reait - RevEng.AI Toolkit and Python API

项目说明

reait

![Python package]()

<ins>R</ins>ev<ins>E</ins>ng.<ins>AI</ins> <ins>T</ins>oolkit

Analyse compiled executable binaries using the RevEng.AI API. This tool allows you to search for similar components across different compiled executable programs, identify known in stripped executables, and generate "YARA++" REAI signatures for entire binary files. More details about the API can be found at docs.reveng.ai.

NB: We are in Alpha. We support GNU/Linux ELF and Windows PE executables for x86_64, and focus our support for x86_64 Linux ELF executables.

Installation

Install the latest stable using pip3.

Latest de

or

Using reait

Analysing binaries

To submit a binary for analysis, run reait with the -a flag:

This uploads the binary specified by -b to RevEng.AI servers for analysis. Depending on the size of the binary, it may take several hours. You may check an analysis jobs progress with the -l flag e.g. reait -b /usr/bin/true -l.

Extract symbol embeddings

Symbol embeddings are numerical representations of each component that capture their semantic understanding. Similar functions should be similar to each other in our embedded space. They can be thought of as *ad* AI-based IDA FLIRT signatures or Radare2 Zignatures.
Once an analysis is complete, you may access RevEng.AI's BinNet embeddings for all symbols extracted with the -x flag.

Search for similar symbols using an embedding

To query our database of similar symbols based on an embedding, use -n to search using Approximate Nearest Neighbours. The --nns allows you to specify the number of results returned. A list of symbols with their names, distance (similarity), RevEng.AI collection set, source code filename, source code line number, and file creation timestamp is returned.

The following command searches for the top 10 most similar symbols found in md5sum.gcc.og.dynamic to the symbol starting at _0x33E6_ in md5sum.clang.og.dynamic. You may need to pass --image-base to ensure addresses are mapped correctly.

Search NN by symbol name.

NB: A smaller distance indicates a higher degree of similarity.

#### Specific Search
To search for the most similar symbols found in a specific binary, use the --found-in option with a path to the executable to search from.

This downloads embeddings from malware.exe and computes the cosine similarity between all symbols and sha256_init.json. The returned results lists the most similar symbol locations by cosine similarity score (1.0 most similar, -1.0 dissimilar).

The --from-file option may also be used to limit the search to a custom file containing a JSON list of embeddings.

#### Limited Search
To search for most similar symbols from a set of RevEng.AI collections, use the --collections options with a RegEx to match collection names. For example:

RevEng.AI collections are sets of pre-analysed executable objects. To create custom collection sets e.g., malware collections, please create a RevEng.AI account.

Unstripping binaries

Find common components between binaries, RevEng.AI collections, or global search, by using -M, --match.

Example usage:

RevEng.AI embedding models

To use specific RevEng.AI AI models, or for training custom models, use -m to specify the model. The default option is to use the latest de model. A models are binnet-0.1 and dexter.

Software Composition Analysis

To identify known open source software components embedded inside a binary, use the -C flag.

Binary ANN Search

To perform binary ANN search, pass in -n and -s flag at the same time. For example:

Configuration

reait reads the config file stored at ~/.reait.toml. An example config file looks like:

Contact

Connect with us by filling out the contact form at RevEng.AI.

项目信息

开发语言：Python

Star 数：33

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕RevEng.AI Toolkit and Python API展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。