Cutter helps organize binary investigation through a graphical interface. The meaning of displayed code still depends on analyst verification and architecture context.
Evaluation approach
Function graphs, disassembly and supported decompiler integrations provide different views. A GUI does not remove analysis assumptions.
Application example
Inspect callers of a critical native function and document the workflows that use its control.
Limits and considerations
A call missing from a static graph may still occur through dynamic resolution.
Use graph views accurately
A function graph can explain a security decision's branches. Include entry point, address and application version so developers can locate the same region. Do not assume every graph edge was observed during execution.
Dynamically resolved calls and indirect jumps may be missing. Compare important authorization paths with runtime observations where feasible. Identify manually assigned analysis names as annotations rather than original symbols.
Checks and decisions
- Review call assumptions
- Record addresses
- Support findings with execution tests
Cutter can help communicate findings; it is neither a complete security scan nor RASP by itself.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.