I built a checksec-inspired binary hardening checker in Rust -- ELF/PE/Mach-O with SARIF output

Hey r/rust,

I just published bincheck v0.1.2 on crates.io -- a binary security property checker for ELF, PE, and Mach-O files.

https://github.com/kazu11max17/bincheck

It checks hardening features like RELRO, NX, PIE, Stack Canary, Fortify Source for ELF, ASLR, DEP, CFG, SafeSEH for PE, and PIE, ARC, stack protection for Mach-O. Inspired by checksec.sh, with JSON/SARIF output and designed for CI pipelines.

Why Rust was the right choice:

• goblin for binary parsing: One crate handles ELF, PE, and Mach-O. I initially considered separate crates (elf + pelite) but goblin's unified Object enum made the check_file() dispatch clean: Object::Elf(elf) => check_elf(&elf) / Object::PE(pe) => check_pe(&pe) / Object::Mach(mach) => check_macho(&mach). ~1500 lines total for the whole tool.

• Single static binary: Target users include embedded engineers on air-gapped build servers. cargo install bincheck and you have a self-contained tool. No Python, no bash, no Docker.

• comfy-table for terminal output: Colored pass/fail table that looks decent in CI logs. serde + serde_json handles the JSON and SARIF serialization.

• Flat CLI with clap derive: No subcommands -- just bincheck /usr/bin/ls. Multiple files work too: bincheck *.elf firmware.bin. Kept it simple since the tool does one thing.

The SARIF output is the main differentiator from checksec.sh. You can pipe it into gh code-scanning upload-sarif and get binary hardening issues as GitHub security alerts. Combined with --strict (exit code 1 on any failure), it slots into CI gating workflows.

Feedback on the code, architecture, or API design welcome. It's early and I want to get the foundations right.

cargo install bincheck