Inspect a binary with capa, Ghidra, YARA-X and ILSpy

capa, Ghidra, YARA-X and ILSpy answer different questions about a binary, per their repositories ^[1]^[2]^[3]^[4]. Start with a file you own or are authorized to inspect.

Identify the file before choosing the tool

Use capa to identify capabilities represented by its rules ^[1]. Ghidra supplies a reverse-engineering framework for inspecting compiled code ^[2]. YARA-X matches patterns expressed as rules ^[3]. ILSpy is a decompiler for .NET assemblies ^[4].

A .NET assembly is a good reason to try ILSpy first. A native executable may require a different tool. Read the supported formats in each project's documentation before downloading it.

Use an isolated inspection environment

Warning: An unfamiliar binary may be malicious. Keep it off your ordinary work machine and do not run it merely to find out what it does.

Download the tool from the repository's release links. Follow the runtime requirements for that release, particularly Ghidra's Java requirements ^[2]. Keep the original file unchanged and inspect a copy.

Treat the findings as leads

capa documents limits for packed and obfuscated files ^[5]. A rule match identifies a pattern to investigate; an empty result cannot establish that a file is harmless.

Record the file, tool version and relevant findings. That gives the next reviewer enough information to repeat the inspection without relying on a screenshot alone.