The use of OCaml in BAP has both positives and negatives. OCaml’s
pattern matching is a wonderful fit for binary analysis. However,
very few people know OCaml, and thus few people can understand or
modify BAP’s source code. Although you can do some nifty things
without digging into BAP’s source code, this only touches the surface
of BAP’s capabilities.
Today I added a feature which I hope will bring BAP to the masses —
well, at least to the masses of security people who want to use BAP
but haven’t because they do not use OCaml. This feature should allow
users to easily read and analyze the BAP IL in the comfort of their
favorite programming language, whatever that might be.
BAP has always had a robust pretty printer and parsing mechanism which
could, in theory, be parsed by other languages. But honestly — who
wants to build a parser to parse the BAP IL? It’s annoying, and I
doubt anyone has gone through the trouble of doing it. The new
feature I added gives users the ability to serialize the BAP IL to a
number of formats, including protobuf, XML, JSON, and Piqi. If your
programming language doesn’t have libraries to parse one of these
formats, it probably isn’t worth using.
Let’s take a look at some examples. Here’s some BAP IL:
Hopefully this will encourage some new people to use and contribute to
BAP. Adding support for new instructions isn’t that hard, even for
people that don’t know OCaml! This serialization will be in BAP 0.7,
which will be released in a few days.