Static Binary Analyzer

A small Python tool for doing static checks on ELF and PE binaries. It extracts basic metadata, disassembles code, builds a simple control-flow view, searches for dangerous API calls and suspicious byte patterns, and looks for hardcoded secrets. Designed to be practical and easy to run on a local machine.

---

Features

• Parse ELF and PE files to extract code sections and metadata (MD5/SHA1/SHA256, file type, size).
• Disassemble code with Capstone and (optionally) gather richer info with radare2/r2pipe.
• Simple CFG reconstruction and local context capture for calls.
• Detection of dangerous functions (e.g. strcpy, sprintf, system), format-string risks, stack/heap patterns, and basic taint-ish checks when radare2 is available.
• Scan printable strings for likely secrets (API keys, JWTs, private-key headers, emails, etc.).
• Output reports in text, JSON, or HTML.

---

Prerequisites

• Python 3.8+

• Recommended packages (install via pip):

  pip install capstone pefile pyelftools python-magic r2pipe jinja2
  

  • r2pipe and a local radare2 install are optional but enable deeper analysis.
  • On some systems python-magic may require libmagic (e.g. libmagic / file package).

---

Quick install

Clone the repo and install dependencies:

git clone <your-repo-url>
cd static-binary-analyzer
python -m pip install -r requirements.txt   # if you have a requirements.txt
# or install piecemeal:
python -m pip install capstone pefile pyelftools python-magic
# optionally:
python -m pip install r2pipe jinja2

If you don’t have radare2 and want it:

# on Debian/Ubuntu
sudo apt update && sudo apt install radare2

---

How to run

The analyzer is a simple CLI script. Usage:

# text report (default)
python3 analyzer.py /path/to/binary

# json output
python3 analyzer.py /path/to/binary --format json

# html output
python3 analyzer.py /path/to/binary --format html

Example:

python3 analyzer.py ./samples/hello_world --format html
# -> produces ./samples/hello_world_analysis.html

Notes:

• If r2pipe and radare2 are installed the tool will attempt additional analyses (function lists, taint/data-flow checks, protection flags).
• The script prints progress to stdout and saves JSON/HTML reports to <binary>_analysis.json or <binary>_analysis.html when those formats are requested.

---

Output

• Text: human-readable summary printed to the terminal.
• JSON: structured JSON file containing binary info, protections and findings. Good for automation.
• HTML: simple styled report, useful for sharing.

---

Typical findings

• Dangerous calls (location and context) — e.g. calls to strcpy, sprintf.
• Suspicious byte patterns (NOP sleds, execve syscalls, packer signatures).
• Possible hardcoded secrets found in strings and where they are referenced.
• Basic protection info (NX/ASLR/PIE/RELRO/canary) if radare2 is present.

---