Overview

VulHunt rules are written in Lua; however, you don’t need to be proficient in Lua to write rules. Lua is used primarily as a container format, and the language is extended with functions that simplify rule creation. VulHunt rules are collections of fields, as defined in the following table:

Field	Description	Category	Required
`author`	Author of the rule	Metadata	Yes
`name`	Name of the rule	Metadata	Yes
`platform`	Target platform	Filtering	Yes
`architecture`	Triplet defining the architecture where the rule should be executed	Filtering	Yes
`conditions`	Conditions under which the rule should be executed	Filtering	No
`types`	Type library used by the engine for matching and decompilation	Detection	No
`signatures`	Signature files used to identify functions in binaries without symbols	Detection	No
`extensions`	Specifies any extension needed by this rule	Detection	No
`scopes`	Defines the list of scopes used to identify a vulnerability	Detection	Yes

These rule fields can be roughly divided into three categories:

Metadata: Includes information such as the author and rule name, providing context about the rule itself.
Filtering: Defines the conditions under which the rule should be executed, such as the target platform or architecture.
Detection: Specifies the core logic of the rule, including signatures, types, and scopes used to identify a vulnerability in a binary file.

Example

The following example shows a sample value for each of the rule fields. A comprehensive overview and the valid values for the fields can be found in the VulHunt Reference.

examples/rule-fields.lua

author = "Your Name"
name = "CVE-2025-0001"
platform = "posix-binary"
architecture = "x86:*:*"
conditions = {name_with_prefix = {"library-name.so"}}
types = "path/to/type-library"
signatures = "path/to/signature-library"
extensions = "decompiler"
scopes = {scope:functions{...}}

Get Started

VulHunt CLI

VulHunt SDK

VulHunt Rules

Appendices

Example

​Example

Example