How our platform finds vulnerabilities in a compiled binary

The method

A version number is a claim, the instruction stream is the evidence

The engine first disassembles the target binary and converts its executable instructions into a structured intermediate representation. That lets us analyse program behaviour rather than version strings or file fingerprints.

Building on that representation, the engine simulates key execution paths to extract stable behavioural and structural features. Those features are compared against reference signatures in our vulnerability database, which holds both vulnerable and remediated patterns. The platform can then say whether the binary in front of it more closely matches an unpatched state, a fixed state, or a state that was never vulnerable.

This matters most where version metadata is incomplete, altered or unreliable: vendor firmware, statically linked libraries, backported patches. By reading what the binary contains and how it behaves, precision improves and both false positives and false negatives fall.