BetterBOM
During a summer cybersecurity research internship with Dr. Doowon Kim at the University of Tennessee, Knoxville, I built a macOS tool that extracts more complete software bills of materials from compiled C and C++ binaries. It combines evidence from Syft, otool, and strings, resolves duplicate libraries, chooses the most trustworthy version data, and writes an SPDX 2.3 JSON file that vulnerability scanners can use.
View the research on GitHubdef merge(syft_libs, otool_libs, strings_libs): merged = {} def add(libs): for lib in libs: key = canonical_name(lib["name"]) source = lib["detected_by"][0] version = lib.get("version") if key not in merged: merged[key] = { "name": key, "aliases": set(), "version": None, "detected_by": [], } entry = merged[key] entry["aliases"].add(lib["name"]) if is_usable_version(version): entry["version_candidates"][source] = version
python3 betterbom.py /usr/bin/curl --output curl.spdx.json

