blint

blint is a Binary Linter that checks the security properties and capabilities of your executables. It is powered by lief and can generate a Software Bill-of-Materials (SBOM) for supported binaries.

What is blint?

blint is a tool for reverse engineers, security analysts, and developers to quickly assess the security posture and composition of a binary file. In an age of statically-linked Golang, Rust, and .NET applications, understanding what's inside a binary is more important than ever. blint automates this initial triage process.

Supported Binary Formats:

• ELF (for GNU and musl libc)
• PE (Windows executables and DLLs)
• Mach-O (macOS and iOS, x64 and arm64), including Objective-C and Swift metadata
• iOS/macOS apps (.ipa): the main executable, embedded frameworks, dylibs, and app extensions are all analyzed
• WASM (WebAssembly modules)
• Android (APK, APKM, AAB, including DEX files in deep mode)
• Disassembler: AArch64, x86/x86-64, ARM, Mips, MicroMips (native), and Dalvik (DEX).

Key Features & Use Cases

• Comprehensive Security Audits: Automatically checks for common security mitigations like PIE, ASLR, NX, Stack Canaries, and RELRO. Ideal for ensuring your CI/CD pipeline produces hardened binaries.
• Software Bill-of-Materials (SBOM) Generation: Creates CycloneDX SBOMs for binaries built with Go, Rust, .NET, and Android toolchains, providing a clear inventory of third-party components for vulnerability management.
• Deep Binary Inspection: Disassembles, extracts, and analyzes a wealth of information including symbols, functions, dependencies, and build toolchains. This raw data is saved as a detailed JSON file.
  • For a complete guide to all attributes in this file, see the Technical Metadata Documentation.
  • For the custom CycloneDX properties blint adds to the BOM, see the Custom Properties Documentation.
  • Navigate to the disassembly guide.
  • For callgraph internals and analyst-facing interpretation, see the callgraph guide.
• Android Deep Analysis: In deep mode blint parses the dex classes, detects bundled service and tracker SDKs, and runs a Dalvik behavioural review that decodes the bytecode and flags risky behaviours such as dynamic code loading, reflection, native command execution, weak cryptography, and cleartext networking. The findings are attached to the BOM as custom properties. When disassembly is enabled, blint also writes a Dalvik callgraph sidecar next to the BOM.
• iOS/macOS App Analysis: Point blint at an .ipa and it unpacks the app bundle, reads the Info.plist context (bundle id, version, minimum OS, FairPlay encryption status), and analyzes the main executable along with every embedded framework, dylib, and app extension. For Mach-O binaries, blint recovers Objective-C metadata (classes, superclasses, methods, protocols, and referenced selectors) and demangles Swift symbols, then surfaces iOS privacy capabilities such as location, camera, microphone, contacts, photos, telephony, motion, biometrics, and device fingerprinting. It also reports privacy and fingerprinting behaviours — passive device fingerprinting, installed-app probing, local-network scanning, cross-app tracking, and the app's PrivacyInfo.xcprivacy posture including undeclared "required reason" API usage.
• Capability Analysis: Identifies potentially sensitive capabilities by reviewing imported functions and symbols, such as network access, filesystem operations, or cryptographic API usage.
  • Includes cluster-style behavioral reviews for low-level networking patterns (for example eBPF sock_ops usage, TUN interception stacks, raw packet injection primitives, and local DoH redirection indicators).
• CI/CD Integration: Can be added to build pipelines to enforce security policies, such as requiring code signing on all release artifacts.
• Fuzzing Target Identification: Suggests interesting functions to target for fuzzing based on common patterns in function names (e.g., parse, decode, copy).
• Extensible with Custom Rules: Define your own capabilities and checks using simple YAML rule files.

Installation

blint requires Python >= 3.10.

pip install blint

For disassembly support, which enables instruction-level analysis of functions, install the extended version. This includes the nyxstone disassembler.

pip install blint[extended]

Via Container Image

You can also run blint using the official container image available on GitHub Container Registry. This is a convenient way to run blint without installing Python or any dependencies on your host machine.

docker run --rm -it -v $(pwd):/app -w /app ghcr.io/owasp-dep-scan/blint:latest -i /path/to/your/binary

Quick Start

Analyze a binary and save the reports to the /tmp/blint directory:

blint -i /bin/netstat -o /tmp/blint

docker run --rm -it -v /tmp:/tmp -v /bin:/app/bin -w /app ghcr.io/owasp-dep-scan/blint:latest -i /app/bin/netstat -o /tmp/blint

Analyze a Go or Rust binary and get suggestions for fuzzing targets:

blint -i /path/to/my-binary --suggest-fuzzable

Analyze an iOS/macOS app (.ipa). blint unpacks the bundle and writes a separate *-metadata.json for the main executable and each embedded framework, dylib, and app extension. Add --disassemble for instruction-level analysis (Objective-C and Swift call sites are resolved to imported APIs):

blint -i /path/to/app.ipa -o /tmp/blint --disassemble

Generate a CycloneDX SBOM for an Android application:

blint sbom -i /path/to/app.apk -o sbom.cdx.json

docker run --rm -it -v /path/to:/app -w /app ghcr.io/owasp-dep-scan/blint:latest sbom -i /app/app.apk -o sbom.cdx.json

For Android deep analysis, enable deep mode so the dex classes are parsed. This is what makes service and tracker detection and the Dalvik behavioural review possible. Add --disassembly to also write the Dalvik callgraph sidecar next to the BOM. Both .apk single files and .apkm split bundles are supported.

blint sbom -i /path/to/app.apkm -o sbom.cdx.json --deep --disassembly

Understanding the Output

blint produces several JSON artifacts in the specified reports directory.

Advanced Usage: SBOM Generation with blintdb

For C and C++ binaries, identifying components from symbols alone can be imprecise. blint can use blintdb v2, a pre-compiled database built from real project outputs, to improve component identification with:

• project-level symbol matching
• binary-name hints
• optional disassembly hash matching when deep mode is enabled

The workflow is a two-step process:

1. Download the blintdb database:

   blint db --download
   

   This downloads the database to the directory specified by the BLINTDB_HOME environment variable.

2. Generate the SBOM with blintdb enabled:

   blint sbom -i /path/to/binary -o sbom.cdx.json --use-blintdb
   

3. For higher-confidence native matching, enable deep mode:

   blint sbom -i /path/to/binary -o sbom.cdx.json --use-blintdb --deep
   

   When --use-blintdb and --deep are set together, blint enables disassembly automatically and searches the database with function hashes before falling back to symbol evidence.

The generated SBOM keeps the inferred package purl and also records internal:blintdb_* evidence properties on matched components so you can review why a component was selected.

For repeatable end-to-end validation of local blint-db changes, use the integration script in tests/scripts/validate_blintdb_small_corpus.py. It builds and validates a versioned 15-case corpus split across Meson, vcpkg, and Homebrew, using the manifest stored in tests/data/blintdb-small-corpus.json.

The generated summary.json includes per-ecosystem provenance copied from the linked blint-db run metadata under ecosystems.<name>.provenance. That block mirrors projects.selected_count, attempted_count, success_count, failure_count, status_counts, and build_failures. Each projects.build_failures[] entry is a flattened per-project failure record with stable keys such as selector, project_name, ecosystem, build_system, status, stage, and message, plus optional details like returncode or exception_type when they are available.

WebAssembly Component Model SBOM

blint sbom skips .wasm inputs by default. Pass --wasm-sbom to include Component Model binaries: their imported WIT interface packages (for example wasi:cli at 0.2.0) are emitted as required library components, and the wasm binary itself becomes the application parent.

The purls are built from exact import evidence only (pkg:generic/wasi/cli@0.2.0?type=wasm maps the WIT namespace/package identity; the type=wasm qualifier follows the format proposed in the wasm-tools dependency research notes). Exported interfaces are recorded as a property on the parent rather than as dependencies, because they are capabilities the binary provides. Core modules are skipped: their imports carry no package identity, so no versionless or fuzzy guesses are emitted.

blint sbom -i /path/to/component.wasm -o sbom.cdx.json --wasm-sbom

Environment Variables

• BLINTDB_HOME, BLINTDB_IMAGE_URL, BLINTDB_REFRESH: Control blintdb download location, source image, and refresh behavior.
• BLINT_MAX_HEX_BYTES: Maximum number of raw bytes converted to hex when metadata contains undecodable byte sequences. Default is 4096.
  • 0 disables truncation.
  • When truncation happens, blint appends ...<truncated:N_bytes> to preserve context without producing huge JSON fields.
• BLINT_MAX_WASM_INSTRUCTIONS: Total instruction-stream budget for each *-wasm-report.json. Instruction streams are the only unbounded part of the wasm parser output and dominate the report size for large modules. Default is 50000; 0 disables the cap.
  • The budget is divided max-min fair across every function in the report, so short functions keep their whole body and the remainder goes to the long ones, rather than the first functions in section order consuming everything.
  • Trimmed functions keep their truthful instruction_count and gain an instructions_truncated count, and the report gains a top-level blint_truncation block recording the budget, the instructions dropped, and how many functions were affected.
• BLINT_RESOLVE_LINK_CLOSURE: Set to 1 to resolve each ELF binary's dynamic dependency closure the way the loader would, reporting libraries that cannot be found, imported symbols nothing in the closure defines, and search paths that let an untrusted directory answer first. Off by default, because resolution reads the filesystem the scan runs on and is only meaningful when that filesystem is the binary's intended runtime. Results land in the link_closure metadata block.
  • BLINT_LINK_ROOT: Filesystem root to resolve against. Point this at an unpacked container image or sysroot rather than at the scanning host. Default is /.
  • BLINT_LINK_SEARCH_PATH: Extra directories treated as if they were in LD_LIBRARY_PATH, separated by the platform path separator.

Command-Line Reference

usage: blint [-h] [-i SRC_DIR_IMAGE [SRC_DIR_IMAGE ...]] [-o REPORTS_DIR] [--no-error] [--no-banner] [--no-reviews] [--no-wasm-strings] [--no-wasm-call-graph] [--suggest-fuzzable] [--use-blintdb] {sbom} ...

Binary linter and SBOM generator.

options:
  -h, --help            show this help message and exit
  -i, --src SRC_DIR_IMAGE [SRC_DIR_IMAGE ...]
                        Source directories, container images or binary files. Defaults to current directory.
  -o, --reports REPORTS_DIR
                        Reports directory. Defaults to reports.
  --no-error            Continue on error to prevent build from breaking.
  --no-banner           Do not display banner.
  --no-reviews          Do not perform method reviews.
  --no-wasm-strings     Do not extract strings from wasm files. Shrinks the wasm report and disables the string-based wasm findings (e.g. WASM-STR-007).
  --no-wasm-call-graph  Do not build the wasm_tools call graph for wasm files. Shrinks the wasm report and disables wasm callgraph exports.
  --suggest-fuzzable    Suggest functions and symbols for fuzzing based on a dictionary.
  --use-blintdb         Use blintdb v2 for symbol resolution. Use environment variables: BLINTDB_IMAGE_URL, BLINTDB_HOME, and BLINTDB_REFRESH for customization.
  --disassemble         Disassemble functions and store the instructions in the metadata. Requires blint extended group to be installed.
  --export-callgraph-mermaid
                        Export callgraph as Mermaid (.mmd) files and embed diagrams into blint-output.html. Effective when --disassemble is enabled.
  --export-callgraph-graphml
                        Export callgraph as GraphML for external graph analysis tools. Effective when --disassemble is enabled.
  --export-callgraph-gexf
                        Export callgraph as GEXF for Gephi and other graph tooling. Effective when --disassemble is enabled.
  --callgraph-min-confidence {low,medium,high}
                        Filter exported callgraph edges/external links by confidence. Defaults to low (no filtering).
  --custom-rules-dir CUSTOM_RULES_DIR
                        Path to a directory containing custom YAML rule files (.yml or .yaml). These will be loaded in addition to default rules.
  -q, --quiet           Disable logging and progress bars.

sub-commands:
  Additional sub-commands

  {sbom}
    sbom                Command to generate SBOM for supported binaries.
    db                  Command to manage the pre-compiled database.

usage: blint sbom [-h] [-i SRC_DIR_IMAGE [SRC_DIR_IMAGE ...]] [-o SBOM_OUTPUT] [--deep] [--stdout] [-q]
                  [--exports-prefix EXPORTS_PREFIX [EXPORTS_PREFIX ...]] [--bom-src SRC_DIR_BOMS [SRC_DIR_BOMS ...]] [--use-blintdb]
                  [--wasm-sbom]

options:
  -h, --help            show this help message and exit
  -i SRC_DIR_IMAGE [SRC_DIR_IMAGE ...], --src SRC_DIR_IMAGE [SRC_DIR_IMAGE ...]
                        Source directories, container images or binary files. Defaults to current directory.
  -o SBOM_OUTPUT, --output-file SBOM_OUTPUT
                        SBOM output file. Defaults to sbom-binary-postbuild.cdx.json in current directory.
  --deep                Enable deep mode to collect more used symbols and modules aggressively. Slow operation. When combined with --use-blintdb, disassembly is enabled automatically to use function-hash lookup.
  --stdout              Print the SBOM to stdout instead of a file.
  -q, --quiet           Disable logging and progress bars.
  --exports-prefix EXPORTS_PREFIX [EXPORTS_PREFIX ...]
                        prefixes for the exports to be included in the SBOM.
  --bom-src SRC_DIR_BOMS [SRC_DIR_BOMS ...]
                        Directories containing pre-build and build BOMs. Use to improve the precision.
  --use-blintdb         Use blintdb v2 for symbol and disassembly-hash resolution. Defaults to true if the local database file exists.
  --wasm-sbom           Emit SBOM components from WebAssembly Component Model binaries using their imported WIT interface packages (e.g. wasi:cli@0.2.0) as exact evidence. Core modules without component-model evidence are skipped.

usage: blint db [-h] [--download] [--image-url IMAGE_URL]

options:
  -h, --help            show this help message and exit
  --download            Download the pre-compiled database to the /Volumes/Work/blintdb/ directory. Use the environment variable `BLINTDB_HOME` to override.
  --image-url IMAGE_URL
                        blintdb image url. Defaults to ghcr.io/appthreat/blintdb-vcpkg-arm64:v2. The environment variable `BLINTDB_IMAGE_URL` is an alternative way to set this value.

References

• lief examples
• checksec.py

Sponsorship

If you love blint, please consider donating to our project. In addition, blint is made possible by the incredible work of the LIEF project. Please consider sponsoring them as well.

• LIEF Project