Static binary analysis is binary analysis performed without executing the program: the analyst inspects the file’s structure, strings, and disassembled code directly from disk. Because nothing is run it is safe against malware, but it can only recover what the disassembler and decompiler can see, and obfuscation limits what static techniques alone reveal.
Tools
The standard static-analysis toolbox
Tool
What it shows
file
the file type — e.g. “ELF 64-bit, dynamically linked”
readelf
the ELF header, program/section headers, and the symbol table (including the address of main)
objdump
the file’s sections and, with -d, its disassembly
strings
printable strings in the file (password prompts, error messages, format strings)
ldd
the shared objects the dynamic linker will load at runtime
These tools inspect the structure of an ELF file without ever loading it for execution — so they can be run on a suspected malware sample without risk.
Disassembly
Turning bytes back into instructions
Disassembly recovers the assembly from a binary’s machine code. On GNU systems the workhorse is objdump with the Intel-syntax flag for readability:
objdump -M intel -ds ./password_manager > pm.s
-d disassembles, -s displays section contents alongside, -M intel selects Intel operand order (destination first), and the redirection saves the listing for browsing. The output mixes addresses (possibly relative/relocatable), the raw machine-code bytes, and the recovered assembly mnemonics; instructions have different lengths on x86, so the byte columns do not align across rows.
What to Look For First
The reconnaissance sequence
The slide’s example binary password_manager shows the canonical order of static questions, each answered by one tool:
file — is it a 32-bit or 64-bit executable, and is it dynamically linked?
ldd — which libraries does it depend on?
readelf — what is the address of main?
strings — what messages (password prompt, success/failure) is it likely to print?
With those answered, objdump’s disassembly of main can be searched for calls such as <strcmp@plt> and <puts@plt> and the jump instructions (jne, jnz, jmp) that implement the program’s branches — long before any execution reveals the answer.