Binary Composition Analysis: How to Identify Open Source in Code You Cannot Read

How Binary Analysis Works

Binary SCA tools use several techniques to identify open source components in compiled artifacts. String analysis extracts literal strings embedded in binaries — function names, error messages, version strings, and copyright notices that often remain readable in compiled code. Code similarity uses hash-based matching (comparing known open source function implementations against extracted binary functions) to identify libraries even when string evidence is minimal. Build artifact signatures match against known build artifact patterns for common open source libraries. License and copyright text extraction finds license notices embedded in the binary that human reviewers might miss.

Coverage and Limitations

Binary analysis achieves lower accuracy than source-based SCA — false positive rates are higher, and completeness is lower. The difficulty varies by language and compilation approach. C and C++ binaries compiled with optimization flags lose significant source-level context. Java class files retain more structural information and yield better binary analysis results. WebAssembly and other newer compilation targets are emerging areas where binary analysis techniques are still maturing.

Use Cases Where Binary Analysis Is Essential

For M&A due diligence, binary analysis enables SBOM generation for acquisition targets without requiring access to their source repositories — often a practical necessity in competitive transactions. For firmware security assessment, binary analysis is the only practical way to enumerate components in device firmware images that ship without build systems. For third-party application risk management, binary analysis generates approximate SBOMs for commercial software where vendors will not provide SBOMs voluntarily.

Integrating Binary Analysis with Your SBOM Program

Binary analysis should be viewed as complementary to source-based SCA, not a replacement. The most comprehensive programs combine source-based SCA (highest accuracy, used during development) with binary analysis (used for artifacts without source access, for verification, and for third-party risk management). An SBOM generated by combining both approaches provides the most complete component picture.