Package: blint
BLintBLint is a Binary Linter to check the security properties, and capabilities in your executables. It is powered bylief. Since version 2, blint can also generate Software Bill-of-Materials (SBOM) for supported binaries.Supported binary formats:Android (apk, aab)ELF (GNU, musl)PE (exe, dll)Mach-O (x64, arm64)You can run blint on Linux, Windows and Mac against any of these binary formats.MotivationNowadays, vendors distribute statically linked binaries produced by golang or rust or dotnet tooling. Users are used to running antivirus and anti-malware scans while using these binaries in their local devices. Blint augments these scans by listing the technical capabilities of a binary. For example, whether the binary could use network connections, or can perform file system operations and so on.The binary is first parsed using lief framework to identify the various properties such as functions, static, and dynamic symbols present. Thanks to YAML basedannotationsdata, this information could be matched against capabilities and presented visually using a rich table.NOTE: The presence of capabilities doesn't imply that the operations are always performed by the binary. Use the output of this tool to get an idea about a binary. Also, this tool is not suitable to review malware and other heavily obfuscated binaries for obvious reasons.Use casesQuickly identify malicious binaries by looking at their capabilities (Ability to manipulate networks or drivers or kernels etc)Add blint to CI/CD to inspect the final binaries to ensure code signing or authenticode is applied correctlyIdentify interesting functions and symbols for fuzzingInstallationInstall python 3.10, 3.11, or 3.12pipinstallblintSingle binary releasesYou can download single binary builds from theblint-bin releases. These executables should work with requiring python to be installed. The macOS .pkg file is signed with a valid developer account.Usageusage:blint[-h][-iSRC_DIR_IMAGE[SRC_DIR_IMAGE...]][-oREPORTS_DIR][--no-error][--no-banner][--no-reviews][--suggest-fuzzable]{sbom}...

BinarylinterandSBOMgenerator.

options:-h,--helpshowthishelpmessageandexit-iSRC_DIR_IMAGE[SRC_DIR_IMAGE...],--srcSRC_DIR_IMAGE[SRC_DIR_IMAGE...]Sourcedirectories,containerimagesorbinaryfiles.Defaultstocurrentdirectory.-oREPORTS_DIR,--reportsREPORTS_DIRReportsdirectory.Defaultstoreports.--no-errorContinueonerrortopreventbuildfrombreaking.--no-bannerDonotdisplaybanner.--no-reviewsDonotperformmethodreviews.--suggest-fuzzableSuggestfunctionsandsymbolsforfuzzingbasedonadictionary.

sub-commands:Additionalsub-commands{sbom}sbomCommandtogenerateSBOMforsupportedbinaries.SBOM sub-commandusage:blintsbom[-h][-iSRC_DIR_IMAGE[SRC_DIR_IMAGE...]][-oSBOM_OUTPUT][--deep]options:-h,--helpshowthishelpmessageandexit-iSRC_DIR_IMAGE[SRC_DIR_IMAGE...],--srcSRC_DIR_IMAGE[SRC_DIR_IMAGE...]Sourcedirectories,containerimagesorbinaryfiles.Defaultstocurrentdirectory.-oSBOM_OUTPUT,--output-fileSBOM_OUTPUTSBOMoutputfile.Defaultstobom.jsonincurrentdirectory.--deepEnabledeepmodetocollectmoreusedsymbolsandmodulesaggressively.Slowoperation.To test any binary including default commandsblint-i/bin/netstat-o/tmp/blintUse -i to check any other binary. For eg: to check ngrokblint-i~/ngrok-o/tmp/blintPass--suggest-fuzzableto get suggestions for fuzzing. A dictionary containing "common verbs" is used to identify these functions.blint-i~/ngrok-o/tmp/blint--suggest-fuzzableTo generate SBOM inCycloneDX formatfor supported binaries, use the sbom sub-command.blintsbom-i/path/to/apk-obom.jsonblintsbom-i/directory/with/apk/aab-obom.jsonTo parse all files including.dexfiles, pass--deepargument.blintsbom-i/path/to/apk-obom.json--deepPowerShell exampleReportsBlint produces the following json artifacts in the reports directory:blint-output.html - HTML output from the console logsexename-metadata.json - Raw metadata about the parsed binary. Includes symbols, functions, and signature informationfindings.json - Contains information from the security properties audit. Useful for CI/CD based integrationreviews.json - Contains information from the capability reviews. Useful for further analysisfuzzables.json - Contains a suggested list of methods for fuzzingsbom command generates CycloneDX json.Referenceslief exampleschecksecDiscord supportThe developers could be reached via thediscordchannel.