Featured Project

Lure

Local Linux binary analysis. Zero cloud. Zero root. Zero cost.

✓ CLEAN ⚠ SUSPICIOUS ✕ DANGEROUS
View on GitHub → Get in Touch
Overview
// What Lure does

Lure runs an untrusted Linux binary inside an isolated sandbox and tells you exactly what it did — before you run it for real. It uses Linux namespaces and strace to observe the binary's behavior, then generates a structured report and delivers a plain verdict: CLEAN, SUSPICIOUS, or DANGEROUS.

Everything runs on your machine. Nothing is uploaded anywhere. Lure was built by Muhammad Usman (0xusmanismail) as a practical tool for analyzing untrusted binaries on Kali Linux without requiring a full VM or cloud sandbox.

⚠ Early development (v0.1) — core features work end to end on x86_64 Linux. Expect rough edges and limited error handling on unusual inputs. Bug reports and contributions are welcome.

Why Lure
// The problem it solves
🔒 Privacy first
Sensitive or client samples never leave your machine. No cloud upload, no account, no API key.
⚡ Zero setup
No VM, no Docker, no Cuckoo install process. Runs on tools already included in Kali Linux.
📋 Readable output
Structured reports instead of raw strace noise. Clear sections for files, network, processes, and syscalls.
🆓 MIT licensed
Free to use and modify. Built on strace and unshare — standard tools on Debian-based systems.
How It Works
// Two commands, two analysis modes
lure inspect /path/to/binary
Static ELF analysis — reads the binary without executing a single byte of code.
  • ELF headers and architecture
  • Security mitigations: NX, PIE, RELRO, stack canary
  • Linked libraries
  • File hashes (MD5 / SHA256)
  • Packer detection
lure run /path/to/binary
Sandboxed dynamic execution — runs the binary inside Linux namespaces, traced by strace.
  • Live feed of file access, network attempts, process spawns
  • Full behavioral report on exit
  • Syscall breakdown
  • Process tree
  • CLEAN / SUSPICIOUS / DANGEROUS verdict

Add --save to lure run to save the full report to ~/.lure/reports/.

Installation
// Getting started
git clone https://github.com/0xusmanismail/lure.git
cd lure
pip install -e .
Requires strace and unshare — both included by default on Kali Linux and Debian. Tested on x86_64 Linux.
Current Status
// v0.1 — what works, what's planned
✓ Working now
  • ELF inspection with security mitigation detection
  • Sandboxed execution via unshare + strace
  • Live event feed during execution
  • Full behavioral report with verdict
  • Report saving to ~/.lure/reports/
○ Planned
  • Better edge-case handling (invalid binaries, missing args)
  • Report comparison (lure diff)
  • Refined verdict heuristics
  • Packaged releases (no manual pip install -e .)
Repository
// Source code and issues

Lure is open source under the MIT license. Bug reports, feedback, and contributions are welcome.

GitHub Repository → Report an Issue →