Knife is a standalone Rust CLI for static binary analysis of PE, ELF, and Mach-O files. It combines header parsing, strings extraction, and disassembly into a single tool that recovers functions from stripped binaries using exception directories. The audit command specifically flags dangerous call sites where argument provenance suggests potential bugs like integer underflows.
This is a solid alternative to juggling five separate tools if you need to triage untrusted binaries quickly. However, it is strictly static and will not help with dynamic debugging or network traffic analysis. The analysis depth depends on the quality of the binary's metadata, so heavily obfuscated or packed targets may not yield much insight.
Leave a comment