Architecture

Architecture

CLI or native GUI → input validation → elf parser → analysis → Binary model → reporter

Modules (src/)

Module	Responsibility
lib.rs	inspect(path) — the single inspection entry point both executables call
input	Regular-file validation and bounded byte reads — see Safety-Model
elf	ELF decoding/validation; produces domain values, not terminal text
hash	SHA-256 over the owned buffer
model	Serializable, format-neutral result types (serde::Serialize)
report	Sanitized human text and versioned JSON — see JSON-Schema
cli	clap argument definitions, category selection, exit-code mapping
error	AppError/ParseError with exit codes and UI guidance
text	Printable-ASCII sanitization (\xNN escaping)
gui (bin)	Native eframe executable; calls inspect, never re-parses

Design constraints

• One extension seam. Deliberately no format trait or plugin system: a second format (PE/Mach-O) would add another decoder module beside elf without touching the interaction layers. ELF-only today; other formats are out of scope.
• One-way data flow. Untrusted bytes stay in parsing/analysis; reporting receives validated owned values.
• Determinism. Vectors retain file order; no user-visible output depends on hash-map iteration.
• No unsafe. #![forbid(unsafe_code)] in the library and both executables.
• Panic-free parsing. Checked arithmetic and explicit caps; malformed input becomes ParseError, never a panic.

Concurrency

The GUI inspects on a background thread and receives the finished Binary or AppError over a channel; the CLI is single-threaded. Neither ever executes or loads the target.

Dependencies

Crate	Version	Used by
clap	4.6 (derive)	CLI
eframe/egui	0.36 (glow)	GUI
rfd	0.17 (xdg-portal)	GUI file chooser
serde + serde_json	1.0	Model serialization, JSON report
libc	0.2	Open flags for safe file access

Release profile: thin LTO, one codegen unit, panic = "abort", stripped symbols.