FAQ

FAQ

Does BinaryInspector execute the file I'm inspecting? Never. It reads bytes and decodes ELF structure. See Safety-Model.

Does it support PE (Windows) or Mach-O (macOS) binaries? No — ELF only, by design. Binary-provided facts only; no emulation, no scoring.

Why is my symlink rejected? Only regular files are accepted. This guarantees the bytes analyzed are the bytes read in one bounded pass, with no device/FIFO reads or link-following races. Inspect the target path directly.

What's the maximum file size? 512 MiB. Larger inputs fail fast with a size-limit error.

The binary is stripped — will anything work? Yes. When there are no symbol/section tables, the parser recovers the dynamic table from PT_DYNAMIC, resolves DT_NEEDED libraries via DT_STRTAB, and still reports segments, interpreter, and mitigations. Symbols/sections will simply be absent or minimal.

Why does a checksec item say "unknown" instead of "on"/"off"? Some protections are only provable in certain binary shapes (e.g., canary needs a stack_chk reference; IBT/SHSTK need PT_GNU_PROPERTY). Absence of evidence is reported as unknown rather than guessed. See Security-Checks.

How do I turn off colors in scripts? NO_COLOR=1 environment variable or --no-color flag.

Is the JSON output stable? Yes — schema version 1. Fields are added carefully; a field rename or type change is a breaking change. Parse the schema_version field before relying on specific keys. See JSON-Schema.

Can the GUI open files via drag-and-drop? Yes — drop an ELF anywhere on the window, use Open File…, pick from Recent, or pass a path on the command line. Esc closes the detail panel or cancels a load.

Does the GUI run on Wayland? Yes — builds include both wayland and x11 support; the file chooser uses the XDG portal.

Why do huge generated files with thousands of duplicate sections take longer? Every declared section is validated (bounds + name). Duplicate sections pointing at the same data are still walked once each; caps keep this bounded, but declaring thousands of sections legitimately costs thousands of validations.

What do the exit codes mean? 0 success · 1 usage · 2 filesystem · 3 malformed/unsupported. See Exit-Codes-and-Errors.

Is entropy shown for packed binaries? Yes — the Overview and each writable executable section show an entropy estimate to hint at packing/unusual content. It's a hint, not a verdict.