Static triage: what to do before you run anything

6 min read

Before a debugger, before Ghidra, you can learn an enormous amount from a binary without executing it — which matters when the binary might be hostile.

• file — architecture, bitness, static vs dynamic, stripped or not. This decides every later step.
• strings — hardcoded messages, format strings, error text, and astonishingly often the password itself. Always the first thing to run.
• Symbols (nm, readelf -s) — function names if it is not stripped. A function called check_license is a map of where to look.
• Imports — strcmp, memcmp, ptrace, crypto calls. What the program can do bounds what it does.

The single most common beginner win: the program compares your input to the correct answer with strcmp, and the correct answer is a plaintext string sitting right there in strings output. Compilers are not trying to hide it; you just have to look.