bap

I use OCaml at work. We work with the Binary Analysis Platform https://github.com/BinaryAnalysisPlatform/bap which is a pretty essential part of what we do. In general, OCaml seems somewhat popular in the area of compilers and program analysis. Facebook Infer is written in OCaml for example https://fbinfer.com/. This may be as you said because of these areas sometimes more academic flavor. There are companies out there using OCaml for all sorts of things, although of course it is a small fraction of those using python or C++.

Going to drop a toplevel comment and say while this is interesting (sincerely!) if people are interested in deeper tools/techniques the book Practical Binary Analysis is excellent, it ends in taint checking, symbolic excution techniques and uses Pin. https://practicalbinaryanalysis.com/ Also worth checking out is BAP, the Binary Analysis Platform, which is the successor project to Bit Blaze, and is one of the most fascinating binary analysis frameworks out there for my money. It was the only one of the darpa CGC entries that ran on real binaries, not the much less complicated ones developed specifically for the challenge. https://github.com/BinaryAnalysisPlatform/bap

This is a solid paper if you want to learn something about SymbEx. If it really interests you and you want something more tutorial oriented, pick up a copy of Practical Binary Analysis, out recently from nostarch. The last chapters are a tutorial intro to it using Triton. If you're a functional programmer and already know some Haskell or Ocaml or are able to pick it up quickly, check out BAP, the binary analysis platform, its got a bunch of tools/analysis built in already for this stuff and there's a fair amount of fascinating research done using or on the platform itself. https://practicalbinaryanalysis.com/ https://github.com/BinaryAnalysisPlatform/bap Cool fact about BAP, there's a really weird but very cool embedded lisp that allows you to drive execution of single instructions via meta programming. It works via a term rewriting

BAP is not a competitor to IDA Pro or Ghidra, it's a platform for implementing automated analysis, while IDA and Ghidra are more like reverse engineering tools that are focused on human interactions. We do support IDA Pro so that you can run BAP analysis from it and have the best of two words. We will soon roll out the support for Ghidra too (the issue is created [1]). What is a really great contribution of Ghidra, to my opinion, is the detailed specification of all supported ISA in Sleigh (their terse and concrete ISA specification language). Ghidra ships with about ~200kLOC of instruction descriptions and this is the most valuable contribution to the community. We're planning to support Sleigh in the nearest future, and I believe that Sleigh might become a standard de facto for instruction semantics specification. [1]: https://github.co

>is basically the first real competitor to IDA Pro What do you think of BAP[1]? [1] https://github.com/BinaryAnalysisPlatform/bap

Well, you could use arrays of optional bytes, but are use sure it's clever? Maybe it's much better to define an abstract module of type module type Mem = sig type t val get_byte : t -> ~offset:int -> char option end And invent some clever (maybe lazy) implementation using just Bigarray? BAP also has something like this in https://github.com/BinaryAnalysisPlatform/bap/blob/master/li... You could ask about BAP in general on https://discuss.ocaml.org/ especially https://discuss.ocaml.org/u/ivg/summary (one of the guys behind BAP, very clever and talented in explaining stuff)

>the linker is using immutable lists of optional bytes to represent memory images Why would you use linked list instead of Bytes, Bigarrays or Arrays? You are doing it wrong, take a look at BAP's memory representation: https://github.com/BinaryAnalysisPlatform/bap/tree/master/li... https://binaryanalysisplatform.github.io/bap/api/master/argo... Looked at your code, damn it's bad, I'd really suggest to dive into BAP sources and documentation a bit to understand how to write OCaml. It feels like you are trying to write in OCaml as in some different language, Haskell maybe, not using modules and functors. Reminds me how J people write C. You could write `fun x y z -> ...` instead of `fun x -> fun y -> fun z -> ...`, it's also better to write signatures (with docstrings) in separate .mli files (much easier to read and generate docs), if you u

But monads are a version of small-stem semantics. And the write linker, so something that operates low-level data, not an actual low-level code, OCaml is a great language for that. Take a look at BAP, it heavily uses OCaml features and implements a beautiful design: https://github.com/BinaryAnalysisPlatform/bap https://binaryanalysisplatform.github.io/bap/api/master/argo... I'm not convinced that OCaml is unsuitable for such tasks.

There are other similar platforms (listing biggest ones): 1. BAP (OCaml) - https://github.com/BinaryAnalysisPlatform/bap 2. BinCAT (OCaml) - https://github.com/airbus-seclab/bincat 3. radare2 (C) + radeco (Rust)(WIP) - https://github.com/radare/radare2 + https://github.com/radare/radeco-lib 4. Falcon (Rust) (WIP) - https://github.com/falconre/falcon And a bunch of others, less common or less featureful.