cantordust-viz

# Cantordust Binary Visualization > **Use when embeddings fail: humans see patterns algorithms miss.** Visual binary analysis tool for Ghidra. Converts binary data to bitmaps/visualizations where structural patterns become visible to human pattern recognition. ## GF(3) Triad ``` cantordust-viz (-1) ⊗ skill-embedding-vss (0) ⊗ radare2-hatchery (+1) = 0 ✓ ``` ## Lineage: 2020 Binary Analysis | Tool | Approach | Strength | |------|----------|----------| | **Cantordust** | Visual/human | Sees patterns ML misses | | **Zignatures** | Soft signatures | Fuzzy matching + keyspace reduction | | **skill-embedding-vss** | MLX embeddings | O(1) similarity at scale | ## Installation ```bash git clone https://github.com/Battelle/cantordust.git # Add to Ghidra Script Manager ``` ## Key Insight From xoreaxeaxeax's work: - **movfuscator**: All x86 can be MOV (Turing-complete) - **sandsifter**: Fuzzing reveals undocumented CPU instructions - **Cantordust**: Binary structure visible in 2D projections ## When to Use 1. **Embedding similarity unclear** → visualize both binaries 2. **Obfuscation suspected** → visual patterns survive obfuscation 3. **Cross-architecture comparison** → structural similarity visible 4. **Malware family classification** → visual fingerprinting ## xoreaxeaxeax Ecosystem (19K+ stars) | Repo | Stars | Category | |------|-------|----------| | movfuscator | 10,075 | obfuscation | | sandsifter | 4,998 | hardware security | | rosenbridge | 2,380 | hardware backdoors | | REpsych | 1,031 | anti-RE | ## Integration with skill-embedding-vss ```python # When embeddings show high similarity but you want visual confirmation from cantordust import visualize_binary from skill_embedding_vss import SkillEmbeddingVSS vss = SkillEmbeddingVSS('/path/to/skills') similar = vss.find_nearest('target', k=5) # Visual confirm top matches for name, dist in similar[:3]: visualize_binary(f'/path/to/{name}') # Human reviews ``` ## References - [Cantordust GitHub](https://github.com/Battelle/cantordust) - [Battelle Blog Post](https://inside.battelle.org/blog-details/battelle-publishes-open-source-binary-visualization-tool) - [DEF CON talks by xoreaxeaxeax](https://www.youtube.com/results?search_query=xoreaxeaxeax+defcon) ## Cantordust ↔ Gay.jl Bridge ```julia # cantordust_gay_bridge.jl connects: # 1. Cantordust 2-tuple byte pair visualization # 2. CJ Carr spectral features (diffusion transformers) # 3. Gay.jl deterministic coloring (SPI) result = analyze_binary_with_gay("target.bin") # Returns: matrix, diagonal_score, ascii_score, trit_sum, sample_colors ``` ## Pattern Theory | Domain | Representation | Gay.jl Mapping | |--------|----------------|----------------| | Binary (Cantordust) | 2-tuple → 256×256 | entropy → trit → color | | Audio (CJ Carr) | Mel spectrogram | centroid/flatness → HSL | | Color (Gay.jl) | SplitMix64 + golden angle | SPI deterministic |