--- title: "Binary Composition Analysis | FOSSA" description: "Decompose and analyze binary files, including firmware. Manage associated SBOMs, vulnerabilities, and open source license compliance." canonical_url: "https://fossa.com/products/binary-composition-analysis/" markdown_url: "https://fossa.com/products/binary-composition-analysis.md" language: "en" author: "FOSSA" organization: "FOSSA" --- # Binary Composition Analysis | FOSSA > Decompose and analyze binary files, including firmware. Manage associated SBOMs, vulnerabilities, and open source license compliance. Binary Composition Analysis ## Complete Binary Composition Analysis Decompose and analyze binary files, including firmware. Manage associated SBOMs, vulnerabilities, and open source license compliance. binary-package.exe Scanning... 0010 1010 1100 0011 1011 0010 0101 1100 1100 0111 1001 1100 0111 1001 0010 0011 1111 0101 1101 1011 0011 0110 0011 1001 0100 1011 1101 1010 0001 1001 0111 1010 1001 0011 0110 0101 0101 1100 0011 1001 0100 0111 1010 0100 0111 1010 0110 1101 ##### libxml2 2.9.12 License Clean Vulnerabilities Clean 1100 0111 1001 0010 0011 1011 0010 0101 1100 1100 0111 1001 0010 0011 1001 0100 ### How FOSSA Binary Composition Analysis Works 1 #### Decompose and Analyze Produce an inventory of detected libraries (plus their associated licenses and vulnerabilities) in binary files. 2 #### Reduce Risk Take action to prioritize and remediate vulnerabilities and ensure distributed binaries include only approved licenses. 3 #### Manage Compliance Produce SBOMs and license attribution notices that reflect the contents of binary files. camtasia.tgz Firmware v4.1 37 Security issues angle(2.1.0)Compiled Library apr(1.4.x)Native Library apr(1.7.1)Native Library libxml2(2.9.3)Embedded Library libxml2 Critical Libxml2 Out-of-bounds Access Issue ID:CVE-2016-9633 Direct memory access in firmware \+ 2 more firmware vulnerabilities ### Supported File Types Comprehensive support for a wide range of binary formats, operating systems, and architectures #### Compiled Languages C/C++, C#, Java, Go executables and libraries ##### Compiled Language Benefits Compiled languages form the backbone of system-level software, requiring thorough security and compliance analysis. FOSSA's deep inspection capabilities can uncover dependencies even in optimized or stripped binaries. Our advanced analysis tools identify library fragments and third-party components that might otherwise go undetected, providing complete visibility into your software supply chain. .exe, .dll, .obj, .o, .so, .a Java class files, .jar ELF binaries, kernel modules No extension binaries ### Why FOSSA Binary Composition Analysis #### Actionable Results and Real Risk Management FOSSA Binary Composition Analysis does more than just decompose binary files. Prioritize vulnerabilities with proprietary remediation efficiency metrics and frameworks like EPSS and CVSS. Enforce license compliance policies to avoid costly GPL violations. Produce SBOMs and VEX statements. #### Superior Supplier and Supply Chain Risk Management FOSSA Binary Composition Analysis capabilities — coupled with our marketing-leading SBOM ingestion features — form a powerful combination for manufacturers looking to understand and mitigate risk in the software they acquire. This includes the ability to verify and enhance supplier SBOMs by comparing them to binary scanning results. #### Complete Coverage You don't have to choose between a platform that only offers advanced software composition analysis (SCA) or binary composition analysis. FOSSA supports a broad range of binaries, programming languages, and ecosystems: it's open source license compliance, security, and SBOM management for all file types. #### Supports Binary Consumption and Production Teams and organizations can use FOSSA Binary Composition Analysis to decompose, analyze, and manage risk for both consumption and production use cases. This includes validating binaries for internal or application development purposes — and ensuring production-ready software meets standards for regulatory compliance, security, and software licensing. #### Flexible Deployment Options FOSSA is one of a small number of binary composition analysis tools that can be deployed on-premises. We also offer a private cloud option. (Additionally, we can work with organizations that require an air-gapped deployment. ### FOSSA Binary Composition Analysis Solutions Comprehensive solutions for vulnerability management, license compliance, and SBOM management #### Open Source Vulnerability Management Find and prioritize security risks in binary components and dependencies - ##### Precise risk detection Multiple analysis methods to decompose binary files and detect dependencies to unlimited depth - ##### Full context See details of affected dependency versions and projects to understand scale and scope - ##### Advanced vulnerability prioritization Proprietary remediation efficiency metrics complement CVSS, EPSS, and CISA KEV for effective prioritization #### Open Source License Compliance Ensure license compliance across all binary components - ##### Audit-grade inventory Get visibility into licenses across both direct and transitive dependencies - ##### Continuous compliance policy enforcement Use expert-curated policies to automatically approve, flag, or deny licenses - ##### Automated compliance artifacts Generate license notice files in multiple formats in just a few clicks #### SBOM Management Generate, verify, and distribute SBOMs that satisfy regulatory requirements - ##### Generation and distribution Produce CycloneDX or SPDX SBOMs that satisfy FDA, CRA, and PCI DSS requirements - ##### Ingestion Ingest and verify SBOMs from suppliers and internal teams to understand risk - ##### Risk management and monitoring Automatically populate VEX statements that can be shared with customers ### Schedule Binary Composition Analysis Demo See how FOSSA Binary Composition Analysis can provide complete visibility into your binary components ## Source Canonical page: https://fossa.com/products/binary-composition-analysis/