Introduction

VulHunt is a unified platform for vulnerability detection, malware analysis, and more — working from a single source of truth across multiple representations including disassembly, intermediate representation (IR), and decompiled code. It allows writing high-level Lua rules that match against low-level semantic information extracted from binaries. These rules can detect known and unknown vulnerabilities, patches, malicious code, and other software properties in targets such as POSIX executables and UEFI modules. VulHunt also exposes its analysis capabilities through an MCP server, giving LLMs flexible access to the full analysis engine. To guide LLMs through common workflows, VulHunt ships a set of Claude Skills — structured instructions that teach an agent how to use VulHunt’s MCP tools for specific tasks.

Quick start

To follow along, install VulHunt:

Linux and macOS

curl --proto '=https' --tlsv1.2 -sSfL https://sh.vulhunt.re | sh

Windows

irm https://ps.vulhunt.re | iex

For full installation options consult the installation guide.

Quick usage

VulHunt supports two primary usage modes:

Scan mode

Run VulHunt rules against binaries:

vulhunt-ce scan --data /path/to/data --rules /path/to/rules --pretty --output output.json <binary>

MCP mode

Use VulHunt as an MCP server:

vulhunt-ce mcp --data /path/to/data

The --data flag is only required when VulHunt’s data files are not in the default location. If you installed via the standard installer, you can omit it.

A first look at rules

VulHunt rules are Lua scripts that define rule metadata and detection. Let’s see an example rule to detect binaries affected by CVE-2024-6387 (also known as regreSSHion). A simplified¹ way to detect this vulnerability in sshd binaries is by checking whether syslogv is called from sshsigdie:

CVE-2024-6387.vh

author = "Binarly"
name = "CVE-2024-6387"
platform = "posix-binary"
architecture = "*:*:*"
scopes = {
  scope:functions {
    named = "sshsigdie",
    with = function(project, context)
      if context:has_call("sshlogv") then
        print("This binary is vulnerable to CVE-2024-6387 (regreSSHion)!")
      end
    end,
  },
}

The rule above works fine, but VulHunt packs way more power. The rest of this guide presents its key concepts, showing how to hunt down interesting code in binaries.
¹

Get Started

VulHunt CLI

VulHunt SDK

VulHunt Rules

Appendices

Quick start

Linux and macOS

Windows

Quick usage

Scan mode

MCP mode

A first look at rules