Binary inspection is the examination of a compiled program file, such as an EXE, ELF, or DLL, without needing the original source code. Analysts look for clues like strings, imports, symbols, embedded resources, control-flow patterns, and suspicious sections to understand what the program may do.
In cyber security, binary inspection is a core part of static analysis. Defenders use it to triage malware, identify packers or obfuscation, spot hard-coded commands or credentials, and assess whether a binary matches expected behavior. Attackers also rely on it when reverse engineering software to find vulnerabilities or extract implementation details. Because compiled code can hide intent, binary inspection is often combined with runtime observation and disassembly to confirm findings. It is useful for evidence gathering, but it rarely tells the whole story by itself.