LCSAJdump is a static analysis framework designed to discover Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP) gadgets. Unlike traditional scanners, LCSAJdump is architecture-agnostic and employs a graph-based approach to uncover vulnerabilities invisible to common linear tools.

Why LCSAJdump?

Common ROP scanners use a linear "sliding-window" approach over the binary's executable bytes. This method systematically fails to identify Shadow Gadgets: execution chains that traverse non-contiguous memory blocks connected by unconditional jumps or conditional branches.

LCSAJdump overcomes this limitation by reconstructing the Control-Flow Graph (CFG) through LCSAJ (Linear Code Sequence and Jump) analysis. By modeling the binary as a directed graph of basic blocks, the tool identifies:

1. Contiguous Gadgets: Standard linear sequences terminating in a control-flow transfer.
2. Shadow Gadgets (Non-Contiguous): Complex chains that bypass "bad bytes" (e.g., null bytes) by utilizing instructions that would otherwise be unreachable via linear scanning.

Key Features

• Multi-Architecture Support: Native support for RISC-V (64GC), x86-64, and ARM64, easily extendable to other architectures via modular profiles.
• Graph-Based Analysis: Segments the .text section into LCSAJ basic blocks and reconstructs flow relationships through a custom-built reverse control-flow graph (lightweight adjacency representation, no heavyweight graph dependency).
• Rainbow BFS Algorithm: Proprietary backward Breadth-First Search starting from control-flow sinks. Now features an O(1) Early-Drop Uniqueness Filter and Hard-Cap Instruction Limits to prevent state explosion and ensure ultra-fast analysis even on dense CISC binaries.
• Lazy Graph Build: Graph construction retains only nodes reachable from gadget tails within --depth hops, drastically reducing memory and build time on large binaries (e.g., libc) while producing identical results.
• Two-Stage Ranking Engine: Combines a hyper-fast heuristic baseline (Bayesian-optimized via Optuna) with a deep-learning LightGBM ML model that refines gadget quality using structural and semantic features.
• Zero-Overhead Inference: The ML model is integrated natively and runs by default, processing tens of thousands of nodes in seconds. It acts as a highly effective filter, rejecting noisy jumps and returning clean, highly controllable gadget chains. Hosted on Hugging Face.
• Pruning Parameters: Configurable "Darkness" factor to balance analysis depth and performance, preventing infinite loops in cyclic graphs.

Supported Architectures

(see Benchmarks).

LCSAJdump is designed to be universal. Currently supported:

• RISC-V 64-bit (RV64GC): Full support for compressed 16-bit instructions.
• x86-64: Handles variable-length overlapping instructions. Safely navigates dense graphs without memory explosion.
• ARM64: Handles 32-bit instructions and deeply filters out bloated gadgets via strict heuristic penalties.
• Other Architectures: Can be easily implemented by defining new profiles in config.py.

Installation

Via Pip (Recommended)

From Source (Development)

Usage

LCSAJdump offers a powerful CLI for precise binary analysis:

Standard Analysis (Default RISC-V):

Advanced Analysis (Specifying Architecture and Output File):

Export as JSON with bad-char filter:

Note: Use -o after --json to save JSON to file. Without --json, -o saves plain text.

Save plain text output:

Analyze all executable sections:

Force strictly algorithmic ranking (bypass ML):

CLI Options

Accuracy & Benchmarks

LCSAJdump is backed by a rigorous, incrementally validated test suite located in the benchmarkTests/ directory.

Through 14 major iterations of semantic feature engineering, the hybrid model has learned to discriminate gadgets based on actual memory side-effects (extracted via angr symbolic execution) rather than purely syntactic heuristics.

Evaluated with group-aware 5-fold cross-validation (test binaries never seen during training), the ranker achieves NDCG@1 = 0.914 ± 0.047 and NDCG@10 = 0.922 ± 0.052, meaning the most useful gadgets are consistently placed at the top of the output. The Two-Stage engine successfully prioritizes clean stack-popping sequences and ret2csu-like calls, while heavily penalizing crash-prone fixed-offset jumps that deceive traditional static scanners.

Developer & ML Guide

The repository is structured to support both end-users and ML researchers.

• Production Engine: The core CLI seamlessly integrates the inference engine using models hosted on Hugging Face, requiring no manual model loading.
• ML Pipeline: The lcsajdump/ml_study/ directory contains the complete pipeline used to train the models:
  • build_dataset.py: Extracts structural and semantic features from a corpus of CTF binaries.
  • train_model.py: Trains the LightGBM LambdaRank model and outputs the .pkl models.
  • kfold_cv.py: Validates the dataset using K-Fold Cross Validation.

Contributing (Open for Forks!)

The framework is open to new implementations. To add a new architecture:

1. Fork the repository.
2. Open lcsajdump/core/config.py.
3. Add a new profile to the ARCH_PROFILES dictionary, defining jump mnemonics, return mnemonics, and registers for the desired architecture (e.g., x86_64).
4. Submit a Pull Request.

License

This project is released under the MIT license. See the LICENSE file for details.

Project Link

Visit the project web page: LCSAJdump web page