$ derscanner scan payments_core.exe
reading PE headers — x64, 24.8 MB
decompiling — 1 412 functions recovered
reconstructing source — done
static analysis — full SAST rule base
Scan complete — mapped to OWASP Top 10 and CWE/SANS Top 25
Trusted by security teams running binary security analysis in production
Organizations increasingly rely on third-party software, commercial off-the-shelf (COTS) applications, SDKs, and vendor-supplied binaries. Many of these components arrive without source code, so source-based application security testing has nothing to read.
DerScanner analyzes compiled software directly, helping security teams assess vendor deliverables, discover hidden risks, and produce actionable findings before software reaches production.
Vendor deliverable pipeline
Binary code analysis covers the artifact a repository never holds.
Static analysis of source code works when the repository is available. Binary analysis fills the gap by examining compiled software in the exact form that runs in production.
This enables the security team to:
Compiled deliverables enter production without the checks applied to in-house code. Binary analysis answers the questions an acceptance review asks:
Findings from vendor software are reported in the same format and on the same severity scale as findings from in-house code, so two suppliers become comparable on the same numbers.
Executable analysis returns the same finding classes as a source scan, with the same evidence attached.
Injection flaws, insecure data handling, and unsafe cryptography in the reconstructed code, mapped to OWASP Top 10 and CWE/SANS Top 25.
Embedded logins and passwords left in the compiled application.
Every finding points to a specific line of the reconstructed code, with the data flow that leads to it.
Three steps from upload to export, with binary vulnerability scanning running on the reconstructed code.
Archives (ZIP, 7Z, RAR, EAR, AAR, tar) are accepted as wrappers. Android applications also import by a Google Play link.
DerScanner builds an intermediate model of the executable code and reconstructs the source. Static analysis runs on that reconstruction with the full SAST rule base.
41void ProcessPayment(char* req) {42 char query[256];43 sprintf(query, "SELECT * FROM cards WHERE id=%s", req);44 db_exec(query);CriticalCWE-89 · SQL injection · line 43
DerTriage validates the exploitability of each finding on-premise and suppresses noise. Results are mapped to OWASP Top 10 and CWE/SANS Top 25 and export to PDF, HTML, CSV, and SARIF.
SQL injection in ProcessPayment()
What a software binary scanner has to cover before it earns a place in the pipeline.
Analyze software without repository access. The compiled file is the only input required.
Reconstructed code pinpoints each vulnerability to a specific line.
Compare the scan of repository source with the scan of the shipped binary and confirm the release matches.
Cover Android (.apk, .aab, Google Play link) and iOS (.ipa) packages without project source.
Scan your APKBinary analysis is static application security testing performed on compiled software instead of source code: the binary is decompiled, the code reconstructed, and the reconstruction scanned with the same rule base as a source scan.
DerTriage validates findings inside the perimeter; no code or result leaves the network.
Scan released artifacts automatically inside the delivery pipeline and enterprise security workflows.
Windows executables and libraries, JVM and Android bytecode, iOS and macOS packages, inside the same 43-language platform.
View the full language listDerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code. I definitely recommend DerScanner if you are serious about the security of your code and the apps you create.
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
DerScanner runs binary analysis inside the same platform as SAST, DAST, SCA, and MAST. The security team assesses in-house code, open-source dependencies, and compiled third-party software without switching tools, and the on-premise AI agents DerTriage and DerCodeFix cut the finding queue by up to 90%.
Deployment is on-premise, private cloud, or fully air-gapped, and every binary analysis finding is mapped to OWASP Top 10 and CWE/SANS Top 25, providing the evidence regulatory reviews ask for.
Cut in the finding queue from the on-premise AI agents DerTriage and DerCodeFix
Binary analysis is static application security testing performed on compiled software. DerScanner decompiles the uploaded executable, reconstructs its code, and scans the reconstruction with the same rule base used for source code. Findings are mapped to OWASP Top 10 and CWE/SANS Top 25 and displayed on the exact line of the reconstructed code, so the security team assesses software even when no repository exists.
DerScanner analyzes .exe and .dll files built from C and C++, JVM bytecode including .jar, .war, .aab and .apk packages and .class files, iOS .ipa packages, and macOS .app executables for x86 and x64 architectures. Archives such as ZIP, 7Z, RAR, EAR, AAR, and tar are accepted as wrappers for these files, and Android applications also import by a Google Play link.
The engine is shared; the input differs. Source-based SAST parses code from a repository or archive. Binary analysis adds a step in front of the scan: DerScanner decompiles the compiled artifact, reconstructs the code, then applies static analysis to the reconstruction. That makes security testing possible for vendor deliverables, legacy systems with lost source, and release builds, where source-based scanning has nothing to read.
DerScanner reconstructs code from the executable and points each finding to the exact line of that reconstruction, together with the data flow behind it. Reports export to PDF, HTML, CSV, and SARIF.
Yes. Commercial off-the-shelf applications, SDKs, and outsourced deliverables arrive compiled, and binary analysis scans them in the supported formats before deployment. Findings from vendor software are reported in the same format and on the same severity scale as findings from in-house code, which makes two suppliers comparable on the same numbers during an acceptance review.
Yes. Android applications are analyzed as .apk or .aab packages or by a Google Play link, and iOS applications as .ipa packages. The scan covers the compiled package without project source, and results are mapped to OWASP Top 10, CWE/SANS Top 25, and OWASP MASVS for mobile-specific reporting.
Yes. DerScanner deploys fully on-premise, including air-gapped environments with no outbound access. Binary scanning and DerTriage validation execute inside the organization's infrastructure, and no code or finding leaves the network. That matters for vendor deliverables under NDA and for regulated environments where compiled software must stay inside a defined perimeter.
Compiled third-party software enters production without the checks applied to in-house code, since source-based tools cannot read it. Binary analysis closes that gap: every vendor deliverable, update, and release artifact is scanned in the form that actually ships. Combined with repository scans of in-house code, this extends security testing across the software supply chain.
A file no tool has scanned still carries vulnerabilities. Binary analysis reads the compiled artifact and returns the findings.
Prefer email? company@derscanner.com