Binary inspector: Mach-O, ELF and PE

Overview — format, CPU, platform and minimum OS (from LC_BUILD_VERSION), UUID or build ID, entry point, the language it was written in (from what the other tabs find), and a card per topic below.

Load commands (Mach-O) — every command with what it says, and the header flags explained (PIE, TWOLEVEL, NO_HEAP_EXECUTION…). Headers (ELF, PE) — program headers, dynamic section, notes (build ID, ABI tag, GNU properties), GNU version needs — with the newest glibc version it needs — or the PE data directories and exports.

Sections — per segment, with addresses, sizes and types. Click one to see its bytes.

Libraries — LC_LOAD_DYLIB, weak, re-exported and upward dylibs with their compatibility and current versions, LC_RPATH entries and where @rpath/ names would be looked for; or ELF’s NEEDED, RPATH, RUNPATH, SONAME and interpreter; or the DLLs a PE imports and from each, which functions.

Symbols — exported, imported and local symbols with the library each import comes from (two-level namespace on macOS, GNU symbol versions on Linux), searchable by text or /regex/, with C and Rust names demangled. C follows LLVM’s c++filt (>> rather than GNU’s > >); Rust handles both the legacy _ZN…17h…E scheme and v0 (_R…) as rustfilt prints it.

Fixups (Mach-O) — chained fixups (macOS 12 and later): each segment’s pointer format and how many binds and rebases it holds, the import table, and every bind with its target, or the classic LC_DYLD_INFO bind opcodes for older binaries. The same list dyld_info -fixups prints.

Signature (Mach-O) — who signed it (ad hoc, Developer ID, Apple, development, App Store) and what that means; a checklist of what notarization needs (Developer ID, hardened runtime, secure timestamp, no get-task-allow); the CodeDirectory as codesign -dvvv prints it, with the cdhash; the flags explained; entitlements from both the XML and the DER blob (and a warning if they differ); the requirements decompiled to text (designated ⇒ identifier "…" and anchor apple generic and …); the certificate chain from the CMS signature; and Verify page hashes, which hashes every page of the code and compares it with the signature.

Hardening (ELF, PE) — the checks checksec makes: RELRO, stack canary, NX, PIE, FORTIFY_SOURCE (which calls were fortified and which could have been), RPATH and RUNPATH, plus Intel CET (IBT, shadow stack) or Arm BTI and PAC from the GNU property note, text relocations and stripping. For PE: ASLR, high-entropy ASLR, DEP, Control Flow Guard and whether it carries an Authenticode signature.

Go — the build info every Go binary since 1.18 carries: Go version, main package and module, every dependency module with its version, go.sum hash and replacement, and the build settings (-trimpath, CGO_ENABLED, GOARCH, -ldflags, vcs.revision, vcs.modified), also as the exact text go version -m prints.

Rust — the compiler version from .comment (ELF) or the commit in /rustc/<hash>/ paths; the crate list from cargo-auditable’s .dep-v0 section if the binary was built with cargo auditable build; and, even in a stripped binary, every crate and version that appears in a panic location’s registry path.

Strings — printable strings by section, with a minimum length, a text or regex filter, and quick filters for paths, URLs, format strings, versions and environment-style names.

Hex — any section or the whole file, a page at a time, jump to an offset.

Sizes — a treemap of the file by segment and section, with __LINKEDIT split into its symbol table, strings, fixups, exports and code signature, and a table of the largest parts.