JSON Schema

JSON Schema (version 1)

--json writes a single pretty-printed JSON document to stdout — nothing else is printed, so output stays pipe-safe. On failure, a human-readable error goes to stderr with a non-zero exit code; no partial JSON is ever emitted.

Envelope

{
  "schema_version": 1,
  "format": "ELF",
  "file": { ... },
  "elf": { ... },
  "sections": [ ... ],
  "segments": [ ... ],
  "dynamic": { ... },
  "symbols": [ ... ],
  "mitigations": { ... },
  "notes": [ ... ],
  "relocations": [ ... ],
  "hashes": { ... }
}

schema_version is 1; the inspection result is flattened to the top level. Field names and types are the contract — renaming or retyping a field is a breaking change and bumps the version.

Top-level fields

Field	Type	Contents
schema_version	number	Always 1
format	string	"ELF"
file	object	size_bytes
elf	object	class, endianness, elf_type, machine, os_abi, abi_version, entry_point, flags, section/program table geometry
sections	array	index, name, section_type, flags, address, offset, size, link, info, alignment, entry_size, entropy (nullable — sections with no file bytes, e.g. .bss)
segments	array	index, segment_type, flags, offset, virtual_address, file_size, memory_size, alignment
dynamic	object	interpreter (nullable), needed[], rpath, runpath, bind_now, entries[] with tag, tag_name, value, string_value
symbols	array	index, name, value, size, sym_type, binding, visibility, section_index (nullable), is_import, is_export, table (symtab/dynsym)
mitigations	object	relro, nx, pie, stack_canary, fortify, fortified_functions[], rwx_segments, has_insecure_rpath — see Security-Checks
notes	array	name, note_type, description, build_id (nullable), abi_tag (nullable), properties[]
relocations	array	section_name, offset, rel_type, symbol_index, symbol_name (nullable), addend (nullable)
hashes	object	sha256 (hex)

Guarantees

• Deterministic: arrays preserve file order; no map iteration reaches output.
• Owned and typed: every value comes from the validated domain model (model.rs), never raw bytes.
• Sanitized strings: binary-provided strings are rendered printable-ASCII with other bytes escaped \xNN, so JSON stays valid for any input.
• Serialized with serde_json; every model type derives Serialize.

Recipes

binary-inspector /bin/ls --json | jq '.mitigations'
binary-inspector /bin/ls --json | jq '.sections[] | select(.entropy != null and .entropy > 7.5)'
binary-inspector /bin/ls --json | jq -r '.dynamic.needed[]'