Autonomous Binary Vulnerability Agent (ABVA)

Educational portfolio project — AI-assisted discovery of intentional CTF-style binary bugs using symbolic execution (angr) and optional reinforcement learning, with sandboxed crash reproduction and teaching reports.

ABVA does not generate ROP chains, shellcode, or weaponized exploit scripts.
Analysis runs in a Docker sandbox (network_mode: none) against in-repo challenge binaries only.

Why this project

1. ELF triage — NX / PIE / canary / RELRO + dangerous imports / sections
2. Symbolic exploration — crash / IP-overwrite / WWW / heap / protocol candidates
3. RL navigation — curriculum-guided menu/state machines
4. Crash reproduction — retries + JSON records
5. Educational reporting — mitigation matrix, severity, expected.json compare

Challenge results (suite)

ID	Challenge	Primary teaching sink
C1	stack_overflow	ip_overwrite
C2	menu_overflow	ip_overwrite
C3	write_what_where	write_what_where
C4	format_string	format_string
C5	guarded_path	ip_overwrite
C6	heap_overflow	heap_overflow
C7	integer_wrap	integer_wrap
C8	off_by_one	off_by_one
C9	multistage_menu	ip_overwrite
C10	length_protocol	protocol

Quick start

docker compose build
docker compose run --rm abva analyze challenges/C1_stack_overflow
docker compose run --rm abva eval

More: docs/USAGE.md · docs/ARCHITECTURE.md · docs/ETHICS.md · docs/CHALLENGES.md · docs/CI.md

License

MIT — see LICENSE.