Fast multi-platform (ELF/PE/MachO) binary checksec written in Rust.
*under active development, cargo crate releases periodically
Uses goblin to for multi-platform binary parsing support and ignore for fast recursive path iteration that respects various filters such as globs, file types and .gitignore
files and serde for Serializaiton/Deserialization.
Prior Art
Plenty of prior art exists for this type of tool. Some are standalone command line utilities and some are plugins for frameworks or debuggers, however all are platform specific.
Project | Author | Language | Active |
---|---|---|---|
checksec.sh (original) | Tobias Klein | bash | Jan 28, 2009 - Nov 17, 2011 |
checksec | Dhiru Kholia | python | Apr 18, 2013 - Mar 19, 2014 |
checksec.sh | Brian Davis | bash | Feb 14, 2014 - current |
pwntools - checksec | Gallopsled | python | Nov 8, 2014 - current |
CheckSec.c | hugsy | c | Dec 7, 2015 - Apr 24, 2018 |
checksec | klks | c++ | Mar 25, 2017 |
iOS-checksec.py | ChiChou | python | Apr 6, 2017 |
checksec-win | Lucas Leong | c++ | Aug 21, 2017 |
winchecksec | Trail Of Bits | c++ | Aug 17, 2018 - current |
pe_mitigation_check.py | David Cannings | python | Sep 20, 2018 |
note: not an exhaustive list
Build/Install
git (HEAD)
&&
cargo
Cross-compilation
For instances where you want to compile for a different target OS or architecture, see rust-cross.
Usage
||
Example
standalone checksec
| |
json output
} }}}} }
libchecksec
Just add the following to any current project with goblin dependencies to enable checksec trait on goblin::Object::{Elf, Mach, PE}
objects.
Add checksec
crate dependency to your project Cargo.toml
.
[]
= { = "0.0.3", = ["elf", "macho", "pe"] }
Now in your project source, specify dependency on the checksec
crate and import the *Properties
trait(s).
extern crate checksec;
use ElfProperties;
use MachOProperties;
use PEProperties;
You will now have access to all the implemented check functions directly from the goblin::Object
.
See examples/ for library usage examples.
Todo
libchecksec todos
- Platform specific checks
- ELF
- Fortifiable
- Rpath RW
- PE
- Authenticode verification
- MachO
- Rpath RW
- ELF
- Platform independent checks
- MachO
@rpath
contents intoshared::VecRpath
similar toDT_RPATH
/DT_RUNPATH
on ELFs- Code signature validation
- MachO
checksec todos
- Check running processes
project todos
- Tests (cargo test)
Contributing
Improvements welcome!
- For ideas, please check the Github Issues page.
- Want something added? file an issue and tag it with
improvement
- Want something added? file an issue and tag it with
- Found a problem? file an issue including the following information
- Description of the problem
- Expected behaviour
- Attach
bug
tag
- For pull requests to be reviewed;
- must be formatted with supplied project
rustfmt.toml
- must have no Clippy warnings/errors with supplied project
clippy.toml
(when one exists)
- must be formatted with supplied project