Tool
Binlex
Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. It models code with a genomics-inspired hierarchy and computes features such as MinHash, TLSH, SHA256, entropy and wildcard byte patterns, so samples can be compared, clustered and turned into signatures at scale. It ships a CLI suite, a Rust API, Python bindings and an IDA plugin, can generate YARA rules from its patterns, and runs processors locally or over IPC and HTTP.
Requirements & limits
- The reviewed master commit declares a Rust 2024-edition workspace at version 2.0.0. The latest stable GitHub release is v1.1.1 (2023-03-04); the v2.0.0 line is still at release candidates, the most recent being v2.0.0-rc2 (2025-01-14), whose prebuilt zips cover Linux (Debian and Arch), macOS (amd64 and aarch64) and Windows, plus an IDA plugin archive and a server archive. The reviewed master is ahead of those tags.
- The README lists Linux, macOS and Windows; input formats PE, ELF and Mach-O; and AMD64, I386 and CIL architectures, with disassembly through Capstone 0.12. Build and install with cargo build --release --workspace, build the Python bindings with maturin, package with make zst/deb/wheel, install the IDA plugin with pip and python -m binlex_ida install, and the repository also provides Docker Compose files for its server, web, MCP and Python images.
- Supply the binaries to analyze yourself; the repository commits no sample binaries, and its tests are Rust source. Binlex extracts static traits and hashes and generates patterns and YARA rules; it does not run the target, and derived signatures and similarity scores still need analyst validation.
- MIT license; contributions require signing the repository's CLA. No binaries were analyzed for this entry.
About this entry
- Type
- Tool
- Category
- Binary analysis libraries
- Relationship
- Foundation tool
- Targets
- Binary
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · c3rb3ru5d3d53c/binlex · Revision f02f270
- Cargo.toml GitHub · c3rb3ru5d3d53c/binlex · Revision f02f270
- LICENSE GitHub · c3rb3ru5d3d53c/binlex · Revision f02f270
- https://github.com/c3rb3ru5d3d53c/binlex/releases/tag/v2.0.0-rc2
- https://github.com/c3rb3ru5d3d53c/binlex/releases/tag/v1.1.1
More in Native binaries
- Driver Buddy Reloaded · Tool
- FA (Firmware Analysis) · Tool
- pyinstxtractor-ng (PyInstaller Extractor Next Generation) · Tool
- CoBRA (Coefficient-Based Reconstruction of Arithmetic) · Tool
- DownUnderCTF: masked-squares flag checker · Case study
- Show Your Work: a measured dissection of REA's evidence architecture · Case study