Hacker News Reader

Comment by throwaway984393 | Hacker News Reader

This probably won't work on binaries that contain references to system files necessary in order to run the binary that aren't code. You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open.

In the past what I've done when I have to copy a binary somewhere, is statically compile it in a Docker container and export the install files, then copy those over. I have about a half dozen tools prepped like that (gdb, curl, strace, busybox, etc)

View on HN

You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open.

You can actually pipe the output of strace into exodus and it will include the files that were accessed by the program in the bundle. For example:

    strace -f nmap --script default 127.0.0.1 2>&1 | exodus nmap

Oh. That's pretty cool

You could also use a package manager utility to list which files are needed, assuming the target binary was installed that way. (pkgs.org lists the files every package installs, or locally you could run something like `apt-files`).

Maybe check out the --detect flag from the README that claims to do just that?

Oh, wow! They've thought of everything.

That will detect files in a system package, but not files in a system package depended on by a system package depended on by a system package. It depends on how the distro packages deps and how apps use them. There are apps which use non-linked files that are only provided in extra packages. And even if you walk the whole dependency graph for a single package and export all listed files, you miss files that are created and updated during the setup steps of a package install (which are not listed in the package).

As long as the automatic way finds most things, and there is any way to manually include arbitrary things, that is actually perfectly great to me.

I don't understand what the complaint or expectation is here.

Just trying to put out there to expect undefined behavior or failures. Users might not understand how applications work and so might expect more than is possible. The strace trick is a nice workaround but I didn't see it in the readme

Reply on news.ycombinator.com