Native CPUs

Automotive ECUs

VMs & Runtimes

pip install ablation-tool

Requirements: Python >= 3.10 · capstone>=5.0.1 · numpy · lief · fastembed · pyelftools

Optional feature sets:

# All optional analyzers
pip install "ablation-tool[full]"

# CPython .pyc scanning and Apple BV41 decompression
pip install "ablation-tool[bytecode]"

sentence-transformers, Anthropic, and Angr support are optional; the full extra includes them together with xdis and lz4.

The code couldn't exist without their ideas. Though no code was written by these authors, doctors, and engineers, their work has direct influence on the production of code that makes Ablation what it is.

Research Papers

Books supplied by www.oreilly.com | github.com/oreillymedia

Honorable Mention

Microsoft Excel (Data Analysis ToolPak). When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.

Ablation has been used to analyze production firmware and kernel drivers from Cisco, IBM, TencentOS, Huawei, Fortinet, and more.

Following coordinated disclosure, the Cisco Product Security Incident Response Team (PSIRT) adopted Ablation for internal vulnerability triage and continues to use it to evaluate ongoing disclosure reports. Cisco Adaptive Security Appliance (ASA) LINA is among the artifacts analyzed, with findings submitted through CERT/CC VINCE.

Ablation in Action

How to Use Ablation

Learn as You RE

NIST SP 800-218

This defines how software should be built, organized around four practice areas: preparing the development environment, protecting the codebase from unauthorized changes, writing software with security built into every layer, and responding when vulnerabilities surface after release.

What this means for Ablation in practice is a mandatory ten-section security audit on every module before it touches the repository. The audit covers input validation, memory handling, integer safety, error handling, concurrency, dependency security, injection prevention, secrets handling, logging, and residual risks. No module is committed without passing it.

Taint trackers, which are the modules that matter most if they get something wrong, carry an additional requirement: 85% statement coverage enforced by a hard gate in the test suite, verified against byte-exact synthetic instruction sequences that test ABI register behavior, not just whether the code runs without crashing. Dependencies are pinned with exact hashes and scanned weekly for known CVEs.

CISA Secure by Design

CISA asks software manufacturers to commit to three things: take ownership of the security outcomes of the people who rely on the software, be transparent about its limitations, and treat security as a requirement rather than a recommendation.

For a RE framework, taking ownership of security outcomes has a specific meaning. A taint tracker that misses a vulnerability does not just produce a wrong answer. It produces a result someone may act on as evidence the binary is clean. That is why a false negative in any Ablation taint tracker is classified as a CRITICAL defect.

Every tracker ships with a documented known-anomalies file describing the exact conditions under which it can produce false negatives, so a researcher knows when to apply manual verification on top of the automated result. The precommit gate is not advisory. No code enters the repository without passing it.

MIL-HDBK-115C

The US Department of Defense handbook for reverse engineering methodology defines four phases:

• Phase 1: Every engagement starts with a session file recording the target description, artifact hash, tool selection, and documentation plan before any analysis runs. The rule that semantic search runs before manual disassembly maps to the following phase.
• Phase 2: Requires characterizing a binary at the function level before doing detailed trace work. The DynamicSandbox covers the following.
• Phase 3: The structured retrospective written at the close of every completed project maps to the final phase.
• Phase 4: The standards document tracks 29 specific requirements drawn from all three frameworks. All 29 are met.

Responsible Use: Ablation is built for authorized security research. Use it only against systems you own or have explicit written permission to test. Running it against systems without authorization violates computer fraud laws in most jurisdictions. The author is not responsible for misuse.

Contact: Feel free to contact me if you have any questions, ideas, complaints, or bugs:

• 📧 ablation@nuclide-research.com
• 𝕏 @showxlate