Safety Model

Safety Model

BinaryInspector is built to inspect untrusted files without ever running them. This page lists the guarantees and the mechanisms behind them.

Core guarantees

1. No execution. The tool never executes, maps, loads, or sends the inspected binary anywhere. It reads bytes and decodes structure.
2. No unsafe code. Both executables are compiled with #![forbid(unsafe_code)]. The crate's own SHA-256 and entropy code are plain safe Rust; no third-party crypto dependency.
3. Panic-free parsing. Every parser path returns Result and uses checked arithmetic. Malformed, truncated, or hostile input produces a parse error (exit code 3), never a panic. Release builds additionally set panic = "abort".
4. Regular files only. Symlinks, directories, FIFOs, and device nodes are rejected before any read (read_regular_file). This removes TOCTOU-style surprises and special-device reads.
5. Local only. No network access, no telemetry, no update checks.

Input bounds

Bound	Value	Enforced by
File size	512 MiB	inspect() before reading
File type	regular file only	read_regular_file (lstat check)
Read model	single bounded read into owned Vec<u8>	input module

Parser caps (denial-of-service containment)

A small file can declare enormous tables; the parser caps every table so declared counts can't turn bounded bytes into unbounded work or allocations:

Constant	Limit	What it protects
MAX_TABLE_ENTRIES	65,534	Program headers, section headers
MAX_DYNAMIC_ENTRIES	16,384	PT_DYNAMIC entries
MAX_SYMBOL_ENTRIES	65,536	Symbols per table
MAX_RELOC_ENTRIES	32,768	Relocations
MAX_NOTE_ENTRIES	8,192	ELF notes
MAX_STRING_BYTES	4,096	Any single string from the file
MAX_TOTAL_TEXT_BYTES	4 MiB	All emitted text combined
MAX_TOTAL_SECTION_SCAN_BYTES	64 MiB	Total section-content scanning

Any structure beyond its cap fails with a LimitExceeded error rather than being silently truncated.

Output safety

• Binary-provided strings are rendered as printable ASCII with every other byte escaped as \xNN — deterministic and terminal-safe (no control-character injection in your shell).
• JSON is emitted through serde_json; JSON output goes only to stdout, human logs to stderr.
• Report vectors preserve file order; no user-visible output depends on hash-map iteration, so output is deterministic for identical inputs.

Trust boundaries

untrusted bytes -> input validation -> elf parser (checked, capped)
                -> Binary model (validated owned values) -> report (sanitized text / JSON)

Data flows one way. Untrusted bytes never reach reporting; reporting only sees validated, owned domain values.