fingerprinting-binaries
Identifies binary file characteristics including compiler signatures, version information, and build environment details. Use when analyzing unknown binaries, investigating binary origins, or identifying build configurations.
When & Why to Use This Skill
This Claude skill provides comprehensive binary fingerprinting capabilities, allowing users to identify compiler signatures, version information, and build environment details from executable files. It automates the extraction of critical metadata, library dependencies, and architectural features to facilitate deep analysis of unknown binaries and security posture assessment.
Use Cases
- Malware Analysis: Rapidly identify the origin and characteristics of unknown or suspicious binary files by detecting compiler artifacts and build timestamps.
- Security Auditing: Evaluate the security features of compiled software, such as stack canaries and instruction set extensions, to ensure compliance with modern security standards.
- Software Supply Chain Verification: Investigate binary origins and library dependencies to detect the use of outdated or vulnerable components in the build process.
- Reverse Engineering: Streamline the initial phase of reverse engineering by automatically classifying architecture, endianness, and entry points of complex binaries.
| name | fingerprinting-binaries |
|---|---|
| description | Identifies binary file characteristics including compiler signatures, version information, and build environment details. Use when analyzing unknown binaries, investigating binary origins, or identifying build configurations. |
Binary Fingerprinting
Detection Workflow
- Extract strings: Use
stringsto get all strings, identify version strings, find compiler-related strings, extract build information - Analyze imports: Identify imported functions, check library dependencies, assess API usage patterns, identify OS/version
- Examine code structure: Analyze function prologues/epilogues, check for stack canaries, identify security features, assess code patterns
- Assess binary characteristics: Determine architecture, identify compiler, estimate build date, classify binary type
Key Patterns
- Compiler signatures: GCC/Clang/MSVC artifacts, compiler version indicators, optimization level signatures, standard library versions
- Build information: build timestamps, source file paths, debug symbols, build configuration strings
- Library signatures: static library linking, library version indicators, custom library usage, third-party dependencies
- Architecture features: CPU architecture (x86, ARM, MIPS), instruction set extensions (SSE, AVX, NEON), endianness (little/big), ABI
Output Format
Report with: id, type, subtype, severity, confidence, binary_info (architecture, endianness, file_type, entry_point), compiler_info (compiler, version, optimization, confidence), build_info (build_date, build_host, source_paths), libraries, security_features, recommendations.
Severity Guidelines
- INFO: Informational only, no security impact
- LOW: Outdated compiler or libraries with known issues
- MEDIUM: Missing security features
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies