VulHunt Community Edition

VulHunt 是一个由 Binarly 研究团队开发的漏洞狩猎框架。它旨在帮助安全研究人员和从业者识别软件二进制文件和 UEFI 固件中的漏洞。VulHunt 构建于 Binarly 的二进制分析与检测系统（BIAS）之上，该系统为分析和理解二进制文件提供了强大而灵活的环境。VulHunt 与 Binarly 透明度平台（BTP）的能力集成，以实现大规模漏洞管理、狩猎与分诊能力。

VulHunt Community Edition 是 BTP 中 VulHunt 引擎的免费开源版本，旨在促进社区开发的规则包和集成。

Building (with cargo-make)

Prerequisites

cargo install cargo-make

Building

cargo make --profile <development|release> build

With support for Binary Ninja:

cargo make --profile <development|release> build --features=bndb

Installation

cargo make --profile <development|release> install

With support for Binary Ninja:

cargo make --profile <development|release> install --features=bndb

Building (without cargo-make)

Prerequisites

git submodule update --init

Install LuaJIT with requisite patches:

git clone https://github.com/LuaJIT/LuaJIT.git -b v2.1
cd LuaJIT
git apply /path/to/vulhunt-ce/patches/luajit-vulhunt.patch

For macOS:

export MACOSX_DEPLOYMENT_TARGET=$(sw_vers -productVersion)

For macOS and Linux:

make BUILDMODE='static'
export LUA_LIB=/path/to/LuaJIT/src/
export LUA_LIB_NAME=luajit
export LUA_LINK=static

For Windows:

cd src
msvcbuild.bat BUILDMODE='static'
set LUA_LIB=C:\path\to\LuaJIT\src\
set LUA_LIB_NAME=lua51
set LUA_LINK=static

Building

cargo build --release

With support for Binary Ninja:

cargo build --release --features=bndb

Packaging

Prerequisites:

cargo install cargo-make

Build packages for the current platform:

cargo make prepare-package --features=...

Usage

Scanning binaries

vulhunt-ce scan <INPUT> -o <OUTPUT> -d <BIAS_DATA> -r <RULES> [OPTIONS]

Options:

• <INPUT>: Path to the binary, BA2 archive, or BNDB file to scan
• -o, --output <OUTPUT>: Path to write output JSON
• -d, --data <BIAS_DATA>: Directory containing auxiliary data (processor specifications, etc.). Can also be set via BIAS_DATA environment variable
• -r, --rules <RULES>: Directory containing VulHunt rules. Can also be set via BIAS_VULHUNT_RULES environment variable
• -m, --modules <MODULES>: Directory containing VulHunt modules (optional). Can also be set via BIAS_VULHUNT_MODULES environment variable
• --loader <LOADER>: Configure the loader to use (default: component). Available loaders:
  • component: Scan single binary files
  • ba2: Scan BA2 (Binarly Archive 2) archives containing multiple components

Example:

vulhunt-ce scan lib.so -o results.json -d /path/to/bias-data -r /path/to/rules --pretty
vulhunt-ce scan firmware.ba2 --loader ba2 -o results.json -d /path/to/bias-data -r /path/to/rules --pretty
vulhunt-ce scan project.bndb --loader bndb -o results.json -d /path/to/bias-data -r /path/to/rules --pretty

Starting the MCP server

VulHunt 可以作为 MCP（模型上下文协议）服务器运行，以便与 AI 助手集成。默认情况下，它会启动一个使用 SSE（服务器发送事件）传输的流式 HTTP 服务器，地址为 http://127.0.0.1:8080：

vulhunt-ce mcp -d <BIAS_DATA> [OPTIONS]

Options:

• -d, --data <BIAS_DATA>: Directory containing auxiliary data (required). Can also be set via BIAS_DATA environment variable
• -m, --modules <MODULES>: Directory containing VulHunt modules (optional). Can also be set via BIAS_VULHUNT_MODULES environment variable
• --stdio: Use stdio transport instead of HTTP
• --host <HOST>: Host address to bind (default: 127.0.0.1)
• --port <PORT>: Port to listen on (default: 8080)

BA2 archive utilities

List components in a BA2 archive:

vulhunt-ce ba2 list-components <INPUT>

Extract a component from a BA2 archive:

vulhunt-ce ba2 extract-component <INPUT> -o <OUTPUT> --component-id <UUID>

Options:

• <INPUT>: Path to the BA2 archive
• -o, --output <OUTPUT>: Output path for the extracted component
• --component-id <UUID>: UUID of the component to extract

BTP integration

Interact with the Binarly Transparency Platform (BTP). All commands require authentication:

Common options:

• -u, --username <USERNAME>: BTP username (or BTP_USERNAME env var)
• -p, --password <PASSWORD>: BTP password (or BTP_PASSWORD env var)
• -s, --instance-slug <SLUG>: Instance slug, e.g., your-org.prod (or BTP_INSTANCE_SLUG env var)

Available commands:

vulhunt-ce btp push-rules <INPUTS> -r <REPOSITORY> [-t <TAG>] [--name <NAME>] [--platform <posix|uefi>] [--modules <DIR>] [--deploy-to-product <ULID> | --deploy-to-org <ULID>]
vulhunt-ce btp list-products
vulhunt-ce btp create-product --name <NAME> [--description]
vulhunt-ce btp upload <FILE> --product-id <ULID> --name <NAME> --version <VERSION> [--scan]
vulhunt-ce btp list-images --product-id <ULID>
vulhunt-ce btp list-scans --product-id <ULID> --image-id <ULID>
vulhunt-ce btp create-scan --product-id <ULID> --image-id <ULID>
vulhunt-ce btp get-scan --product-id <ULID> --image-id <ULID> --scan-id <ULID>
vulhunt-ce btp get-findings --product-id <ULID> --image-id <ULID>
vulhunt-ce btp download-ba2 --product-id <ULID> --image-id <ULID> [--scan-id <ULID>] [-o <OUTPUT>]

License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

Copyright (c) 2026 Binarly Inc. and VulHunt developers.