Binary Fingerprinting
Detection Workflow
- Extract strings: Use
strings to get all strings, identify version strings, find compiler-related strings, extract build information
- Analyze imports: Identify imported functions, check library dependencies, assess API usage patterns, identify OS/version
- Examine code structure: Analyze function prologues/epilogues, check for stack canaries, identify security features, assess code patterns
- Assess binary characteristics: Determine architecture, identify compiler, estimate build date, classify binary type
Key Patterns
- Compiler signatures: GCC/Clang/MSVC artifacts, compiler version indicators, optimization level signatures, standard library versions
- Build information: build timestamps, source file paths, debug symbols, build configuration strings
- Library signatures: static library linking, library version indicators, custom library usage, third-party dependencies
- Architecture features: CPU architecture (x86, ARM, MIPS), instruction set extensions (SSE, AVX, NEON), endianness (little/big), ABI
Output Format
Report with: id, type, subtype, severity, confidence, binary_info (architecture, endianness, file_type, entry_point), compiler_info (compiler, version, optimization, confidence), build_info (build_date, build_host, source_paths), libraries, security_features, recommendations.
Severity Guidelines
- INFO: Informational only, no security impact
- LOW: Outdated compiler or libraries with known issues
- MEDIUM: Missing security features
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: fingerprinting-binaries3description: Identifies binary file characteristics including compiler signatures, version information, and build environment details. Use when analyzing unknown binaries, investigating binary origins, or identifying build configurations.4---5
6# Binary Fingerprinting
7
8## Detection Workflow
9
101. **Extract strings**: Use `strings` to get all strings, identify version strings, find compiler-related strings, extract build information
112. **Analyze imports**: Identify imported functions, check library dependencies, assess API usage patterns, identify OS/version
123. **Examine code structure**: Analyze function prologues/epilogues, check for stack canaries, identify security features, assess code patterns
134. **Assess binary characteristics**: Determine architecture, identify compiler, estimate build date, classify binary type
14
15## Key Patterns
16
17- Compiler signatures: GCC/Clang/MSVC artifacts, compiler version indicators, optimization level signatures, standard library versions
18- Build information: build timestamps, source file paths, debug symbols, build configuration strings
19- Library signatures: static library linking, library version indicators, custom library usage, third-party dependencies
20- Architecture features: CPU architecture (x86, ARM, MIPS), instruction set extensions (SSE, AVX, NEON), endianness (little/big), ABI
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, binary_info (architecture, endianness, file_type, entry_point), compiler_info (compiler, version, optimization, confidence), build_info (build_date, build_host, source_paths), libraries, security_features, recommendations.
25
26## Severity Guidelines
27
28- **INFO**: Informational only, no security impact
29- **LOW**: Outdated compiler or libraries with known issues
30- **MEDIUM**: Missing security features
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
aibot88