Reverse Engineering Fortinet with Ablation

Ablation is a reverse engineering framework that provides the exact same core disassembly, decompilation, and binary analysis capabilities as industry-standard tools like Ghidra, IDA Pro, and Binary Ninja. Combined with an LLM, it transforms into a fully autonomous reverse engineering tool.

Ablation is built for the modern landscape, and more importantly, the human.

Now reverse engineering is accessible to anyone. No matter your wallet or your barrier of entry into education, you can learn about reverse engineering as you reverse engineer.

flowchart TD

Binary(["Target Binary ELF · PE · firmware"])

Claude(["Claude Code (Orchestrator) Central Agent Controller"])

Binary -->|"load"| BCtx["BinaryContext PLT · Strings · Call Graph · XRefs"]

BCtx -->|"context"| Corpus["Corpus Builder Semantic Embedding DB"]

BCtx -->|"context"| Taint["Taint Engine Data Flow / Sinks"]

BCtx -->|"context"| Diffing["Diffing Engine DTW / Version Delta"]

BCtx -->|"context"| FmtStr["Format String Specifier Scanner"]

BCtx -->|"context"| Heap["Heap Scanner Chunk / UAF Audit"]

BCtx -->|"context"| MultiArch["Multi-Arch Engine MIPS · PPC · RISC-V · ARC · V850"]

BCtx -->|"context"| Driver["Driver Engine Kernel IOCTL / BYOVD Audit"]

Corpus -->|"embeddings"| Semantic["Semantic Search BERT Behavioral Fingerprints"]

Semantic -. "candidates" .-> Claude

Taint -. "findings" .-> Claude

Diffing -. "findings" .-> Claude

FmtStr -. "findings" .-> Claude

Heap -. "findings" .-> Claude

MultiArch -. "findings" .-> Claude

Driver -. "findings" .-> Claude

Claude -->|"confirmed finding"| Registry["Finding Registry Cross-Target Corpus"]

Registry -->|"seeds future sweeps"| Semantic

classDef primary fill:#2a1a4a,stroke:#7c3aed,stroke-width:2px,color:#fff

classDef foundation fill:#0d1117,stroke:#58a6ff,stroke-width:2px,color:#e5e7eb

classDef engine fill:#171717,stroke:#404040,stroke-width:1px,color:#e5e7eb

classDef feedback fill:#0d2818,stroke:#238636,stroke-width:2px,color:#e5e7eb

class Claude,Binary primary

class BCtx foundation

class Corpus,Semantic,Taint,Diffing,FmtStr,Heap,MultiArch,Driver engine

class Registry feedback

mindmap

root((Local Decompilers))

x86 Family

x86 - 32

x86 - 64

ARM Family

ARM - 32

ARM - 64

MIPS Family

MIPS 32+nM

MIPS - 64

PowerPC Family

PPC - 32

PPC - 64

RISC-V Family

RISC-V 32

RISC-V 64

Embedded / Other

ARC EM/HS

V850 - 32

- Semantic Search via BERT: Semantic search finds results based on meaning rather than exact keywords. BERT reads text and figures out what it means. Similar meanings get similar scores, so you can search by concept instead of exact words. By combining the two, it speeds up the main bottleneck of reverse engineering while finding the vulnerable functions.

- Extreme Performance: A 50 MB binary loads in 35 seconds. Ghidra and IDA Pro can take hours because they parse the entire file into a database before you can do anything. Ablation only analyzes the functions you are actively working on, so you start immediately.

- Version Diffing: Utilizing the Jaccard method to measure how much a function's behavior overlaps between releases and Dynamic Time Warping that tracks the "shape" of how a function executes across those versions of firmware or software that a vendor updated, Ablation confirms whether a patch actually changed the logic or just the packaging, because a cosmetic recompile can't hide an unpatched vulnerability.

- Cross-Binary Analysis: Analyze every shared library in a firmware image simultaneously, tracking data flows across binary boundaries.

- Entropy Mapper: Finds encrypted, compressed, or packed sections in a binary.

- Crypto Audit: Scans for cryptography.

- XorSolver: Recovers, then decrypts the target section which allows further reverse engineering.

Everything legacy tools have

Capabilities legacy tools don't have

When executing commands like ablation sweep firmware.so --json results.json, Claude Code can interpret the JSON, identify suspicious functions, and automatically pivot to run ablation cfg to visualize logic or ablation taint to verify reachability.

This ReAct loop using claude-sonnet-5 for decompilation effectively replaces the junior analyst role during triage, surfacing only confirmed, exploitable paths for human review.

Recommended model: claude-sonnet-4-6 (released January 2026).

/model claude-sonnet-4-6

Ablation has been used to analyze production firmware and kernel drivers from Fortinet, Cisco, Axis, Fujitsu, MikroTik, Orka, TencentOS, Enigma2, and Skydio.

Following coordinated disclosure on Cisco FMC and ISE, the Cisco Product Security Incident Response Team (PSIRT) has adopted Ablation for internal vulnerability triage. Cisco PSIRT is actively using it to triage ongoing disclosure reports across Firepower Threat Defense (FTD), Cisco Secure Client (AnyConnect), HyperFlex, and Catalyst. Cisco Adaptive Security Appliance (ASA) LINA has also been reverse engineered using Ablation, with findings currently under coordinated triage via CERT/CC VINCE.

End-to-end analysis of the ML native binaries bundled in FortiSOAR 8.0.0, from RPM extraction through BinaryContext, string xrefs, and capstone disassembly to confirmed findings.

flowchart TD

RPM["elasticsearch-8.19.19-x86_64.rpm 649MB · FortiSOAR 8.0.0 third-party bundle"]

RPM -->|rpm2cpio / cpio| EXTRACT["x-pack-ml/platform/linux-x86_64/"]

EXTRACT --> PI["bin/pytorch_inference 397KB · stripped PIE · x86-64"]

EXTRACT --> CTRL["bin/controller 128KB · stripped PIE · x86-64"]

EXTRACT --> LIBS["lib/libMlCore.so lib/libtorch_cpu.so"]

subgraph TRACK_PI ["pytorch_inference track"]

direction TB

BCI["BinaryContext.load_or_build() 32 func starts · 551 strings · PLT built"]

BCI --> SS["ctx.strings scan aten::from_file VA 0x51560 aten::save VA 0x51570 validElasticLicenseKeyConfirmed 0x52e08"]

SS --> XREF["ctx.string_xrefs() both ops xref → 0x17499, 0x174af ctx.func_containing() → init fn 0x10000"]

XREF --> DA1["capstone disasm 0x17450 lea rsi → aten::from_file · call set::insert lea rsi → aten::save · call set::insert CONFIRMED: exactly 2 blacklist entries"]

DA1 --> DA2["capstone disasm 0x16511 cmp qword ptr [r9], 0 je → model loads · ne → handleFatal empty set = bypass confirmed"]

end

subgraph TRACK_LIBS ["library analysis"]

direction TB

NM["nm -D libMlCore.so spawn at 0xfdb20 · ctor at 0xfcfd0"]

NM --> DA3["capstone disasm libMlCore.so:0xfdbc7 cmp entry length == exe_path length memcmp at 0xfdbdb proper equality check · no prefix bypass"]

LSCAN["re.findall aten:: in libtorch_cpu.so 2481 distinct ops found 2 blocked · 2479 unblocked"]

end

subgraph TRACK_CTRL ["controller track"]

direction TB

BCC["BinaryContext.load_or_build() 18 func starts · PLT · strings"]

BCC --> XREF2["ctx.string_xrefs() on 5 path strings ./autodetect · ./categorize ./data_frame_analyzer · ./normalize ./pytorch_inference all xref at 0x9a04-0x9a5e"]

XREF2 --> DA4["capstone disasm 0x99e9 call CProgName::progDir() call COsFileFuncs::chdir() chdir to binary dir before spawn"]

DA4 --> DA5["capstone disasm 0x11500 args vector from command pipe tokens passed raw to spawn() at 0x11699 no validation"]

end

PI --> BCI

PI --> BCC

LIBS --> NM

LIBS --> LSCAN

DA2 --> F1

LSCAN --> F1["F1 · HIGH verifySafeModel blocks 2 of 2481 ops upload malicious .pt via ML API seccomp BPF not yet decoded, CIA impact open"]

DA3 --> F2

XREF2 --> F2["F2 · LOW controller spawn allowlist is sound but args vector unchecked requires elasticsearch user pipe access"]

DA5 --> F2

SS --> F3["F3 · INFO license gate = JSON field only no cryptographic verification"]

classDef finding fill:#1a1a2e,stroke:#e94560,stroke-width:2px,color:#fff

classDef tool fill:#16213e,stroke:#0f3460,stroke-width:1px,color:#e5e7eb

classDef binary fill:#0f3460,stroke:#533483,stroke-width:2px,color:#fff

classDef input fill:#533483,stroke:#7c3aed,stroke-width:2px,color:#fff

class F1,F2,F3 finding

class BCI,BCC,NM,LSCAN,SS,XREF,XREF2,DA1,DA2,DA3,DA4,DA5 tool

class PI,CTRL,LIBS binary

class RPM,EXTRACT input

pip install git+https://github.com/Ablation-Tool/ablationWith LLM features:

pip install "git+https://github.com/Ablation-Tool/ablation#egg=ablation[llm]"Reach out directly. If there's anything you'd like added or improved on or just report a bug.

- Open an issue on GitHub

- X: @ablation_tool

- Signal: @deadbug.06

- Email: ablation@nuclide-research.com

- Python >= 3.10

- capstone,- numpy,- lief,- sentence-transformers,- pyelftools

- Optional: anthropicfor LLM features

See LICENSE.

Nicholas Michael Kloster & Claude

Books (All obtained from O'Reilly Media | www.oreilly.com)

Research Papers

Honorable Mention

Microsoft Excel (Data Analysis ToolPak) When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.