taint-analysis 开源项目推荐（248 个）

meta /pyre-check

Performant type-checking for python.

vimeo /psalm

用于查找 PHP 应用程序中错误和安全漏洞的 PHP 静态分析工具

JonathanSalwan /Triton

Triton是一个动态二元分析库。构建您自己的程序分析工具、自动化反向工程、执行软件验证或只是模拟代码。

find-sec-bugs /find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

BinaryAnalysisPlatform /bap

Binary Analysis Platform

python-security /pyt

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

airbus-seclab /bincat

Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection

pascal-lab /Tai-e

An easy-to-learn/use static analysis framework for Java and Android

AngoraFuzzer /Angora

安哥拉是一种基于突变的毛圈。 安哥拉的主要目标是通过解决路径约束而不进行符号执行来增加分支覆盖率。

JonathanSalwan /Tigress_protection

研究 Tigress 软件保护，破解其部分保护机制并解决其逆向工程挑战。使用符号执行、污点分析和 LLVM 实现自动去混淆。

decaf-project /DECAF

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

trailofbits /polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

SourceCode-AI /aura

Python source code auditing and static analysis on a large scale

BytecodeDL /ByteCodeDL

A declarative static analysis tool for jvm bytecode based Datalog like CodeQL

antgroup /YASA-Engine

YASA is an open-source static program analysis project. Its core innovation lies in a unified intermediate representation called UAST, designed to support multiple programming languages. Built on top of UAST, YASA provides a highly accurate static analysis framework.

AngoraFuzzer /libdft64

libdft for Intel Pin 3.x and 64 bit platform. (Dynamic taint tracking, taint analysis)

wmkhoo /taintgrind

A taint-tracking plugin for the Valgrind memory checking tool

Feysh-Group /corax-community

Corax for Java: A general static analysis framework for java code checking.

HeadyZhang /agent-audit

Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.

SVF-tools /Software-Analysis-Studio

Teaching and Learning Software Analysis via SVF