parsers where a user-supplied length field has a fixed header size subtracted, wraps on truncation, and reaches a downstream allocation or copy without a prior bounds check.
Setuid Auth OracleIdentifies setuid binaries that call getspnam and crypt without PAM mediation, exposing a brute-force oracle because exit-code-based result disclosure bypasses rate limiting that pam_tally2 and faillock enforce. Absence of pam_start in the PLT surfaces candidates without a taint run.
Lua Injection AnalyzerDetects unsanitized user-controlled strings passed to a Lua runtime via Python format operations. Built from two CRITICAL findings in FortiAnalyzer and FortiManager where no other scanner detected the class.
Specialized Recovery
Capability
C++ Vtable ReconstructionRecovers C++ virtual dispatch tables from stripped ELF binaries on any architecture and names each slot. A generated type-annotation script propagates slot names through every call site so the decompiler shows method names instead of function pointer offsets.
PPC32 GOT2 ResolverResolves indirect calls in stripped GOT2-PIC PPC32 binaries at 98.6% coverage so taint paths through BCTRL stubs do not dead-end at the first unresolved call.
Dynamic SandboxExecutes leaf functions in an emulated sandbox to fingerprint behavior where static analysis alone cannot distinguish branches.
Firmware ExtractionDecrypts vendor-encrypted firmware without a key because predictable patterns in inner partitions reveal it. Handles vendor-modified squashfs images including ARM64 BCJ-filtered variants.
Firmware Key CorpusClassifies recovered firmware keys against a cross-image family table. An anomalous key count flags a potential finding before decryption begins.
Platform & Runtime Support
Capability
Windows PE Security AnalysisAudits a Windows PE binary for security weaknesses in a single pass. It checks CFG bypass exports, SafeSEH gaps, unauthenticated RPC endpoints, COM registration gaps, and kernel pool overflows so the attack surface is visible before manual review begins.
Windows Kernel Driver & BYOVDClassifies signed kernel drivers for BYOVD capability before they are deployed. Physical memory access, privilege token manipulation, and callback removal each trigger a finding.
Android / APK AnalysisMaps the APK attack surface and ranks native libraries by risk before manual analysis begins.
HarmonyOS / ArkTS AnalysisAnalyzes HarmonyOS HAP packages and ArkTS bytecode so OpenHarmony targets can be assessed without source access. Surfaces exported abilities, permission grants, and native library attack surface before manual review begins.
Go Binary Reverse EngineeringRecovers function names from stripped Go binaries because the runtime embeds a metadata table that survives stripping.
Erlang / BEAM AnalysisDecodes BEAM bytecode to readable pseudo-IR so Erlang and Elixir applications can be analyzed without source. High-risk import patterns and obfuscation indicators surface without executing the application.
MicroPython .mpy LifterLifts .mpy v6 bytecode to readable pseudo-Python so MicroPython firmware on ESP32, STM32, and CC13xx targets can be analyzed without source. Flags dangerous imports and machine-level memory access calls in the lifted output.
Game & Legacy RELabels stripped game binary functions by engine so analysis starts at the game logic layer instead of the engine layer. Also handles PS3 Cell SPU and classic Mac OS PEF binaries.
PS3 SELF DecryptorDecrypts PS3 SELF (Signed ELF) files to plain ELF because lief and BinaryContext reject SCE-format magic. Keyset detection is automatic from the key_rev field so no manual key lookup is needed.
MCP Server Security ScannerScans MCP server source for unauthenticated endpoints, exec-class methods in allowed tool lists, and network-wide socket bindings. All three issue classes appeared in production MCP servers where no other scanner detected them.
LoongArch64The only public reverse engineering toolkit built specifically for LoongArch64. Every analysis phase works without architecture-specific workarounds.
nanoMIPSFollows tainted data through nanoMIPS binaries interprocedurally, resolving branch targets and PLT stubs that no other public tool handles.
Automotive ECU Analysis
Capability
ECU Architecture DetectorIdentifies the ISA of a flat ECU ROM from raw bytes alone. PPC32, SH-2A, TriCore, RH850, V850, M68K, C28x, and M32R all produce recognizable structural signatures without symbols or file headers.
ROM Layout AnalyzerSplits a flat ROM into CODE, CALIBRATION, and IVT regions before analysis begins. The interrupt vector table is excluded from function discovery so taint trackers start from clean application code boundaries.
Calibration ParsersReads TunerPro XDF, ASAM A2L, RomRaider XML, open_damos, ConesCAN, and Nissan Pytrex definition files and injects human-readable table labels into BinaryContext. Every array in the ROM has a name when the taint tracker reaches it.
CAN DBC ParserReads CAN signal database files and makes message and signal definitions available during binary analysis. No other RE tool brings CAN signal context into the taint analysis pipeline.
ECU Security Access ScannerAudits UDS SecurityAccess implementations for weak seed generation, static keys, and bypassable challenge-response logic. Runs before taint analysis so weak authentication findings are confirmed before deeper code tracing begins.
TriCore Taint AnalysisFollows attacker-controlled data to security-sensitive sinks in Infineon TriCore AURIX TC1.6x ECU firmware using the GHS EABI and IAR EABI calling conventions. Automotive targets on TriCore receive the same interprocedural taint coverage as ARM64 and x86-64.
RH850 Taint AnalysisFollows attacker-controlled data through Renesas RH850 ECU firmware using the GHS CC-RH and IAR RH850 ABIs. Flat ROM support handles images shipped without ELF headers because most automotive RH850 firmware ships without them.
Workflow & Quality Gates
Capability
Version DiffingChecks whether the logic changed, not whether the file changed, so a cosmetic recompile cannot hide an unpatched vulnerability.
Kernel Module Subsystem ClassifierClassifies a Linux kernel module by its source tree path to determine attack surface before analysis begins. Network-reachable modules surface first so manual review starts at the highest-risk code.
Module Quality GateFORGE audits every user-written module before it can be stored, so local extensions meet the same standard as the modules that ship with Ablation. Every HIGH and CRITICAL finding is tagged with the pipeline stage where it would surface without the audit, from a free static-check catch at develop time to an 18x-cost find in production.
Coverage GateThe taint engine requires 85% statement coverage on every commit, so a regression in taint logic fails the test suite before it reaches a firmware engagement.
YARA Rule GenerationSynthesizes YARA detection rules from PE and ELF scanner findings so confirmed vulnerability signatures are immediately deployable in detection pipelines without manual rule authoring.
31 Decompilers
Native CPUs
ISAVariants
x86x86-32 · x86-64
ARMARM-32 · ARM-64 · Thumb
MIPSMIPS-32 · nanoMIPS · MIPS-64
PowerPCPPC-32 · PPC-64 · VLE
RISC-VRV32 · RV64 · HiSilicon ext
ARCARC EM/HS
LoongArchLoongArch64
Intel MCS8051
Automotive ECUs
ISAVariants
V850 / RH850V850-32 · RH850
Renesas SHSH-2A
MotorolaM68K / CPU32 · MC88100
InfineonTriCore TC1.6x
TI DSPTMS320C28x
VMs & Runtimes
ISAVariants
DEXDalvik · ART
ARKArkTS
BEAMErlang · Elixir
MicroPython.mpy v6

Project Background

Real-World Results

Real-World Results

Ablation has been used to analyze production firmware and kernel drivers from Cisco, Fortinet, TencentOS, Huawei, and more.

Following coordinated disclosure, the Cisco Product Security Incident Response Team (PSIRT) adopted Ablation for internal vulnerability triage and continues to use it to evaluate ongoing disclosure reports. Cisco Adaptive Security Appliance (ASA) LINA is among the artifacts analyzed, with findings submitted through CERT/CC VINCE.

CVEProductTitleCVSS
CVE‑2026‑76420Secure Firewall Management Center (FMC)Peer Impersonation9.0 Critical
CVE‑2026‑76412Secure Firewall Management Center (FMC)Privilege Escalation to root8.5 High
CVE‑2026‑76413Secure Firewall Management Center (FMC)Single Sign-On Token Forgery8.5 High
CVE‑2026‑76447Identity Services Engine (ISE)OCSP Responder Authentication Bypass5.3 Medium

Acknowledgments

Acknowledgments

The code couldn't exist without their ideas. Though no code was written by these authors, doctors, and engineers their work has direct influence on the production of code that makes Ablation what it is.

Research Papers

TitleAuthors
Reverse Compilation Techniques · Specifying the Semantics of Machine Instructions · UQBT: Adaptable Binary Translation at Low Cost · Machine-Adaptable Dynamic Binary TranslationDr. Cristina Cifuentes
Design of a Retargetable Decompiler for a Static Platform-Independent Malware AnalysisPetr Zemek, Lukáš Ďurfina, Jakub Křoustek, Dušan Kolář, Tomas Hruska, Karel Masařík, Alexander Meduna
Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias AnalysisCheng, Zheng, Liu, Guan, Liu, Li, Zhu, Ye, Sun
iResolveX: Multi-Layered Indirect Call Resolution via Static Reasoning and Learning-Augmented RefinementMonika Santra, Bokai Zhang, Mark Lim, Vishnu Asutosh Dasu, Dongrui Zeng, Gang Tan
Extracting Protocol Format as State Machine via Controlled Static Loop AnalysisQingkai Shi, Xiangzhe Xu, Xiangyu Zhang
NEMETYL: Message Type Identification of Binary Network Protocols using Continuous Segment SimilarityStephan Kleber, Rens Wouter van der Heijden, Frank Kargl
Imperfect Forward Secrecy: How Diffie-Hellman Fails in PracticeDavid Adrian, Karthikeyan Bhargavan, Zakir Durumeric, Pierrick Gaudry, Matthew Green, J. Alex Halderman, Nadia Heninger, Drew Springall, Emmanuel Thomé, Luke Valenta
Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLSHanno Böck, Aaron Zauner, Sean Devlin, Juraj Somorovsky, Philipp Jovanovic
Whitening Sentence Representations for Better Semantics and Faster RetrievalJianlin Su, Jiarun Cao, Weijie Liu, Yangyiwen Ou
Constant Propagation with Conditional BranchesMark N. Wegman, F. Kenneth Zadeck
A Simple, Fast Dominance AlgorithmCooper, Harvey, Kennedy
libdft: Practical Dynamic Data Flow Tracking for Commodity SystemsVasileios P. Kemerlis, Georgios Portokalidis, Kangkook Jee, Angelos D. Keromytis

Books supplied by www.oreilly.com | github.com/oreillymedia

TitleAuthors
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh
Practical Binary AnalysisDennis Andriesse
Practical Malware AnalysisMichael Sikorski, Andrew Honig
Practical Reverse EngineeringBruce Dang, Alexandre Gazet, Elias Bachaalany
Hacking: The Art of Exploitation (2e)Jon Erickson
Learning Linux Binary AnalysisRyan O'Neill
Windows Internals Part 1 & 2Pavel Yosifovich, Mark Russinovich, David Solomon, Alex Ionescu, Andrea Allievi
Rootkits: Subverting the Windows KernelGreg Hoglund, Jamie Butler
Advanced Compiler Design and ImplementationSteven Muchnick
Engineering a CompilerKeith Cooper, Linda Torczon
Practical IoT HackingFotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Woods
Inside the Android OS: Building, Customizing, Managing and Operating Android System ServicesG. Blake Meike
Malware Analysis and Detection EngineeringAbhijit Mohanta, Anoop Saldanha
Evasive MalwareKyle Cucci
Hacking CryptographyKamran Khan, Bill Cox
Real-World CryptographyDavid Wong

Honorable Mention

Microsoft Excel (Data Analysis ToolPak) When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.


Demonstrations

Ablation in Action

Ablation in Action

How to Use Ablation

How to Use Ablation

Learn as You RE

Learn as You RE

Getting Started

Install

Install

Do not run pip install ablation. An unrelated package occupies that name on PyPI. You will install the wrong thing and see no error.

From PyPI:

pip install ablation-tool

With LLM features (anthropic client):

pip install "ablation-tool[llm]"

Verified install (pinned commit SHA) — pip rejects any substitution:

pip install -r requirements-verified.txt

Local / development:

git clone https://github.com/Ablation-Tool/ablation.git ~/ablation
pip install -e ~/ablation/

Verify the install:

python -c "import ablation; print(ablation.__version__)"
python -c "from ablation.analyzers.binary_context import BinaryContext; print('ok')"

Requirements

Requirements

  • Python >= 3.10
  • capstone, numpy, lief, sentence-transformers, pyelftools

Responsible Use

Responsible Use

Ablation is built for authorized security research. Use it only against systems you own or have explicit written permission to test. Running it against systems without authorization violates computer fraud laws in most jurisdictions. The author is not responsible for misuse.


Standards

Standards

NIST SP 800-218

This defines how software should be built, organized around four practice areas: preparing the development environment, protecting the codebase from unauthorized changes, writing software with security built into every layer, and responding when vulnerabilities surface after release.

What this means for Ablation in practice is a mandatory ten-section security audit on every module before it touches the repository.

The audit covers input validation, memory handling, integer safety, error handling, concurrency, dependency security, injection prevention, secrets handling, logging, and residual risks.

No module is committed without passing it.

Taint trackers, which are the modules that matter most if they get something wrong, carry an additional requirement: 85% statement coverage enforced by a hard gate in the test suite, verified against byte-exact synthetic instruction sequences that test ABI register behavior, not just whether the code runs without crashing.

Dependencies are pinned with exact hashes and scanned weekly for known CVEs.

CISA Secure by Design

CISA asks software manufacturers to commit to three things: take ownership of the security outcomes of the people who rely on the software, be transparent about its limitations, and treat security as a requirement rather than a recommendation.

For a RE framework, taking ownership of security outcomes has a specific meaning.

A taint tracker that misses a vulnerability does not just produce a wrong answer.

It produces a result someone may act on as evidence the binary is clean.

That is why a false negative in any Ablation taint tracker is classified as a CRITICAL defect.

Every tracker ships with a documented known-anomalies file describing the exact conditions under which it can produce false negatives, so a researcher knows when to apply manual verification on top of the automated result.

The precommit gate is not advisory. No code enters the repository without passing it.

MIL-HDBK-115C

The US Department of Defense handbook for reverse engineering methodology.

It defines four phases:

Phase 1. Every engagement starts with a session file recording the target description, artifact hash, tool selection, and documentation plan before any analysis runs. The rule that semantic search runs before manual disassembly maps to the following phase.

Phase 2 Requires characterizing a binary at the function level before doing detailed trace work. The DynamicSandbox covers the following.

Phase 3. The structured retrospective written at the close of every completed project maps to the final phase.

Phase 4. The standards document tracks 29 specific requirements drawn from all three frameworks. All 29 are met.

Contact

Contact

Feel free to contact me if you have any questions, ideas, complaints or bugs.

📧 ablation@nuclide-research.com
𝕏 @showxlate


Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Versions 1

Collected releases
VersionPublishedDirect dependenciesOpen version
2.81.015 Oct 20268

Package advisories

0
No matching advisories collected

This describes our collected data; it is not a security assessment.

Repository

PENDING
ablation-tool/ablation

Shared repository data · GitHub

License detected in repository
Not collected

Metadata history

Meaningful changes
Current collected state Current

Observed since 20 Oct, 17:28 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package:fca000a97f7f251dd3aa63793f26420a7c4f85f524ac2bf64aecaae5a08012b8