Callisto is an automated binary vulnerability analysis tool designed to assist researchers in binary analysis and zero-day vulnerability discovery. It decompiles binaries, analyzes pseudocode with Semgrep and GPT-3.5-Turbo for vulnerability detection, and outputs findings to reduce false positives.

How It Works

Callisto leverages Ghidra's headless decompiler to generate pseudocode from a given binary. This pseudocode is then analyzed by Semgrep using custom C rules. Findings from Semgrep are further validated and potentially augmented by GPT-3.5-Turbo, offering a dual-validation approach to enhance accuracy and depth in vulnerability identification.

Quick Start & Requirements

• Install: pip install -r requirements.txt
• Prerequisites: Ghidra, Semgrep, OpenAI API token (for GPT-3.5-Turbo feature, configured in config.txt), correct Ghidra path set in config.txt.
• Run: python callisto.py -b <path_to_binary> [-ai] [-o <path_to_output_file>] [-all]
  • -ai: Enables GPT-3.5-Turbo analysis.
  • -o: Specifies an output file.
  • -all: Runs all functions through AI analysis (requires -ai).
• Documentation: https://github.com/JetP1ane/Callisto

Highlighted Details

• Utilizes Ghidra for headless decompilation.
• Employs Semgrep for initial SAST analysis.
• Integrates GPT-3.5-Turbo for secondary validation and enhanced discovery.
• Aims to reduce false positives through a dual-validation pipeline.

Maintenance & Community

The project acknowledges Marco Ivaldi (@0xdea) for his contributions to Semgrep rules and research methodology. Further community or maintenance details are not specified in the README.

Licensing & Compatibility

The README does not explicitly state a license. Compatibility for commercial use or closed-source linking is not detailed.

Limitations & Caveats

The tool requires an OpenAI API key for its advanced AI features. The effectiveness of vulnerability detection is dependent on the quality of Ghidra's decompilation and the capabilities of Semgrep and GPT-3.5-Turbo. It is not guaranteed to catch all vulnerabilities.