Note: This is a v0 release, API may change.
A tool to analyze ELF binaries for security hardening features.
Focused on binaries compiled with GCC and Clang for amd64, arm64, arm, and riscv.
Binaries where the compiler cannot be detected (e.g. stripped) are analyzed by all loaded rules, since the compiler filter is bypassed when detection fails.
Binaries identified as Go or Rust are skipped, as their hardening model differs from C/C++ compiler flags.
Based on recommendations from:
Prebuilt binaries for Linux and macOS on amd64 and arm64, and for Windows on amd64, are on the releases page.
curl -fsSL https://raw.githubusercontent.com/mkacmar/crack/main/install.sh | shInstalls the latest release into ~/.local/bin and checks the download against SHA256SUMS. It does not check the signature over SHA256SUMS, which the project page shows how to verify.
Requires the Go toolchain:
go install go.kacmar.sk/crack/cmd/crack@latestcrack analyze [options] [<path>...]<path>...- Files or directories to analyze (glob patterns must be expanded by the shell)--recursive- Recursively scan directories--input <file>- Read paths from file, one per line (use-for stdin)--parallel <n>- Number of files to analyze in parallel (default: number of CPUs)
See rules reference for all available rules.
--rules <ids>- Comma-separated list of rule IDs to run--target-compiler <spec>- Only run rules available for these compilers (e.g.,gcc,clang:15)--target-platform <spec>- Only run rules available for these platforms (e.g.,arm64,amd64)
When --rules is not specified, crack runs the following default set:
aslrfortify-sourcefull-relrono-insecure-rpathno-insecure-runpathnx-bitpierelroseparate-codestack-canary
The --target-compiler and --target-platform flags filter which rules are loaded based on their applicability.
At runtime, the tool also detects the actual compiler from binary metadata and skips rules that don't apply to the detected compiler.
For stripped binaries where detection fails, all loaded rules run.
--include-passed- Include passing checks in output--include-skipped- Include skipped checks in output--sarif <file>- Save detailed SARIF report to file--exit-zero- Exit with 0 even when findings are detected
The --include-passed and --include-skipped flags affect both text and SARIF output.
For programmatic access to results, use SARIF output (--sarif). SARIF (Static Analysis Results Interchange Format) is a standardized JSON format. We support SARIF version 2.1.0.
Results are written as files are analyzed, so their order reflects the order analysis finished and varies between runs on the same input. Compare reports semantically rather than by diffing bytes.
A scan that is interrupted still produces a valid report, marked executionSuccessful: false with an explanatory notification, and exits with code 1.
A scan killed outright leaves a partial file behind, so treat a non-zero exit as a reason to discard the report rather than parse it.
--log <file>- Write logs to file--log-level <level>- Log level:none,debug,info,warn,error
Fetch debug symbols from debuginfod servers.
--debuginfod- Enable debuginfod integration--debuginfod-servers <urls>- Comma-separated server URLs--debuginfod-cache-dir <dir>- Cache directory for downloaded symbols--debuginfod-timeout <duration>- HTTP timeout--debuginfod-retries <n>- Max retries per server
Resolve missing sections from a local build-id-indexed debug directory, the layout populated by distro debug packages (dbgsym on Debian/Ubuntu, -debuginfo on Fedora/RHEL/openSUSE).
--local-debuginfo- Enable local debuginfo lookup--local-debuginfo-dir <dir>- Root directory of the local debuginfo store (default/usr/lib/debug)
When both --local-debuginfo and --debuginfod are set, the local store is consulted first and debuginfod serves as a fallback for any sections it cannot supply.
Debug builds (make build) include --cpuprofile and --memprofile flags for the analyze command. These flags are not available in release binaries.
If you experience performance issues, please build from source with make build and attach CPU/memory profiles to your issue. Profiles are written in pprof format and can be analyzed with go tool pprof <file>.
0- Success (no findings, or--exit-zerospecified)1- Error (invalid arguments, file errors, interrupted scan)2- Findings detected
--exit-zero suppresses only the findings exit code. Errors and interrupted scans still exit with 1.
The public packages can be used as a library. See API documentation for details on parsing binaries, running rules, writing custom rules, custom compiler detection, supplying sections from custom sources, and wrapping the Binary input.
MIT License - see LICENSE for details.