AwesomeREA.org

Tool

Binary Refinery

Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. Each unit reads stdin and writes stdout, so units chain into shell pipelines, while framing, multibin arguments and meta variables let one pipeline process many chunks, and the binref command searches unit help. The author describes it as a command-line take on CyberChef focused on malware triage; the README also points to a separate binref/agent repository of instructions for language-model agents that use refinery.

Requirements & limits

  • Latest release at review: 0.11.2, uploaded to PyPI on 2026-07-14 and requiring Python 3.10+. The reviewed master commit of 2026-10-11 is 1,138 commits past that tag and still reports version 0.11.2, while its changelog already lists breaking 0.11.3 changes, including Python 3.11+ and renamed meta variables. The README says refinery is still in alpha and that units and parameters can be renamed or removed.
  • Installed with pip as binary-refinery, preferably into its own virtual environment. The default, extended and all extras add progressively more optional dependencies, and units name a missing dependency when run. Installation creates one shell command per unit, optionally with a prefix to avoid name clashes. The README rates Bash and CMD support as good, PowerShell 7.4+ as reasonable, and Zsh and Fish as having minor issues. Several decompression and cipher routines have Cython extensions next to pure-Python versions.
  • Inputs are the analyst's own files or data piped on stdin. CI runs pytest on Windows, macOS and Ubuntu with Python 3.11 and 3.13. Tests that need real-world inputs fetch encrypted files from the separate binref/refinery-test-data repository, which this review did not open. Unit output depends on the parameters chosen and needs analyst validation; nothing was installed or run for this review.
  • LICENSE.md is the 3-Clause BSD License, which GitHub does not classify. refinery/lib/thirdparty keeps third-party modules under their own licenses, and refinery/lib/seven ports compression code from 7-Zip. The reviewed sources establish no REA use.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · binref/refinery · Revision 13d8c68
  2. README.md#L124-L126 GitHub · binref/refinery · Revision 13d8c68
  3. CHANGELOG.md GitHub · binref/refinery · Revision 13d8c68
  4. setup.py GitHub · binref/refinery · Revision 13d8c68
  5. pyproject.toml GitHub · binref/refinery · Revision 13d8c68
  6. refinery/__init__.py GitHub · binref/refinery · Revision 13d8c68
  7. .github/workflows/test.yml GitHub · binref/refinery · Revision 13d8c68
  8. samples/__init__.py GitHub · binref/refinery · Revision 13d8c68
  9. refinery/lib/thirdparty/__init__.py GitHub · binref/refinery · Revision 13d8c68
  10. refinery/lib/seven/__init__.py GitHub · binref/refinery · Revision 13d8c68
  11. LICENSE.md GitHub · binref/refinery · Revision 13d8c68
  12. https://pypi.org/project/binary-refinery/0.11.2/
  13. README.md GitHub · binref/agent · Revision be019a5

More in Native binaries

All 114 entries in Native binaries