Strata: Binary-to-SBOM

For a long stretch of my career, reading other people's machine code was just the job. On the 6502, then the Z80, then the 68000, you learned to read a routine the way you'd read a paragraph. The shape of it, the constants it leaned on, the little idioms a given compiler always reached for. I once worked out which library a shipped console build was using from its string table alone, which felt like a party trick at the time. That skill went quiet for twenty years. It's back, and the stakes this time are supply-chain security rather than a stubborn loading screen.

Most software bills of materials are built from what a project declares: its lockfiles, its manifests, the dependency tree the build already knows about. That's fine right up to the point where you don't have the source. A vendored firmware image, a third-party binary you're being asked to ship, a container layer with no provenance. In every one of those, the declaration is exactly the thing you're missing.

Strata works the other way round. It reads the artefact itself, whether that's a stripped ELF, a Windows PE or a Mach-O binary, and reconstructs the open-source libraries compiled into it, their versions, and which of them carry known vulnerabilities. No source, no build access, no cooperation from whoever produced it.

The hard part

Stripping throws away the symbol table, so the obvious signals are gone. What survives compilation is subtler: the control-flow shape of a function, the constant tables a codec ships with, the exact byte sequences a hash implementation is built around. The compiler is an adversary here, however well-meaning. The same function at -O0 and -O3, under gcc and under clang, looks like four different functions, and inlining and dead-code elimination mean half the library might not even be there.

So the approach is fingerprinting against a corpus of the same libraries built across compilers, optimisation levels and versions. Each function gets reduced to the signals that survive optimisation: the shape of its control-flow graph, a hash over its normalised instructions, the constant tables it carries. A learned embedding sits on top of the heuristics, trained on that corpus, so a function emitted by clang can still match one the corpus only ever saw under gcc.

# The core loop is a matcher, not a scanner: fingerprint the artefact,
# then ask which known library versions could have produced these traces.
matches = index.query(fingerprint(artifact))
for lib, version, confidence in rank(matches):
    if confidence > THRESHOLD:
        sbom.add(component=lib, version=version, evidence=matches[lib])

None of this is new ground on its own. BinDiff, Asm2Vec and the commercial binary-analysis tools have all walked parts of it. What was still missing is an open, CI-friendly tool that reports an honest confidence score instead of a marketing one, and shows its working. Every component in a Strata SBOM carries the traces that identified it, the version evidence behind it, and a confidence figure, because a bill of materials you can't interrogate is just another claim. The output's standard: CycloneDX 1.6 and SPDX 2.3, with a thin cross-reference to known CVEs.

The test that actually mattered wasn't whether it could re-recognise its own training set. Anything can do that. It was whether it could name a library in a binary built by a compiler it had never seen produce that library, and that was the case worth pushing on until it did. Built from a gcc corpus and run against stripped clang binaries across 54 libraries, the heuristics alone reach 100% precision at 77.6% recall. With the learned embedding on top, that rises to 98.7% precision at 90.2% recall, and 48 of the 54 libraries come back at full precision and recall. The corpus, the benchmark harness and the numbers are all in the open repository, so you can reproduce them or argue with them.

IF YOU CAN'T SAY WHAT'S IN THE BINARY, YOU CAN'T SAY IT'S SECURE.

Strata's built, benchmarked and open. The ongoing work is coverage, meaning more libraries in the corpus and more packaging formats, and keeping the confidence calibration honest as the corpus grows, so a low-certainty match keeps reading as low-certainty rather than as a false negative. Its findings feed the same supply-chain surface OSPulse already watches.