1

Is there a open-source Linux tool / utility for Linux platform that would recursively search for binary files (executable, shared / static objects, etc), in a folder and display?

closed as off-topic by perror, Rolf Rolles, Jason Geffner, 0xC0000022L, ixje Mar 25 '14 at 21:07

  • This question does not appear to be about reverse engineering within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What do you mean by binary file ? Is, for an instance, mp3 music file binary ? – w s Mar 25 '14 at 7:35
  • I have mentioned in the parenthesis: executable, shared / static objects, etc. I am not interested in .mp3 or .ogg or .gif or .jpeg :). – AjayKumarBasuthkar Mar 25 '14 at 9:03
  • 5
    This question appears to be off-topic because it is about basic Unix shell commands. Not about reverse-engineering. – perror Mar 25 '14 at 9:22
  • @perror, I believe, answer to the question helps to begin reverse-engineering a binary knowing that it belongs to 'a' architecture and one can process the binary alive on a compatible virtual or physical platform, the answer very much helps in disassembly or decompilation, it definitely helps to begin with, "...explore the principles of a system through analysis of its structure, function, and operation ...", so what if it is a basic Unix Shell Command?, requesting you to review your opinion, it is not necessary that only experts visit here. – AjayKumarBasuthkar Apr 29 '16 at 4:28
  • Your question is way to basic and weak compared to the scope of this website. It could have been covered in Unix & Linux or in SO with no problem. – perror Apr 29 '16 at 7:37
3

When looking for files containing executable code in a well known format, you could search using find and file:

find . -type f -print0 | xargs -0 file | grep -i "i386\|x86\|arm\|ar archive"

This will get you all files which file labeled with the processor name for i386, x86 or arm.

Note that there are many filetypes which file does not recognize. It will for instance not recognize java jar files, or android apk files as executable. Nor will it recognize raw firmware images.

What I actually usually do when researching an unknown system:

  • do find . | xargs file to get a large list of everything
  • then filter out known files, like audio, images, html, text, xml files.
  • then manually inspect what is left over.
  • file also makes lots of mistakes, i usually get quite some number of files labeled as DOS executable, which aren't, also i often see files mislabeled as DBase.
  • This will not find static libraries. You should add "i386\|x86\|arm\|ar\ archive" – w s Mar 25 '14 at 9:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.