B2R2 is a fully managed binary analysis framework written in F#, offering disassembly, instruction lifting, and control-flow recovery for reverse engineers working on authorized targets.
| Tool | B2R2-org/B2R2 — fully managed binary analysis framework written in F# for reverse engineering and program analysis |
| Category | Binary analysis framework / disassembler toolkit (.NET) |
| Primary Use | Disassembly, assembly, instruction lifting, and CFG recovery across ELF, PE, Mach-O, and WASM binaries in authorized reverse-engineering workflows |
| Safe Use | Intended for authorized malware triage, CTF work, firmware research, and defensive binary analysis on samples and systems you own or are contracted to assess |
| Telemetry Note | Purely a local static-analysis library; it performs no network activity, so defenders should note that use leaves no infrastructure traces beyond local process and file access artifacts |
B2R2 positions itself as a fully managed binary analysis framework written in F#, and that single design decision shapes nearly everything about how the tool feels in practice. Instead of the C/C++ core with scripting bindings that dominates this space, B2R2 runs on .NET, which means there is no native dependency tangle to fight before you can parse a binary. Install the .NET SDK, pull the relevant package from NuGet, and the framework is available on Linux, macOS, and Windows alike. For teams that live in the Microsoft ecosystem or want to script analyzers from any CLI-supported language, that portability story is the headline feature.
The name is a nod to R2-D2 — the project was originally styled B2-R2 before the hyphen was dropped because .NET namespaces do not allow them. The README unpacks the acronym as binary, two-state computation, and reversing, which tells you the intended audience: people who build analysis tooling rather than people who only consume it. B2R2 is best understood as a library of algorithms, data structures, and front ends for binary-level inspection, with a handful of command-line tools layered on top that the authors compare to readelf and objdump, while remaining platform-agnostic.
Architecturally, the project is split into front ends and rear ends. The B2R2.FrontEnd.API NuGet package is the documented entry point for programmatic use, and the repo metadata shows the launcher shipping as B2R2.RearEnd.Launcher on NuGet. This separation means the parsing, disassembly, and lifting machinery is consumable independently of the CLI tools, which is exactly what you want when embedding binary analysis into a larger pipeline such as an automated triage system or a firmware diffing service.
Format support is broader than the typical side project. B2R2 handles four container formats — ELF, PE, Mach-O, and WebAssembly — which covers the overwhelming majority of what an authorized analyst encounters, from Linux firmware blobs to Windows samples to browser-delivered WASM modules. The ISA matrix in the README is the most impressive artifact: full instruction parsing, disassembly, lifting, and assembly across x86, x86-64, ARMv7, ARMv8 (AArch64), MIPS32, MIPS64, M68K, Alpha, PA-RISC, PPC32, PPC64, SPARC, SH4, RISCV32, RISCV64, and the S390 family.
Note the honest maturity markers in that matrix. For most general-purpose CPUs, CFG recovery is marked as half-complete (a first-quarter moon in the README's notation), while disassembly and lifting are full. Exceptions stand out: x86 and x86-64 have full CFG recovery, and EVM — the Ethereum Virtual Machine — is full across every column. That EVM emphasis, echoed in the repo's topic tags, signals real investment in smart-contract analysis, a domain where lifting bytecode to an intermediate representation and recovering control flow is central to auditing work.
The virtual ISA and bytecode coverage is arguably the most differentiated part of the project. Beyond EVM, B2R2 supports CIL, eBPF, WASM, and even Python bytecode with full parsing, disassembly, and lifting. For defenders, eBPF support is particularly interesting: eBPF programs embedded in loaders or used defensively can themselves be audited, and having a managed framework that can lift them to a common representation makes that workflow practical. The embedded corner includes AVR with near-complete support, while TMS320C6000 covers parsing and disassembly only.
The functional-first implementation is not just an aesthetic choice. The README argues that F# features such as pattern matching, algebraic data types, and expressive functional abstractions make it well suited for building program analyzers, and that the resulting engine is designed for pure parallelism across common tasks like instruction lifting and CFG recovery. In practice, that means lifting a large firmware image to the intermediate representation can be parallelized without mutable-state hazards, which is where many analysis pipelines silently fall over. The CI badges for build-test and a dedicated jumptable-test workflow indicate the maintainers test jump-table recovery, a classic pain point in CFG construction.
The dependency philosophy reinforces the managed design. The core library has zero external dependencies, and the handful of NuGet packages listed — System.IO.Hashing, FSharp.Compiler.Service, FParsec, BenchmarkDotNet, and Avalonia.FuncUI — are optional and scoped to specific components. FParsec for parsing, BenchmarkDotNet for performance measurement, and Avalonia.FuncUI suggesting a GUI front end in development all point to a deliberate, layered architecture. API documentation is generated with fsdocs and hosted at b2r2.org/B2R2/, so the surface area is browsable without cloning the repo.
Getting started programmatically is straightforward and mirrors standard .NET workflow. After creating a console project with dotnet new console -lang F#, you add the front-end package with dotnet add package B2R2.FrontEnd.API and work from a Program.fs that opens the B2R2 and B2R2.FrontEnd namespaces. The README's example walks exactly this path, which tells you the project expects its primary consumers to be developers composing custom analyzers rather than analysts clicking through a GUI.
For an authorized workflow, think of B2R2 as the engine room behind several common tasks: batch disassembly of firmware across mixed architectures, lifting samples to a normalized IR for downstream symbolic execution or diffing, smart-contract bytecode inspection via the mature EVM support, and quick format triage with the readelf/objdump-style CLI tools. Because everything runs in-process under .NET, integrating it into a C#-based malware classification pipeline or an F# research notebook is far less friction than bridging to native libraries.
With roughly 552 stars, an MIT license, and active CI across build and jump-table testing, B2R2 sits in the serious-research-tool tier rather than the weekend-project tier. The half-complete CFG recovery on non-x86 architectures is the main caveat to weigh before committing a pipeline to it, though the project explicitly invites contributions under its CONTRIBUTING.md guideline. For defensive researchers who want a clean, dependency-light, cross-platform foundation for binary analysis — especially one that speaks EVM and eBPF natively — B2R2 deserves a close look.
B2R2-org/B2R2.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.