bREDcrumb

Leave your mark in every binary

Get Started Try Demo

Inject unique tracking strings into your tools and implants. At the end of an engagement, these breadcrumbs help blue team distinguish your binaries from real threats — and ensure nothing gets left behind.

Features

💾

Binary Patching

Inject tracking strings into PE, ELF, and Mach-O binaries using multiple strategies: cave, section, extend, or overlay.

🔍

YARA Rules

Auto-generate YARA detection rules for your breadcrumbs. Share with blue team for post-engagement cleanup.

📊

Tracking Database

Keep track of all breadcrumbs, tags, and patched binaries. Know exactly what you deployed and where.

🌐

WebAssembly

Use directly in the browser with full WASM support - no server or installation required.

💻

Code Snippets

Generate embeddable code for C, C++, Rust, Go, C#, Java with dead code elimination prevention.

Supported Formats & Strategies

Format Cave Section Extend Overlay
ELF (Linux) ✓ ✓ ✓ ✓
PE (Windows) ✓ ✓ ✓ ✓
Mach-O (macOS) ✓ ✓ ✓ ✓

How each strategy works

Cave

Searches for code caves — null bytes in section padding. String is written into unused space. Binary size unchanged, no headers modified. Most stealthy but space is limited.

Section

Creates a new section in the binary's section table (e.g., .bcrumb). Updates section count and size fields. Reliable for any string size but modifies structure.

Extend

Extends the last section by increasing its size and appending data. Less intrusive than new section. Data is mapped into memory at runtime.

Overlay

Appends data past the file's end. No headers modified, loader ignores this region. Simplest approach but data not mapped into process memory.

Installation

From Source (Cargo)

git clone https://github.com/nikaiw/bREDcrumb
cd bREDcrumb
cargo build --release
./target/release/bredcrumb --help

Usage Examples

Generate a Tracking String

$ bredcrumb generate -l 16 -t "operation-alpha"
RT8AfENUlAMN3hPk

$ bredcrumb generate --custom "MY_CUSTOM_MARKER" -t "op-beta"
MY_CUSTOM_MARKER

Patch a Binary

$ bredcrumb patch ./implant.exe "RT8AfENUlAMN3hPk" -s cave
Successfully patched binary!
  Format: PE64
  Strategy: cave (.rdata)
  Virtual Address: 0x140008AB0
  File Offset: 0x6EB0
  Output: ./implant_patched.exe

$ bredcrumb patch ./beacon -s overlay -o ./beacon_tracked
Successfully patched binary!
  Format: ELF64
  Strategy: overlay
  File Offset: 0x22BE8

Generate YARA Rule

$ bredcrumb yara "RT8AfENUlAMN3hPk" --ascii --wide
rule tracking_string_RT8AfENU {
    meta:
        description = "Detects tracking string: RT8AfENUlAMN3hPk"
        author = "bredcrumb"

    strings:
        $tracking_string = "RT8AfENUlAMN3hPk" ascii wide
        $tracking_hex = { 52 54 38 41 66 45 4E 55 ... }

    condition:
        any of them
}

List Tracked Strings

$ bredcrumb list
ID                                    Value             Created               Tags
------------------------------------------------------------------------------------------
24ba2d8f-121b-488a-b6d9-84267c61ba42  RT8AfENUlAMN3hPk  2026-02-03 08:58      operation-alpha
ac288ebe-a192-4481-a03b-147a2e1f59ce  MY_CUSTOM_MARKER  2026-02-03 10:48      op-beta

Interactive Demo

Try bREDcrumb directly in your browser using WebAssembly

String Generator

Binary Patcher

YARA Generator

When you control the source code, embed the tracking string directly. The generated code includes DCE prevention techniques to ensure the string survives compiler optimization.

Code Generator

Loading WebAssembly module...