The Swiss Army Knife for Binary (In)security

Alan

Last update: Dec 16, 2022

Related tags

Overview

binsec

Swiss Army Knife for Binary (In)security

binsec is a minimal static analysis utility for detecting security capabilities in ELF/PE/Mach-O executables. It's useful for reverse engineers and vulnerability researchers to gain quick and deeper insights into binary artifacts, build fast detection pipelines, and improve overall binary analysis.

Features

Cross-platform, supports robust checks for ELF/PE/Mach-Os while running on any host.
Backends libgoblin for efficient and cross-platform binary parsing.
JSON serializable for storage/logging consumption.
Small and ast: final release build is ~2.44Mb, with analysis done in 30ms.

Static Analysis Checks

The project currently supports static detection for a variety of executable checks:

Compilation Features - insights about how the executable was compiled, and runtimes used in that process.
Exploit Mitigations - OS-supported binary hardening features used to limit exploitation and priviledge escalation.
Dynamic Instrumentation - detects any known instrumentation frameworks used for dynamic analysis and/or profiling.
Anti-Analysis (WIP) - noticeable anti-analysis checks employed to mitigate reverse engineering.

Usage

Install binsec as a command line application as so:

$ cargo install binsec

Using the application is meant to be very simple. Given any binary executable you want to conduct initial analysis, simply pass it in as a positional argument:

$ binsec -- ./suspicious

binsec output can also be serialized into JSON:

# print to stdout
$ binsec --json - -- ./suspicious

# print to path
$ binsec --json report.json -- ./suspicious

Contributing

This is something that is continually being developed! You can contribute by catching issues and bugs and submitting them through the issue tracker or making a pull request!

License

MIT License

Comments

Bump serde_json from 1.0.64 to 1.0.65
Bumps serde_json from 1.0.64 to 1.0.65.

Release notes

Sourced from serde_json's releases.

v1.0.65

Documentation improvements

Commits

c9193d4 Release 1.0.65

f205576 Merge pull request 788 from jplatte/doc-cfg

6f15a0e Add doc(cfg(feature = "std")) attribute where appropriate

d8f70a3 Add CI job to ensure documentation can be built

e2978b6 Document unbounded_depth, raw_value feature-gated API via doc_cfg

ea39063 Update preserve_order required compiler to 1.38.0 for hashbrown

df1fb71 Resolve semicolon_if_nothing_returned clippy lints

e4057c7 Change readme run buttons to tab style

9e45712 Merge pull request 778 from jayeshmann/patch-1

9cbdfc8 Overlapping button fix

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump yara from 0.6.1 to 0.8.0
Bumps yara from 0.6.1 to 0.8.0.

Changelog

Sourced from yara's changelog.

0.8.0 (2021-07-22)

Features

add compile options (6d40365)

add set and get configuration (967b23a)

add callback API into Rules and Scanner (562ec2c)

0.7.0 (2021-07-13)

Features

adding deserialize (10036ad)

vendored feature now uses v4.1.1 (05d130a)

Bug Fixes

unit test scanner_scan_proc encoding (bc62faf), closes #25

yara-sys: show some gcc warnings on vendored build (a93fa08)

Commits

7ad4799 chore(release): 0.8.0

562ec2c Add callback API into Rules (#33)

967b23a Set and get configuration (#35)

6d40365 Add more compile options for libyara (#32)

7613ae7 chore(release): 0.7.0

5bcf074 docs: change Travis badge URL to travis-ci.com

fd7646d feat: hide serde behind a feature gate

10036ad feat: adding deserialize

f8b4e53 Merge pull request #30 from Orycterope/scan_proc_test_tiemout

bc62faf fix: unit test scanner_scan_proc encoding

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump yara from 0.6.1 to 0.7.0
Bumps yara from 0.6.1 to 0.7.0.

Changelog

Sourced from yara's changelog.

0.7.0 (2021-07-13)

Features

adding deserialize (10036ad)

vendored feature now uses v4.1.1 (05d130a)

Bug Fixes

unit test scanner_scan_proc encoding (bc62faf), closes #25

yara-sys: show some gcc warnings on vendored build (a93fa08)

Commits

7613ae7 chore(release): 0.7.0

5bcf074 docs: change Travis badge URL to travis-ci.com

fd7646d feat: hide serde behind a feature gate

10036ad feat: adding deserialize

f8b4e53 Merge pull request #30 from Orycterope/scan_proc_test_tiemout

bc62faf fix: unit test scanner_scan_proc encoding

dcb67a8 Merge pull request #29 from Orycterope/yara_v4.1.1

05d130a bump: vendored feature uses v4.1.1

c30065b Merge pull request #27 from Orycterope/show_cc_warnings

a93fa08 refactor: show cc compilation wanings

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump goblin from 0.4.0 to 0.4.2
Bumps goblin from 0.4.0 to 0.4.2.

Changelog

Sourced from goblin's changelog.

[0.4.2] - 2021-7-4

Added

strtab: preparses the string table to prevent certain class of DoS attacks, thanks @Lichtsto: m4b/goblin#275

[0.4.1] - 2021-5-30

Fixed

elf: fix error when alloc, but not endian, thanks @dancrossnyc: m4b/goblin#273

Commits

b43b93e strtab: re-add new method with original signature, include new_preparsed, so ...

0fe1499 build: update to 0.4.2; add 1 new contributor, update changelog

8febb72 strtab: Parse Strtab only once on Creation (#275)

ef33a75 build: update to 0.4.1; add 1 new contributor, update changelog, add alloc to...

d406a4a build: fix error when alloc, but not endian_fd

b2b15a3 build: goblin is now 0.3 => 0.4, in CHANGELOG (#270)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump goblin from 0.4.0 to 0.4.1
Bumps goblin from 0.4.0 to 0.4.1.

Changelog

Sourced from goblin's changelog.

[0.4.1] - 2021-5-30

Fixed

elf: fix error when alloc, but not endian, thanks @dancrossnyc: m4b/goblin#273

Commits

ef33a75 build: update to 0.4.1; add 1 new contributor, update changelog, add alloc to...

d406a4a build: fix error when alloc, but not endian_fd

b2b15a3 build: goblin is now 0.3 => 0.4, in CHANGELOG (#270)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump serde from 1.0.125 to 1.0.126
Bumps serde from 1.0.125 to 1.0.126.

Release notes

Sourced from serde's releases.

v1.0.126

Resolve conflict with forbid(future_incompatible) lint setting in generated code (#2026, thanks @hyd-dev)

Commits

d9c338e Release 1.0.126

699bf3a Merge pull request #2026 from hyd-dev/warning

dd29825 Allow only unused_extern_crates instead of the whole rust_2018_idioms lin...

6366f17 Ignore clone_instead_of_copied pedantic clippy lint

1120e5a Remove suppression of removed clippy lint

1093f7e Resolve flat_map_option pedantic clippy lint

2ea132b Merge pull request #2018 from dtolnay/nonascii

2ebc771 Remove non_ascii_idents feature gate from test suite

c17c4ee Unify stable and beta CI workflow

7aa4950 Release serde_derive_internals 0.26.0

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump byte-unit from 4.0.11 to 4.0.12
Bumps byte-unit from 4.0.11 to 4.0.12.

Commits

8690c34 bump version

2f7b069 Merge pull request #10 from binarycode/fix-typo

729f085 fix typo

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Upgrade to GitHub-native Dependabot

Dependabot Preview will be shut down on August 3rd, 2021. In order to keep getting Dependabot updates, please merge this PR and migrate to GitHub-native Dependabot before then.

Dependabot has been fully integrated into GitHub, so you no longer have to install and manage a separate app. This pull request migrates your configuration from Dependabot.com to a config file, using the new syntax. When merged, we'll swap out dependabot-preview (me) for a new dependabot app, and you'll be all set!

With this change, you'll now use the Dependabot page in GitHub, rather than the Dependabot dashboard, to monitor your version updates, and you'll configure Dependabot through the new config file rather than a UI.

If you've got any questions or feedback for us, please let us know by creating an issue in the dependabot/dependabot-core repository.

Learn more about migrating to GitHub-native Dependabot

Please note that regular @dependabot commands do not work on this pull request.
dependencies

opened by dependabot-preview[bot] 1
Bump sysctl from 0.4.0 to 0.4.1
Bumps sysctl from 0.4.0 to 0.4.1.

Changelog

Sourced from sysctl's changelog.

[0.4.1] - 2021-04-23

Changed

Replace deprecated failure crate with thiserror.

Fix clippy lints.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump goblin from 0.3.0 to 0.4.0
Bumps goblin from 0.3.0 to 0.4.0.

Changelog

Sourced from goblin's changelog.

[0.4.0] - 2021-4-11

BREAKING

elf: fix returning invalid ranges for SH_NOBIT sections, method changed to return optional range instead, thanks @Tiwalun: m4b/goblin#253

Fixed

pe: pass parse opts correctly in pe parser in lookup table, fixes some issues loading and parsing pe libraries: m4b/goblin#268 elf: remove unnecessary unsafe blocks, thanks @nico-abram: m4b/goblin#261 elf: replace pub type with pub use, thanks @sollyucko: m4b/goblin#259

Added

elf: add a lazy parse example, thanks @jesseui: m4b/goblin#258 elf: add a new fuzzing harness + fix overflows in hash functions and note data iterator construction, thanks @Mrmaxmeier: m4b/goblin#260

[0.3.4] - 2021-1-31

Added

elf: introduce "lazy" parsing of elf structure with new lazy_parse function, which allows user to fill in parts of the ELF struct they need later on; new example provided, as well as some tests, thanks @jessehui: m4b/goblin#254

elf: also add new Elf::parse_header convenience function, which allows to parse elf header from bytes without e.g., explicitly depending on scroll, etc.

[0.3.3] - 2021-1-31

Fixed

mach: fix debug print panic, thanks @messense: m4b/goblin#251

Added

pe: allow pe virtual memory resolve to be optional, allowing memory/process dump parsing, thanks @ko1n (as well as patience for very long time to merge PR!): m4b/goblin#188

[0.3.2] - 2021-1-29

Fixed

elf: overflow panic when note name is 0, thanks @glandium: m4b/goblin#256

[0.3.1] - 2021-1-18

Added

mach: add rpaths, thanks @keith: m4b/goblin#248

Fixed

elf: fix regression parsing binaries like busybox (m4b/bingrep#28), thanks @jan-auer: m4b/goblin#249

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Bump serde from 1.0.123 to 1.0.125
Bumps serde from 1.0.123 to 1.0.125.

Release notes

Sourced from serde's releases.

v1.0.125

Improve performance of serializing Ipv4Addr (#2001, thanks @saethlin)

v1.0.124

Fix possible panic deserializing invalid data as SystemTime (#1997, thanks @cyang1)

Commits

e9270e5 Release 1.0.125

72060b7 Extend test_format_u8 to include u8::MAX

1bb23ad Remove format_u8 when not used by Ipv4Addr impl

9be4c96 Merge pull request 2001 from saethlin/optimize-ipaddr

4114e90 Fix off-by-one mistake, explain the offset

8bb07b0 skip UTF8 checking and initialize with b'.'

ba8c1d6 use the algorithm from itoa

857a805 Faster Ipv4 serialization prototype

5a8dcac Release 1.0.124

697b082 Touch up PR 1997

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)

Pull request limits (per update run and/or open at any time)

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 1
Revamp: binsec for CI/CD

This started out as a learning lesson for parsing binaries with goblin and recognizing exploit protection primitives. However, there can be a much stronger push for this as an integration into software supply chain security mitigations.

binsec should be fully CI/CD ready for GitHub Actions, trigger detections on binary artifact releases and recommending additional compilation steps (as per https://github.com/ex0dus-0x/binsec/issues/62). Not only does this create actionable security items for devs, but also a point of transparency for security researchers looking for vulns.

opened by ex0dus-0x 0
Additional Windows PE and Kernel Checks
Good series of posts with information about different Windows mitigations:

https://www.crowdstrike.com/blog/state-of-exploit-development-part-1/

https://www.crowdstrike.com/blog/state-of-exploit-development-part-2/

For binary checks:

Legacy ASLR

ACG

Authenticode

CET / Return flow guarding

enhancement help wanted good first issue important security-check
opened by ex0dus-0x 0
Incorporate opinionated security recommendations for binary harden checks
If specified with a flag like --opinion, return compiler flags that can be harnessed in order to mitigate any security features that are not set for the specific instance. Ie with partial RELRO for ELF binaries, we can recommend the following to upgrade to a full RELRO to prevent jumps to dynamically linked symbols:

-Wl,-z,relro,-z,now

If flag is set, this output should be incorporated in all output formats that are emitted.
enhancement help wanted experimental
opened by ex0dus-0x 0