Solana BPF Reverse Engineering Toolkit

A comprehensive reverse engineering toolkit for Solana BPF programs. Analyze compiled .so files to understand program logic, detect vulnerabilities, and recover source code.

Features

60+ Analysis Capabilities

• Core Analysis: Function detection, string extraction, constant analysis
• Security: 8 vulnerability checks, taint analysis, flash loan detection
• Code Recovery: Decompiled Rust, Anchor project generation, trait inference
• Visualization: SVG memory layouts, complexity heatmaps, call graphs
• Automation: REST API, watch mode, CI/CD integration

Output Formats

• Markdown/HTML reports (37 sections)
• Ghidra/IDA Pro/Radare2 scripts
• Complete Anchor project skeleton
• Fuzz test harness

Quick Start

Installation

# Clone repository
git clone https://github.com/vnxfsc/solana-bpf-reverse.git
cd solana-bpf-reverse

# Install dependencies
pip install -r requirements.txt

# Or install as package
pip install -e .

Cursor AI Skill Installation

To use as a Cursor IDE AI Skill:

# Copy skill to Cursor skills directory
cp -r cursor-skill ~/.cursor/skills/solana-bpf-reverse

Then mention "BPF analysis" or "reverse engineer Solana program" in Cursor to activate.

Basic Usage

# Analyze a program
python -m bpf_analyzer program.so -o ./output

# Interactive REPL
python -m bpf_analyzer repl program.so

# Fetch from chain
python -m bpf_analyzer fetch <PROGRAM_ID> -o program.so

# Generate Anchor project
python -m bpf_analyzer anchor program.so -o ./my_project

Commands

Command	Description
analyze <file>	Full analysis with 37 report sections
repl <file>	Interactive analysis mode
serve [port]	REST API server
watch <id>	Monitor on-chain program for changes
fetch <id>	Download program from Solana
diff <a> <b>	Compare two program versions
compare <files>	Compare 3+ versions
parallel <files>	Multi-threaded analysis
anchor <file>	Generate Anchor project
symbolic <file> <addr>	Symbolic execution

Example Output

Analyzing program.so (505,920 bytes)...

Summary:
  - Functions: 495
  - Strings: 110
  - Constants: 2350
  - Program Type: dex (CLMM)
  - Security Risk: LOW
  - Flash Loan Risk: HIGH

Output files:
  - report.md (37 sections)
  - report.html
  - anchor_project/
  - memory_layout.svg
  - complexity_heatmap.svg

Report Sections

1. Basic Information
2. String Analysis
3. Function Analysis
4. Syscall Usage
5. Constant Analysis
6. Security Analysis
7. Symbol Recovery
8. Function Signatures
9. Data Flow Analysis
10. Control Flow Analysis
11. Loop Detection
12. Cross References
13. CPI Targets
14. Account Permissions
15. Compute Unit Estimation
16. Taint Analysis
17. Type Inference
18. Dead Code Analysis
19. Instruction Format
20. Library Matching
21. Call Chain Analysis
22. Code Clone Detection
23. Stack Frame Analysis
24. Permission Matrix
25. Compiler Information
26. Optimization Level
27. Obfuscation Detection
28. Program Similarity
29. Flash Loan Detection
30. Vulnerability Patterns
31. Complexity Metrics
32. Gas Optimization
33. Error Types
34. Rust Traits
35. Generic Recovery
36. Macro Detection
37. Symbolic Execution

Security Checks

Check	Severity	Description
Missing Signer	HIGH	No signer verification
Missing Owner	MEDIUM	No owner validation
Integer Overflow	HIGH	Unchecked arithmetic
Reentrancy	MEDIUM	CPI reentrancy risk
PDA Validation	MEDIUM	Missing PDA verification
Flash Loan	HIGH	Flash loan vulnerability
Account Confusion	HIGH	Type confusion risk

REST API

# Start server
python -m bpf_analyzer serve 8080

# Fetch and analyze
curl http://localhost:8080/api/v1/fetch/<PROGRAM_ID>

# Analyze uploaded program
cat program.so | base64 | curl -X POST -d @- http://localhost:8080/api/v1/analyze

Python API

from bpf_analyzer import BPFAnalyzer

with open("program.so", "rb") as f:
    data = f.read()

analyzer = BPFAnalyzer(data)
result = analyzer.analyze(level=10)

print(f"Type: {result['program_type']}")
print(f"Functions: {result['function_count']}")
print(f"Security Risk: {result['security']['risk_level']}")

Supported Program Types

• Token / Token-2022
• NFT / cNFT
• DEX (AMM, CLMM, DLMM)
• DEX Aggregator
• Lending
• Staking
• Governance
• Oracle
• Bridge
• Perpetual
• Orderbook
• Name Service

Library Detection

Automatically detects code from:

• SPL Token / Token-2022
• Anchor Framework
• Metaplex
• Orca Whirlpool
• Raydium AMM/CLMM
• Meteora DLMM
• Marinade
• Jupiter

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

# Run tests
pytest tests/

# Format code
black src/
isort src/

# Type check
mypy src/

License

MIT License - see LICENSE for details.

Acknowledgments

• Solana Foundation
• Anchor Framework
• The Solana security research community

Disclaimer

This tool is for educational and security research purposes only. Always obtain proper authorization before analyzing programs you don't own.