VOLE (Vulnerability Observance and Learning-based Exploitation)

VOLE is a tool for detecting common bug classes in program binaries. It leverages:

• angr for symbolic execution, control-flow graph (CFG) recovery, and intermediate representation (IR) lifting
• VEXIR2Vec to derive vector embeddings of IR
• Graph Convolutional Networks for classification
• NIST SARD Juliet as training data

Setting up VOLE for development

Requirements

• Linux/WSL (macOS and Windows are unsupported)
• Python 3.11+
• pip

Optional

Note

If you do not have a CUDA or ROCm compatible GPU, you can skip the NVIDIA/AMD requirements.

• Docker
• CUDA 12.9+ (NVIDIA GPUs)
• ROCm 6.4+ (AMD GPUs) - While ROCm may work, it is not officially supported. Only use if you have ROCm pre-installed.

Installation and Setup

1. Activating Venv

python -m venv ./venv
source ./venv/bin/activate

2. Installing Dependencies

python -m ensurepip
python -m pip install -r requirements.txt
python -m pip install -r requirements-nvidia.txt # (Optional) For NVIDIA GPUs

3. Install Required Models and Data

python setup.py

4. Compiling Training Data

Note

For consistency, a Dockerfile has been provided to compile the SARD test cases

From the root directory of the repository:

1. (Optional) Build the Docker image with docker build -t sard-env:latest .
2. Compile the target CWEs per CWE-ID by running: a. Bare metal: python src/make.py CWE<ID> data/SARD b. Docker: docker run -it --rm -v "$PWD":/usr/src/env -w /usr/src/env sard-env python3 src/make.py CWE<ID> data/SARD

Contributing Changes

1. Before starting work, ensure your local repo is up to date!
2. When assigned an issue, create a new branch for the issue by:
3. Going to the "Development" tab
4. Selecting "Create a branch"
5. Clicking "Create branch"
6. Checking out the new branch locally
7. Do what you need to do
8. Before pushing changes, run ruff format . to format them (no ugly code, sorry)