Binary analysis tools
Introduction
Binary analysis is a specialization that requires technical knowledge, patience, and especially the right tools. It is also known as reverse engineering and continues to be in demand by security firms. Reverse engineering is definitely a valuable skill to have or obtain. Typically it is used to investigate malware and during digital forensics.
During our reviews, we came across many open source projects. Most of these projects are not just limited to the analysis of binaries, but can also be used to reverse engineer systems and firmware. It is safe to say that there is not a single tool that will perform all activities required during analysis. So instead of picking one, it is worth investigating all options. As always, some projects are a safe pick, as they are popular and often requested in professional experience. Radare2 is a good example of such tool that can be found in the toolbox of the professional reverse engineers.
Usage
Binary analysis tools are typically used for binary analysis, malware analysis, reverse engineering.
Users for these tools include malware analysts and security professionals.
Tools
Popular binary analysis tools
BAP (binary analysis toolkit)
binary analysis, malware analysis
The main purpose of BAP is to provide a toolkit for program analysis. This platform comes as a complete package with a set of tools, libraries, and related plugins. There are bindings available for C, Python, and Rust.
Binary Analysis Next Generation (framework for binary analysis)
binary analysis, malware analysis, malware scanning
BANG is a framework to unpack files recursively and scan them. The files can be firmware, binaries, or malware. The main goal is to scan all files and perform classification and labeling. This way each file can be further analyzed based on the characteristics.
Cutter (graphical user interface for radare2)
binary analysis, malware analysis, reverse engineering
Cutter is a graphical user interface for radare2, the well-known reverse engineering framework. It focuses on those who are not familiar enough with radare2, or rather have a graphical interface instead of the command-line interface that radare2 provides.
LIEF (library for analysis of executable formats)
binary analysis, malware analysis, reverse engineering
In several occasions, it may be useful to perform analysis on binary file formats. Such occasion could be incident response, digital forensics, or as part of reverse engineering tasks. In these cases, a toolkit like LIEF can help to perform this job. It allows you to parse and modify the files. LIEF also will make information available an application programmable interface (API) for automated processing.
Manticore (dynamic binary analysis tool)
binary analysis, malware analysis, reverse engineering
Manticore is a so-called symbolic execution tool to perform a binary analysis. It supports Linux ELF binaries and Ethereum smart contracts. The tool helps with researching binaries and their behavior. This might be useful to learn how malware works and troubleshooting.
PEDA (Python Exploit Development Assistance for GDB)
debugging, exploit development, reverse engineering
PEDA is an extension for GDB (GNU DeBugger) to help with the development of exploit code. It can be used by reverse engineers and pentesters.
PyREBox (Python scriptable Reverse Engineering Sandbox)
binary analysis, malware analysis, reverse engineering
PyREBox is short for Python scriptable Reverse Engineering Sandbox. It provides dynamic analysis and debugging capabilities of a running QEMU virtual machine. The primary usage is the analysis of running processes to perform reverse engineering. PyREBox can change parts of the running system by changing data in memory or within processor registers.
pyelftools (ELF parsing toolkit)
binary analysis, malware analysis
This toolkit is used by other software, or standalone. Its main purpose is to parse binary ELF files and DWARF debugging information. This can be useful during malware analysis or troubleshooting issues with programs.
r2frida (bridge between Radare2 and Frida)
application testing, binary analysis, memory analysis
Both Radare2 and Frida have their own area of expertise. This project combines both, to allow a more extensive analysis of files and processes.
radare2 (reverse engineering tool and binary analysis)
digital forensics, reverse engineering, software exploitation, troubleshooting
Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.
Other related category: Linux reverse engineering tools
Missing a favorite tool in this list? Share a tool suggestion and we will review it.