Binary Scanner

The Binary Scanner inspects compiled binaries to discover linked cryptographic libraries, embedded certificates, and code signatures.

What It Scans

Compiled binary files including:

• Windows: DLL, EXE files (Authenticode signatures)
• Linux: SO (shared object) files
• Java: JAR files (JAR signatures, embedded certs)

How It Works

1. Walks configured directories looking for binary files by extension
2. Analyzes each binary for:
   • Linked crypto libraries — detects references to OpenSSL, BoringSSL, NSS, Windows CryptoAPI
   • Embedded certificates — finds X.509 certificates compiled into the binary
   • Code signatures — extracts Authenticode (Windows) or JAR signing certificates
   • Signature algorithms — identifies the algorithms used for code signing
3. Reports library versions where detectable

Configuration

scanners:
  binary:
    - paths:
        - /usr/local/bin
        - /opt/app/lib
        - C:\Program Files\MyApp
      extensions:
        - dll
        - exe
        - so
        - jar

Parameter	Required	Default	Description
paths	Yes	—	List of directories to scan
extensions	No	dll, exe, so, jar	File extensions to include

Assets Produced

Asset Type	What’s Captured
algorithm	Linked crypto library name and version, algorithm implementations detected
signature	Code signing algorithm, signer certificate reference, timestamp
certificate	Embedded or signing certificates with full X.509 properties

What Gets Detected

Detection Type	Examples
Crypto libraries	OpenSSL 1.1.1, BoringSSL, NSS 3.68, Windows CNG
Embedded certs	Root CA certificates compiled into applications
Authenticode	Windows code signing certificates and timestamp countersignatures
JAR signatures	Java archive signing certificates
Signature algorithms	SHA256withRSA, SHA384withECDSA

Deduplication

• Embedded certificates: SHA-256 of DER-encoded bytes
• Signatures: SHA-256 of signer certificate + binary file hash
• Algorithms: Deduplicated by library name + version + binary path

Use Cases

• Audit deployed binaries for crypto library versions — find outdated OpenSSL
• Verify code signing — ensure all production binaries are properly signed
• Detect expired signing certificates before they affect software updates
• Identify embedded root CAs that may need rotation

Example Output

{
  "type": "signature",
  "algorithm": "SHA256withRSA",
  "signerSubject": "CN=Example Corp Code Signing, O=Example Corp",
  "signerFingerprint": "sha256:f6a7b8c9d0e1...",
  "timestamp": "2024-03-01T14:30:00Z",
  "source": {
    "scanner": "binary",
    "filePath": "/opt/app/lib/crypto-service.jar",
    "signatureType": "JAR",
    "fileSize": 4521984
  }
}

{
  "type": "algorithm",
  "name": "OpenSSL",
  "version": "1.1.1w",
  "category": "crypto-library",
  "source": {
    "scanner": "binary",
    "filePath": "/usr/local/bin/myapp",
    "linkType": "dynamic"
  }
}

---

← Back to Scanners Overview | Sensor Setup Guide