Definition
Binary Analysis
Binary analysis is the practice of collecting information about a program from its compiled binary rather than its source, in order to understand behaviour, hunt for bugs, or reverse-engineer unknown code. It comes in two complementary forms: static analysis, which inspects the file without executing it, and dynamic analysis, which runs the program under a debugger or tracer to observe its runtime behaviour.
The Two Modes
Complementary, not alternatives
Static analysis is safe — nothing is executed, so a malicious binary cannot infect the analyst’s machine — but it can only see what the disassembler and decompiler can recover, and obfuscation hides a lot. Dynamic analysis shows the program’s actual behaviour, including anything that only manifests at runtime, but runs the risk of triggering the malware it studies, so it is usually done in a sandbox or on a VM. The two are combined in practice: static recon to find entry points, strings, and interesting functions; dynamic steps to confirm hypotheses and watch state change.
Tool Families
Tools used against an ELF binary
The standard toolbox splits cleanly along the static/dynamic axis:
- static —
file,objdump,readelf,strings,ldd(see Static Binary Analysis);- dynamic —
gdb+pwndbg,strace,ltrace(see Dynamic Binary Analysis);- supporting — the Ghidra reverse-engineering suite (decompiler), the exploit-development library
pwntools, andchecksec(which reports properties such as PIE and stack canaries).