knife is a reverse engineering toolkit designed to bring several stages of binary investigation into a single program. It works directly on executable files and other binary data without running the target, making it suitable for malware inspection, vulnerability research, forensic work and general analysis of compiled software.
The program combines a command-line interface with an interactive terminal workspace. The latter provides a more exploratory workflow, letting analysts move between recovered functions, listings, cross-references and other views while retaining their own annotations. The underlying analysis engine is shared between the interfaces, so information recorded during an investigation remains available when switching between commands and the interactive environment.
This is free and open source software.
Key Features
- Parses PE, ELF and Mach-O executable formats.
- Disassembles x86, x86-64 and AArch64 machine code.
- Recovers functions using symbols, control flow, exception metadata and unwind information.
- Provides pseudocode generated from a lifted intermediate representation.
- Builds function-level control-flow graphs and whole-program call graphs.
- Identifies dangerous API call sites and groups them by potential vulnerability class.
- Audits argument provenance at selected sinks to highlight suspicious data-flow patterns.
- Examines exploit mitigations and reports weakened or missing protections.
- Finds imports, exports, strings, indicators of compromise, hashes and embedded artifacts.
- Scans binaries for cryptographic constants, packer markers and embedded file formats.
- Stores names, notes, bookmarks, types, prototypes and variable aliases in a persistent analysis database.
- Supports staged binary patches without modifying the original input file.
- Compares binaries by functions, imports and sections.
- Provides JSON output for machine-readable analysis results.
- Exposes analysis and annotation facilities through a Model Context Protocol server.
Website: github.com/bl4ckr0ss3/knife
Support:
Developer: 0xblack
License: MIT License
knife is written in Rust. Learn Rust with our recommended free books and free tutorials.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.