BinAnalysis
The Binary Vulnerability Analysis tool is an AI-powered scanner designed to detect vulnerabilities in binary files. Users can upload a bina...
Last verified:
What is BinAnalysis?
BinAnalysis is an AI-powered binary vulnerability scanner that accepts uploaded executable binaries, decompiles them, and searches for known vulnerabilities by comparing function-level embeddings against a large historical vulnerability dataset. The service decompiles binaries using Ghidra, cleans and normalizes code (removing filler and guessing symbols), then generates function-wise embeddings with a finetuned CodeT5+ model to perform similarity checks and pattern-based rule detection. Key features include similarity matching against DiverseVul and a 20k+ historical vulnerability corpus, Semgrep-based rule checks, and automated decompilation and cleaning steps to make binary analysis tractable. The tool is aimed at security researchers, reverse engineers, DevSecOps teams, and software vendors who need rapid, automated triage of binary artifacts for known vulnerabilities or similarity to previously observed vulnerable code.
BinAnalysis pricing
Pricing model: Free
The website indicates the service is available for free; there are no advertised paid plans or tiered pricing on the public site, and the analysis is provided at no cost.
BinAnalysis pros
- AI-driven function-level similarity detection
- Decompilation using Ghidra integrated into the workflow
- Function-wise embeddings from a finetuned CodeT5+ model
- Checks against a corpus of over 20,000 historical vulnerabilities
- Semgrep rule checks for pattern-based vulnerability detection
- Automated cleaning and symbol-guessing to improve analysis quality
- Works on arbitrary uploaded binary executables
- Fine-grained per-function analysis rather than whole-binary heuristics
- Can surface likely vulnerable code via similarity rather than exact signatures
- Useful for triage when source code is not available
- Combines multiple techniques (decompilation, embeddings, rules) for higher coverage
- Cloud-hosted web interface for easy uploads and results
- Analysis pipeline documented with steps and expected timing
- Reports that point to specific functions and matches for follow-up
- Free access (no paid tier required) making it accessible for testing
BinAnalysis cons
- Analysis can take several minutes for large files
- Detection limited to vulnerabilities present in its historical dataset
- Potential false positives from similarity-based matching
- Potential false negatives for novel vulnerability patterns
- Relies on quality of decompilation; obfuscated binaries may degrade results
- No clear enterprise-grade access controls documented on the site
- No published SLA or throughput guarantees for large-scale scanning
- No detailed pricing or paid support tiers available on the site
Frequently asked questions about BinAnalysis
How do I submit a binary for analysis?
You upload your executable binary file through the web interface; the site then queues the file for analysis, which begins with decompilation using Ghidra followed by cleaning, symbol guessing, embedding generation, and vulnerability checks.
What analysis steps does BinAnalysis perform?
The pipeline decompiles the executable with Ghidra, removes filler and formats the code, guesses symbols and inlines functions where appropriate, generates function-wise embeddings using a finetuned CodeT5+ model, checks similarity against a historical vulnerability corpus and DiverseVul dataset, and runs Semgrep-based rule checks.
Which vulnerability datasets and models are used?
BinAnalysis uses a historical vulnerabilities corpus of over 20,000 entries, the DiverseVul dataset for similarity checks, Big Clone Bench and CodeSearchNet for embedding training contexts, and a finetuned CodeT5+ embedding model for function-level embeddings.
How long does an analysis take?
Analysis time varies by file size and complexity; the site notes the process can take up to about 10 minutes for typical uploads, with larger or more complex binaries taking longer.
Can BinAnalysis find zero-day or previously unknown vulnerabilities?
The tool is optimized for detecting similarities to known historical vulnerabilities and rule-based patterns from Semgrep, so it is more effective at flagging known or similar issues rather than discovering entirely novel zero-day vulnerabilities.
What formats of binaries are supported?
The service accepts executable binary files (the site references general executables); since it uses Ghidra for decompilation it can handle formats supported by Ghidra, though exact supported formats are not exhaustively listed on the public page.
Will my uploaded binaries be stored or shared?
The public site describes the analysis workflow but does not provide a detailed public data retention or sharing policy; users should assume uploads are processed by the service and verify privacy requirements before sending sensitive binaries.
How are results presented?
Results include decompiled/cleaned function views, similarity matches to historical vulnerabilities, and Semgrep rule hits, with references to the matched functions to aid manual triage and remediation.
Are there integrations or an API for automation?
The public site focuses on the web upload workflow and does not prominently document a public API or CI/CD integrations; users seeking automation should contact the maintainers or check for undocumented endpoints.
Is there commercial support or enterprise offerings?
No paid plans, enterprise support options, or SLAs are listed on the public website; the service is presented as free, so organizations requiring commercial support should reach out directly to inquire about custom arrangements.