Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

POST: purl2sym, extracting symbols from sources for fun and for profit

未關閉
  • 哪裡不對？
#8 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度
2/5
預估耗時
1-3 小時
新手友好度
35/100
Issue 類型
文件
描述清晰度
基本清楚
活躍度
停滯
領域
content, documentation

研究方向

該儲存庫被描述為基於 Docusaurus/Markdown，但沒有指定目標檔案或內容目錄。首先找出網站現有的文章結構，並將其與連結的 purl2sym 和 Symbols and Strings in PURLdb 參考資料進行比較。完成的標準是：將此草稿發佈到網站中適當的位置，並保留其中的連結和技術性主張。

由索引模型根據 Issue 內容生成。

描述

0-high-priority blog ready-to-post

Lightweight reverse-engineering of open source binaries with purl2sym

TL;DR

  • Got binary code? Got source code?
  • Need to know what open source packages it came from?
  • Use purl2sym to extract and then index symbols, like function names, and strings.
  • Extract strings from the binary and match them back to actual source packages.

Context

As an open source developer, I further rely on open source every day. But what happens when that code is shipped as a binary, like when embedded in devices (a car, a phone, or a toaster) or in container images where the original corresponding source code is not present?

You get a blob. Maybe a stripped ELF file. How can you figure out what is inside, what is it made off, what is the source, and where is the "open" source?

This is where purl2sym comes in. It is one of the AboutCode https://aboutcode.org projects, funded by NLnet https://nlnet.nl/project/purl2sym and it extracts and indexes symbols from source code so you can match these back to binary symbols of open source packages, keyed by PURL https://github.com/package-url/purl-spec. It can help turn otherwise mostly obscure and opaque symbols and strings found in binaries into traceable references to specific open source code packages and specific versions.

Problems

If you have ever faced some of these use cases, then purl2sym could help:

  • Analyzed a binary firmware blob to find which open source packages it embeds
  • Tried to comply with FOSS license obligations post-compilation, to find what the actual code that is effectively compiled and shipped (as opposed to the 10x more code used in development and testing)
  • Hunted down the source code of a vulnerability found in a binary
  • Built SBOMs, working from compiled codebase

Solution

purl2sym extract symbols from source code and builds indexes of symbols and strings extracted from multiple tech stacks and programing languages, like C, C++, Java, Python JavaScript, packaged in Linux distros like Debian or Alpine, or application packages like PyPI, Maven and more. You can fetch the symbols by PURL (Package-URL) and cross-reference these with binary symbols to get back matches to potential packages and versions indexed in the PrulDB.

How it works

purl2sym is a combo of low level libraries, scripted pipelines and high level APIs. When you call the high level REST API, you request the symbols for a PURL, and the tool:

  • Downloads and extracts the source package
  • Extracts symbols and strings from the code using tools like gettext, treesitter, or pygments.
  • Stores those symbols keyed by PURL (e.g., pkg:deb/debian/[email protected]).
  • Returns a JSON doc with the symbols and metadata for further integration, alongside hashes and fingerprints.

With this, I can analyze unknown binary blobs by extracting their symbols and finding their original sources, using symbol matching. Or determine if the symbols of a code vulnerability may be present or used in a given source or binary. (Assuming we know which code segment is the trigger for a vulnerability, but this another thing, handled in another project)/

It is designed to work with and power binary analysis tools like BANG https://github.com/armijnhemel/binaryanalysis-ng/ that can then detect reused code chunks across binaries.

In practice

Let’s say you are working with the firmware blob of a commercial device. It includes a statically linked C executable, but it is not obvious what libraries are linked in the binary. You could pull a few function names using strings (or commoncode's string functions) , or maybe extract a specific ELF section.

You can feed that into a tool powered by purl2sym. Voila: it will suggests that OpenSSL 1.1.1d from Debian is linked in the exe, and you can further lookup in the PurlDB for complete licensing metadata and in Vulnerable for CVEs. You now have a clear path towards automating a security and license compliance.

Get Started

主要語言
JavaScript
星號
9
分支
17
平均合併
7 小時 55 分鐘
30 天內合併 PR
2

環境準備

這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

aboutcode-org/www.aboutcode.org 的其他 Issue

查看 aboutcode-org/www.aboutcode.org 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。