Binary Analyzer Beta

Identifies quantum-vulnerable cryptography in compiled binaries without requiring source code. Works across Windows, Linux, and macOS formats and produces a quantum risk score with prioritized remediation guidance.

Cross-platform analysis: Cerebion Rivet can analyze binaries from any platform regardless of where you're running it. A Windows user can analyze Linux ELF binaries, macOS Mach-O libraries, or Docker image layers without needing to run the analysis on the target OS.

Supported File Formats

See Settings → Binary Analysis to configure resource limits.

Scan Options

Analysis Type

Analysis Depth

Business Criticality

Affects the Business Impact component (20%) of the Quantum Risk Score. Options: Low, Medium (default), High, Critical. Use Critical for production binaries handling sensitive data or regulated workloads.

Compliance Requirements

Optional. Selecting compliance frameworks increases the Business Impact score component for regulated environments. Supported: fedramp, hipaa, pci, sox.

How Analysis Works

1. Signature-based pattern scanning — scans the raw binary bytes against a quantum-specific detection ruleset. Fast and format-agnostic. Runs on every scan regardless of backend.
2. Binary structure parsing — parses the binary format (PE/ELF/Mach-O), extracts imported symbols, exported functions, section metadata, and security flags (ASLR, DEP, stack canaries).
3. Disassembly — disassembles code sections to identify cryptographic operations at the instruction level.
4. .NET metadata — for PE binaries, extracts managed code metadata to detect .NET cryptographic API usage.
5. Risk scoring — findings from all sources feed into the unified 4-component Quantum Risk Score (0–100).

Result Fields Explained

Quantum Risk Score

Risk Score Breakdown

The Quantum Risk Score is a weighted sum of four components, each normalized to 0–100.

Pattern Scan Analysis

Binary Analysis

Analysis Confidence

The analyzer validates result quality before scoring and reports a confidence level:

Recommendations

Three recommendation categories are generated based on the risk assessment:

• Immediate Actions — steps to take now (e.g. replace RSA with ML-KEM, migrate to AES-256)
• Migration Strategy — medium-term plan for transitioning to post-quantum cryptography
• Long-Term Recommendations — crypto-agility framework, compliance alignment, ongoing monitoring

Q-Score Reference

Each pattern signature match carries a Q-Score (1–5) indicating the severity of the quantum risk for that specific pattern. The Q-Score feeds into the Algorithm Risk component of the unified score.

Detection Categories

The pattern detection engine covers the following categories:

Post-Quantum Migration Reference

When the analyzer identifies a vulnerable algorithm, it maps it to the appropriate NIST-standardized replacement:

Resource Limits

All limits are configurable in Settings → Binary Analysis.

Stripped and Packed Binaries

Stripped binaries (no symbol table) and packed/obfuscated binaries present challenges for binary analysis:

• Stripped binaries — signature-based pattern scanning still works on raw bytes. Binary analysis may find fewer named crypto functions but can still detect crypto constants and instruction patterns. Confidence level will be Pattern Primary or Medium.
• Packed binaries — the outer packer layer may prevent crypto detection. Pattern scanning may still match packer signatures.
• Very small binaries (<100 KB with no analyzable functions) — the analyzer may return UNKNOWN if neither pattern scanning nor binary analysis finds anything meaningful. This is expected for test stubs or minimal executables.

Limitations

The Binary Analyzer performs static analysis only — it does not execute code. The following scenarios are outside its detection scope:

• Runtime-only crypto — cryptographic algorithms loaded or constructed at runtime (e.g. dynamically assembled key material, reflective loading) are not visible to static analysis.
• Custom or proprietary implementations — crypto implementations that do not use known constants, OIDs, or library function names will not be detected. Rivet detects known patterns; it cannot reason about unknown ones.
• Encrypted or heavily obfuscated payloads — if the binary's code section is encrypted and unpacked only at runtime (common in commercial protectors), detection coverage is reduced. Pattern scanning may still match the outer layer.
• Key size inference — when a key size cannot be extracted from the binary, Rivet applies conservative worst-case assumptions in the risk score (e.g. RSA without a detected key size is treated as RSA-2048).
• Unsupported formats — file types other than PE, ELF, Mach-O, .NET, Java .class/JAR, and DEX are not analysed. An unsupported format returns no findings, not a clean result.

A clean scan result means no known vulnerable cryptographic patterns were detected. It does not constitute a guarantee of quantum safety.

Relationship to Other Analyzers

The Binary Analyzer uses the same 4-component unified risk engine as the Certificate and Network Analyzers. The difference is the detection method — instead of inspecting a TLS certificate, it inspects compiled binary code. The risk score scale (0–100) and component weights are identical across all analyzers.

For full documentation of the risk scoring methodology and quantum computing threat timeline, see the Risk Scoring documentation.