binsider

Binsider is a terminal user interface (TUI) tool for reverse engineers that provides several analysis capabilities:

• General Analysis: Retrieves file information like size, ownership, permissions, and linked shared libraries (similar to stat(1) and ldd(1)).
• Static Analysis: Analyzes ELF layout, including sections, segments, symbols, and relocations.
• Dynamic Analysis: Executes the binary to trace system calls, signals, and execution flow (similar to strace(1) and ltrace(1)).
• String Extraction: Extracts strings from the binary to find URLs, passwords, or other sensitive data (similar to strings(1)).
• Hexdump: Provides a structured hexdump view for analyzing binary content.

When viewing the static analysis layout in Binsider, you can use the following keyboard shortcuts to navigate the data:

• Vertical Scrolling: Use n (next) and p (previous) to select different blocks, or h/j/k/l for standard directional movement.
• View Details: Press enter on a selected item to view its specific details.
• Horizontal Scrolling: Use h and l to scroll horizontally through tables.
• Search: Press / to search for a specific value within the view.

To build binsider from the source repository, ensure you have Cargo installed with a minimum supported Rust version (MSRV) of 1.74.1.

Follow these steps:

1. Clone the repository and enter the directory.
2. Run the build command using Cargo.

The resulting binary will be located at target/release/binsider.

git clone https://github.com/orhun/binsider
cd binsider/
CARGO_TARGET_DIR=target cargo build --release

You can use binsider to drill down into the dependencies of a binary. In the Linked Shared Libraries view:

1. Navigate to a specific shared library in the list.
2. Press <kbd>enter</kbd> to re-run binsider specifically on that selected shared library.
3. Use <kbd>backspace</kbd> to navigate back to the previous binary in the analysis path.

The current analysis path is displayed in the top right corner of the screen.

A full implementation of the binsider TUI is available in the repository's examples directory. You can run it locally using cargo.

cargo run --example demo

You can edit binary data directly within the hexdump view like a text editor.

1. Start typing the new hex values at the desired location.
2. Press s to save the changes back to the binary file.

Requirements & Safety:

• Read-Write Mode: The binary file must be opened in read-write mode for modifications to persist.
• Backup: Always back up your binary file before making changes, as edits are written directly to the file.

You can install binsider on Arch Linux using the official repositories via the pacman package manager.

pacman -S binsider

To analyze a specific binary located on your host machine, mount the directory containing the binary as a volume to /app/custom inside the container, then pass the filename as an argument to binsider.

docker run --rm -it -v "custom:/app/custom:rw" "orhunp/binsider:${TAG:-latest}" custom

The dynamic analysis feature is gated behind the dynamic-analysis feature flag. To run binsider on platforms where dynamic analysis is not supported (such as macOS or Windows), build the project with the following command to disable the default features:

cargo build --no-default-features

While running binsider in string extraction mode, you can interact with the results using the following keyboard shortcuts:

• Press / to initiate a search.
• Press enter to view the details of a selected string.

To start analyzing a binary file using the binsider terminal user interface, run the command followed by the path to the target binary.

Example usage: binsider <binary>

Use binsider to extract printable strings from binary files, similar to the strings(1) command. This is useful for identifying URLs, passwords, and other sensitive information embedded in a binary.

To adjust the minimum length of the strings being extracted, you can:

1. Use the <kbd>+</kbd> or <kbd>-</kbd> keys while the tool is running.
2. Use the -n command-line argument when starting binsider.