BannedFuncDetector

Detect banned/insecure functions in binary files using radare2 decompilers

Overview

BannedFuncDetector is a Python tool that scans binary files to detect banned or insecure functions. It supports traditional radare2 decompilers and AI-assisted decompilation to provide readable output and highlight risky calls.

Key Features

Supported Decompilers

Default (pdc)  r2ghidra (pdg)  r2dec (pdd)  decai (AI assistant)

Installation

From PyPI (Recommended)

pip install bannedfuncdetector

From Source

git clone https://github.com/seifreed/BannedFuncDetector.git
cd BannedFuncDetector
python3 -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate
pip install -e .

Quick Start

# Analyze a single binary
bannedfunc -f /path/to/binary

# Analyze a directory
bannedfunc -d /path/to/binaries --parallel

# Use r2dec
bannedfunc -f /path/to/binary --decompiler r2dec

Usage

Command Line Interface

# Basic analysis
bannedfunc -f /path/to/binary

# Analyze a directory with parallel workers
bannedfunc -d /path/to/binaries --parallel

# Save output to a custom directory
bannedfunc -f /path/to/binary -o output

# Force a decompiler
bannedfunc -f /path/to/binary --decompiler r2ghidra --force-decompiler

# Skip decompilation analysis (names only)
bannedfunc -f /path/to/binary --skip-analysis

Available Options

AI decompilation (decai)

The decai decompiler uses an AI backend through the radare2 decai plugin. The backend is driven entirely by the decompiler.options.decai section of config.json, so you can switch providers without touching code.

Default backend: OpenCode Zen — free big-pickle model. Zen exposes free models (big-pickle, deepseek-v4-flash-free, …) over an OpenAI-compatible endpoint, so decai reaches them with api=openai. The models are free of charge but Zen still requires a free key (there is no anonymous access):

# 1. Sign up and copy your key at https://opencode.ai/auth
# 2. Store it in decai's "openai" slot (Zen is OpenAI-compatible):
r2 -qc 'decai -K' /bin/ls        # add a line:  openai=<your-zen-key>
#    or export it:  export OPENAI_API_KEY=<your-zen-key>

⚠️ Privacy note for malware analysis. Any cloud backend uploads the disassembly of the analyzed sample to a third party. For sensitive or classified samples, use the local Ollama backend (below) so nothing leaves the host — it is the only key-free, fully private option.

Switch backend by editing config.json → decompiler.options.decai:

// Local / offline (private, no key) — requires Ollama + a local model:
"decai": { "api": "ollama", "model": "qwen2.5-coder:7b",
           "host": "http://localhost", "port": 11434 }

// OpenCode Zen (default) — free models, free key:
"decai": { "api": "openai", "model": "big-pickle", "host": "https://opencode.ai/zen" }

api, model and the host(+port)-derived base URL are applied to the plugin automatically when --decompiler decai runs (decai builds the request URL as host + /v1/chat/completions). Providers supported by decai: openai (incl. OpenCode Zen), ollama, ollamacloud, gemini, anthropic, claude, mistral, xai, deepseek, lmstudio.

If you see ABI mismatch warnings for r2ai.dylib, rebuild the backend plugin for your radare2 version: r2pm -ci r2ai.

Python Library

Both helpers return a Result: Ok(outcome) on success or Err(failure) on error — check with .is_ok() and read the value with .unwrap().

Basic Usage

from bannedfuncdetector.bannedfunc import analyze_file

result = analyze_file(
    "/path/to/binary",
    decompiler_type="r2ghidra",
    output_dir="output",
)

if result.is_ok():
    outcome = result.unwrap()
    for finding in outcome.report.detected_functions:
        print(finding.name, finding.banned_calls)
else:
    print("Analysis failed:", result.error)

Directory Analysis

from bannedfuncdetector.bannedfunc import analyze_directory

result = analyze_directory(
    "/path/to/binaries",
    output_dir="output",
    decompiler_type="r2dec",
    parallel=True,
)

if result.is_ok():
    summary = result.unwrap().summary
    print(f"{summary.analyzed_files}/{summary.total_files} files analyzed")

Requirements

• Python 3.13+ (tested on 3.13 y 3.14)
• radare2 (required)
• r2ghidra/r2dec (optional decompilers)
• decai plugin (optional, for AI-assisted decompilation — see "AI decompilation" above)
• See pyproject.toml for Python dependencies

Support the Project

If you find BannedFuncDetector useful, consider supporting its development:

_{Made with dedication for the reverse engineering community}