RuntimeXRay
Don't tell me my application is insecure — show me why.
See what an attacker can learn from your application at runtime.
RuntimeXRay is an evidence-driven security analysis tool for compiled applications.
It combines static binary analysis with runtime observation to produce security findings backed by observable evidence.
🤖 “The AI wrote it. But what did it actually build?”
AI can produce working code in seconds, but do you know what the resulting binary actually exposes at runtime?
📦 “You didn’t write that library. Do you really know what it does?”
Modern apps depend on third-party and legacy components that are difficult to fully audit.
🧩 “Who still understands this entire application?”
Large applications accumulate years of code, dependencies, and configuration paths. Security decisions increasingly rely on assumptions.
⚡ “Can security review keep up with the release cycle?”
Software changes faster than security teams can manually inspect every change. Runtime evidence shows what actually happened.
What RuntimeXRay can show today
RuntimeXRay can currently correlate this observed exact-fingerprint flow:
file → read → independently scanned memory → send → socket
The correlated finding connects the source file, read event, scanner-derived
memory address, output event, and socket destination using the same
sensitive-object fingerprint.
Secret values remain redacted by default. RuntimeXRay reports observed
evidence; it does not claim malicious intent, exfiltration, or that a
destination is unexpected without additional evidence.
✅ Available today:
Unified CLI
runtimexray analyze – ELF hardening checks and dangerous API detection
runtimexray trace – dynamic syscall tracing (ptrace or ebpf)
runtimexray mem – process memory scanning for secrets
Common options (all subcommands)
--report FILE – human‑readable report (default: stdout)
--json FILE – JSON report
--log-level LEVEL – error, warn, info, debug, trace
--log-file FILE – write logs to file (default: stderr)
--min-severity LEVEL – Critical, High, Medium, Low, Info
--show-secrets – explicitly disclose detected secret values (redacted by default)
(Removed: --verbose, --output-format, --quiet — replaced by the above)
Dynamic tracing features
• Fork/thread following (--follow-forks / --no-follow-forks)
• Timeout support (--timeout <sec>)
• eBPF backend (--backend ebpf) – low‑overhead, requires root
• Sensitive file, network, and buffer detection
• Live process-memory evidence with --scan-memory
• Exact-fingerprint correlation across read, independently scanned process memory, and send/socket observations
Memory scanning
• /proc/<pid>/cmdline and /proc/<pid>/environ
• Password‑like strings and private key markers
• --max-pages to limit scan
Extensibility
• AnalyzerRegistry – add custom analyzers without touching core code
• Built‑in analyzers: hardening, dangerous APIs, sensitive files, network, memory secrets
Tests
• 47+ CTest tests, runs on x86_64 and ARM64 (GitHub Actions)
🧪 Experimental
• Process/event lineage and the first exact sensitive-object correlation path are implemented; transformed values, lifetime tracking, and broader correlation remain experimental
• eBPF process‑attach (planned)
📋 Planned
• Broader value-level lineage across copies, transformations, lifetime, and additional sinks
• Network‑boundary detection
• AI explanations (evidence‑first)
• PE / Mach‑O support
• Local and air-gapped packaging and CI workflows
• HTML reports
• Dynamic plugin loading (.so)
