Triton

**Triton** is a dynamic binary analysis library. It provides internal components that allow you to build your program analysis tools, automate reverse engineering, perform software verification or just emulate code. * Dynamic **symbolic** execution * Dynamic **taint** analysis * AST representation of the **x86**, **x86-64**, **ARM32**, **AArch64** and **RISC-V 32/64** ISA semantic * Expressions **synthesis** * SMT **simplification** passes * **Lifting** to **LLVM** as well as **Z3** and back * **SMT solver** interface to **Z3** and **Bitwuzla** * **C++** and **Python** API

As **Triton** is a kind of a part-time project, please, **don't blame us** if it is not fully reliable. [Open issues](https://github.com/JonathanSalwan/Triton/issues) or [pull requests](https://github.com/JonathanSalwan/Triton/pulls) are always better than trolling =). However, you can follow the development on twitter [@qb_triton](https://twitter.com/qb_triton).

           

# Quick start * [Installation](#install) * [Python API](https://triton-library.github.io/documentation/doxygen/py_triton_page.html) * [C++ API](https://triton-library.github.io/documentation/doxygen/annotated.html) * [Python Examples](https://github.com/JonathanSalwan/Triton/tree/master/src/examples/python) * [They already used Triton](#they-already-used-triton) ## Getting started ``` … ``` ## Install using pip Triton can be installed using `pip`: ```console pip install triton-library ``` ## Install from source Triton relies on the following dependencies: ``` * libcapstone >= 5.0.x https://github.com/capstone-engine/capstone * libboost (optional) >= 1.68 * libpython (optional) >= 3.6 * libz3 (optional) >= 4.6.0 https://github.com/Z3Prover/z3 * libbitwuzla (optional) >= 0.4.x https://github.com/bitwuzla/bitwuzla * llvm (optional) >= 12 ``` ### Linux and MacOS ```console $ git clone https://github.com/JonathanSalwan/Triton $ cd Triton $ mkdir build ; cd build $ cmake .. $ make -j3 $ sudo make install ``` By default, LLVM and Bitwuzla are not compiled. If you want to enjoy the full power of Triton, the cmake compile is: ```console $ cmake -DLLVM_INTERFACE=ON -DCMAKE_PREFIX_PATH=$(llvm-config --prefix) -DBITWUZLA_INTERFACE=ON .. ``` #### MacOS M1 Note: In case if you get compilation errors like: ``` Could NOT find PythonLibs (missing: PYTHON_LIBRARIES PYTHON_INCLUDE_DIRS) ``` Try to specify `PYTHON_EXECUTABLE`, `PYTHON_LIBRARIES` and `PYTHON_INCLUDE_DIRS` for your specific Python version: ```console cmake -DCMAKE_INSTALL_PREFIX=/opt/homebrew/ \ -DPYTHON_EXECUTABLE=/opt/homebrew/bin/python3 \ -DPYTHON_LIBRARIES=/opt/homebrew/Cellar/[email protected]/3.10.8/Frameworks/Python.framework/Versions/3.10/lib/libpython3.10.dylib \ -DPYTHON_INCLUDE_DIRS=/opt/homebrew/opt/[email protected]/Frameworks/Python.framework/Versions/3.10/include/python3.10/ \ .. ``` This information you can get out from this snippet: ```python from sysconfig import get_paths info = get_paths() print(info) ``` #### Python Autocompletion If Python autocompletion is not working, follow these steps: 1. Execute the [script](doc/autocomplete/generate_autocomplete.py) 2. Place the generated triton.pyi file in the same directory as the Triton shared object you want to provide hints for (for example, `/usr/lib/python3.13/`). Your IDE must support parsing .pyi files. ### Windows You can use cmake to generate the .sln file of libTriton. ``` … ``` You can use setup.py to generate the debug version of triton.pyd on Windows. ```console > git clone https://github.com/JonathanSalwan/Triton.git > cd Triton > $env:COMPILER_DIR="C:/deps/llvm/llvm2116r/bin" > $env:CMAKE_PREFIX_PATH="C:/deps/llvm/llvm-project-21.1.6.src/install/lib/cmake/llvm;C:/code/cxx-common-cmake/build/install" > python_d -m build --wheel > python_d -m pip install (Get-ChildItem .\dist\triton_library*) ``` However, if you prefer to directly download the precompiled library, check out our AppVeyor's [artefacts](https://ci.appveyor.com/project/JonathanSalwan/triton/history). Note that if you use AppVeyor's artefacts, you probably have to install the [Visual C++ Redistributable](https://www.microsoft.com/en-US/download/details.aspx?id=30679) packages for Visual Studio 2012. ### Installing from vcpkg The Triton port in vcpkg is kept up to date by Microsoft team members and community contributors. The url of vcpkg is: https://github.com/Microsoft/vcpkg. You can download and install Triton using the vcpkg dependency manager: ```console $ git clone https://github.com/Microsoft/vcpkg.git $ cd vcpkg $ ./bootstrap-vcpkg.sh # ./bootstrap-vcpkg.bat for Windows $ ./vcpkg integrate install $ ./vcpkg install triton ``` If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository. # Contributors * [**Alberto Garcia Illera**](https://twitter.com/algillera) - Cruise Automation * [**Alexey Vishnyakov**](https://vishnya.xyz/) - ISP RAS * [**Black Binary**](https://github.com/black-binary) - n/a * [**Christian Heitman**](https://github.com/cnheitman) - Quarkslab * [**Daniil Kuts**](https://github.com/apach301) - ISP RAS * [**Jessy Campos**](https://github.com/ek0) - n/a * [**Matteo F.**](https://twitter.com/fvrmatteo) - n/a * [**Pierrick Brunet**](https://github.com/pbrunet) - Quarkslab * [**PixelRick**](https://github.com/PixelRick) - n/a * [**Romain Thomas**](https://twitter.com/rh0main) - Quarkslab * [**And many more**](https://github.com/JonathanSalwan/Triton/graphs/contributors) ## They already used Triton ### Tools * [Exrop](https://github.com/d4em0n/exrop): Automatic ROPChain Generation. * [Pimp](https://github.com/kamou/pimp): Triton based R2 plugin for concolic execution and total control. * [Ponce](https://github.com/illera88/Ponce): IDA 2016 plugin contest winner! Symbolic Execution just one-click away! * [QSynthesis](https://github.com/quarkslab/qsynthesis): Greybox Synthesizer geared for deobfuscation of assembly instructions. * [TritonDSE](https://github.com/quarkslab/tritondse): Triton-based DSE library with loading and exploration capabilities. * [Titan](https://github.com/archercreat/titan): Titan is a VMProtect devirtualizer using Triton. ### Papers and conference

• Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle
  Talk at: Ivannikov ISP RAS Open Conference, Moscow, Russia, 2022. [paper] [slide]
  Authors: Vishnyakov A., Kuts D., Logunova V., Parygina D., Kobrin E., Savidov G., Fedotov A.
  Abstract: Nowadays automated dynamic analysis frameworks for continuous testing are in high demand to ensure software safety and satisfy the security development lifecycle (SDL) requirements. The security bug hunting efficiency of cutting-edge hybrid fuzzing techniques outperforms widely utilized coverage-guided fuzzing. We propose an enhanced dynamic analysis pipeline to leverage productivity of automated bug detection based on hybrid fuzzing. We implement the proposed pipeline in the continuous fuzzing toolset Sydr-Fuzz which is powered by hybrid fuzzing orchestrator, integrating our DSE tool Sydr with libFuzzer and AFL++. Sydr-Fuzz also incorporates security predicate checkers, crash triaging tool Casr, and utilities for corpus minimization and coverage gathering. The benchmarking of our hybrid fuzzer against alternative state-of-the-art solutions demonstrates its superiority over coverage-guided fuzzers while remaining on the same level with advanced hybrid fuzzers. Furthermore, we approve the relevance of our approach by discovering 85 new real-world software flaws within the OSS-Sydr-Fuzz project. Finally, we open Casr source code to the community to facilitate examination of the existing crashes.


• Strong Optimistic Solving for Dynamic Symbolic Execution
  Talk at: Ivannikov Memorial Workshop, Kazan, Russia, 2022. [paper] [slide]
  Authors: Parygina D., Vishnyakov A., Fedotov A.
  Abstract: Dynamic symbolic execution (DSE) is an effective method for automated program testing and bug detection. It is increasing the code coverage by the complex branches exploration during hybrid fuzzing. DSE tools invert the branches along some execution path and help fuzzer examine previously unavailable program parts. DSE often faces over- and underconstraint problems. The first one leads to significant analysis complication while the second one causes inaccurate symbolic execution. We propose strong optimistic solving method that eliminates irrelevant path predicate constraints for target branch inversion. We eliminate such symbolic constraints that the target branch is not control dependent on. Moreover, we separately handle symbolic branches that have nested control transfer instructions that pass control beyond the parent branch scope, e.g. return, goto, break, etc. We implement the proposed method in our dynamic symbolic execution tool Sydr. We evaluate the strong optimistic strategy, the optimistic strategy that contains only the last constraint negation, and their combination. The results show that the strategies combination helps increase either the code coverage or the average number of correctly inverted branches per one minute. It is optimal to apply both strategies together in contrast with other configurations.


• Greybox Program Synthesis: A New Approach to Attack Dataflow Obfuscation
  Talk at: Blackhat USA, Las Vegas, Nevada, 2021. [slide]
  Authors: Robin David
  Abstract: This talk presents the latest advances in program synthesis applied for deobfuscation. It aims at demystifying this analysis technique by showing how it can be put into action on obfuscation. Especially the implementation Qsynthesis released for this talk shows a complete end-to-end workflow to deobfuscate assembly instructions back in optimized (deobfuscated) instructions reassembled back in the binary.


• From source code to crash test-case through software testing automation
  Talk at: C&ESAR, Rennes, France, 2021. [paper] [slide]
  Authors: Robin David, Jonathan Salwan, Justin Bourroux
  Abstract: This paper present an approach automating the software testing process from a source code to the dynamic testing of the compiled program. More specifically, from a static analysis report indicating alerts on source lines it enables testing to cover these lines dynamically and opportunistically checking whether whether or not they can trigger a crash. The result is a test corpus allowing to cover alerts and to tr