Binary version

[noxing]

I saw the binary version of the detection section when running the emba. The detection process seems to be complicated. There are actually binaries with no detected versions. How does it work? Thank you!

[m-1-k-3]

The binary version detection is handled from module S09. It iterates through the configuration file and checks every binary in bin_string_checker with strings against the current identifier (see here)

There are multiple other cases included like the check of the extractor logs here or some strict mode handling.

[noxing]

Thank you very much for your help.