Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / MALWARE REVERSE / ANALYSIS / STATIC / BEHAVIOUR

Protections

Shows security protections of a binary


Linux (checksec)

checksec --file=./binary

# Example output:
# RELRO: Full  
# Canary: Yes  
# NX: Enabled  
# PIE: Enabled

Windows (sigcheck)

sigcheck.exe file.exe

# -------------------------  
# CHECK DIGITAL SIGNATURE  
# -------------------------  
sigcheck.exe -i file.exe  
  
# -------------------------  
# VERIFY SIGNATURE + CHAIN  
# -------------------------  
sigcheck.exe -v file.exe  
  
# -------------------------  
# VIRUSTOTAL CHECK  
# -------------------------  
sigcheck.exe -vt file.exe  
  
# Accept VT terms automatically  
sigcheck.exe -accepteula -vt file.exe  
  
# -------------------------  
# SHOW HASHES  
# -------------------------  
sigcheck.exe -h file.exe  
  
# -------------------------  
# RECURSIVE DIRECTORY SCAN  
# -------------------------  
sigcheck.exe -s C:\folder  
  
# Include subdirectories + show hashes  
sigcheck.exe -s -h C:\folder  
  
# -------------------------  
# SHOW ONLY UNSIGNED FILES  
# -------------------------  
sigcheck.exe -u C:\folder  
  
# -------------------------  
# SHOW FILE VERSION INFO  
# -------------------------  
sigcheck.exe -n file.exe  
  
# -------------------------  
# CSV OUTPUT  
# -------------------------  
sigcheck.exe -c file.exe  
  
# -------------------------  
# COMBINED
# -------------------------  
sigcheck.exe -accepteula -h -vt -s C:\Windows\System32