When we discussed the binary analysis methodology back in Chapter 4, Creating a Binary Analysis Methodology, I mentioned there are situations where it is acceptable to alter the methodology as needed. This is one such case. We can completely avoid the discovery phase since we are analyzing this binary for vulnerabilities as opposed to identifying malicious functionality, and most of the time, your organization's developers will communicate where to find the compiled binary for analysis. We're also going to need to alter our Bash script slightly to accommodate a binary written in C, specifically for the beginning of the static analysis phase.

Since we can automate the use of some of the tools and their arguments, let's do so in an effort to save ourselves a bit of time. We'll still have to manually review the output, but that&apos...