Function binary_embeds_ssl 

pub fn binary_embeds_ssl(path: &str) -> bool

Heuristic: does this ELF statically embed its own SSL implementation?

Node.js bundles OpenSSL directly into the node binary, so there is no system libssl.so for sslsniff to hook — it must attach to the binary itself. We detect this by scanning for static OpenSSL/BoringSSL marker strings in the file. Grok’s native binary is also selected by its CLI marker; sslsniff performs the stricter rustls signature check. Dynamically- linked runtimes like CPython call into a separate libssl.so (via _ssl.so) and do NOT contain these markers in the executable, so they keep using sslsniff’s system-libssl attachment with comm filtering intact.