Binary Analysis Deep Dive

1. What Kind of Binary Is This?

The first step in any binary analysis is understanding what you're looking at:

$ file ~/.local/share/claude/versions/2.1.87
Mach-O 64-bit executable arm64

  ┌─────────────────────────────────────────────────────────┐
  │               Mach-O Binary (arm64)                      │
  │  ┌──────────────────────────────────────────────────┐   │
  │  │  Bun Runtime (compiled C/Zig code)               │   │
  │  │  - JavaScript engine                              │   │
  │  │  - Node.js compatibility layer                    │   │
  │  │  - HTTP client, crypto, fs, etc.                  │   │
  │  └──────────────────────────────────────────────────┘   │
  │  ┌──────────────────────────────────────────────────┐   │
  │  │  Embedded JavaScript Bundle (minified)             │   │
  │  │                                                    │   │
  │  │  This is what strings extracts!                   │   │
  │  │                                                    │   │
  │  │  var VW8={BASE_API_URL:"https://...",          │   │
  │  │      TOKEN_URL:"https://...",                      │   │
  │  │      CLIENT_ID:"9d1c250a-..."};                    │   │
  │  │  var CH9="files-api-2025-04-14,oauth-...";     │   │
  │  │  var eK_=["user:inference",...];               │   │
  │  │  ...hundreds of thousands of lines...              │   │
  │  └──────────────────────────────────────────────────┘   │
  │  ┌──────────────────────────────────────────────────┐   │
  │  │  Other embedded resources (icons, etc.)           │   │
  │  └──────────────────────────────────────────────────┘   │
  └─────────────────────────────────────────────────────────┘

2. The strings Command — Your X-Ray Vision

For a Bun-compiled JS app, strings extracts:

• The entire minified JavaScript source (string literals, object keys, URLs, etc.)
• Error messages and log strings
• Bundled dependency code (AWS SDK, Azure SDK, etc. — lots of noise)
• Native Bun runtime strings

The scale of output

$ strings ~/.local/share/claude/versions/2.1.87 | wc -l
~2,400,000 lines

$ strings ~/.local/share/claude/versions/2.1.87 | wc -c
~180 MB of text

3. Understanding JavaScript Minification

Before we can interpret what we find, we need to understand what minification does to JavaScript code.

What a bundler/minifier does

// ── ORIGINAL SOURCE CODE (what developers wrote) ──────────────

const OAUTH_CONFIG = {
  BASE_API_URL: "https://api.anthropic.com",
  TOKEN_URL: "https://platform.claude.com/v1/oauth/token",
  CLIENT_ID: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
};

const BETA_FEATURES = "files-api-2025-04-14,oauth-2025-04-20";
const API_VERSION = "2023-06-01";

const DEFAULT_SCOPES = [
  "user:inference",
  "user:inference:claude_code",
  "user:sessions:claude_code",
  "user:mcp_servers",
  "user:file_upload"
];

// ── AFTER MINIFICATION (what ends up in the binary) ───────────

VW8={BASE_API_URL:"https://api.anthropic.com",TOKEN_URL:"https://platform.claude.com/v1/oauth/token",CLIENT_ID:"9d1c250a-e61b-44d9-88ed-5944d1962f5e"}
CH9="files-api-2025-04-14,oauth-2025-04-20"
bH9="2023-06-01"
eK_=["user:inference","user:inference:claude_code","user:sessions:claude_code","user:mcp_servers","user:file_upload"]

What gets renamed vs. what stays

4. Search Strategy — How to Find What You Need

With 2.4 million lines to search, strategy matters. Here's the general approach:

Strategy: Start with what you know, follow the thread

Filtering out noise

The binary contains massive amounts of third-party code. Key filtering patterns:

# GOOD — target Anthropic-specific strings
strings binary | grep -E "anthropic|claude" | grep -v "github\|docs\|mailto"

# GOOD — search for URLs with specific path patterns
strings binary | grep -oE "https://[^ \"']*anthropic[^ \"']*"

# GOOD — extract JSON-like object literals
strings binary | grep -oE '\{[^}]*refresh_token[^}]*\}'

# BAD — too broad, drowns in AWS/Azure SDK results
strings binary | grep "token"         # → tens of thousands of hits
strings binary | grep "refresh"       # → hundreds of Azure MSAL hits
strings binary | grep "client_id"     # → Azure, Google, Notion, GitHub hits

5. Decoding VW8 — The OAuth Config Object

This is the most information-rich discovery. Let me walk through exactly how I found it and how I knew what it meant.

The search that found it

I was looking for the eK_ variable (the scopes array) because an earlier search had shown it held OAuth scopes. I searched for its name:

$ strings /path/to/claude | grep "eK_" | head -5

One of the results contained this massive line (reformatted for readability):

eK_=[A1H,_S,
  "user:sessions:claude_code",
  "user:mcp_servers",
  "user:file_upload"],

a96=Array.from(new Set([...EW8,...eK_])),

VW8={
  BASE_API_URL:"https://api.anthropic.com",
  CONSOLE_AUTHORIZE_URL:"https://platform.claude.com/oauth/authorize",
  CLAUDE_AI_AUTHORIZE_URL:"https://claude.com/cai/oauth/authorize",
  CLAUDE_AI_ORIGIN:"https://claude.ai",
  TOKEN_URL:"https://platform.claude.com/v1/oauth/token",
  API_KEY_URL:"https://api.anthropic.com/api/oauth/claude_cli/create_api_key",
  ROLES_URL:"https://api.anthropic.com/api/oauth/claude_cli/roles",
  CONSOLE_SUCCESS_URL:"https://platform.claude.com/buy_credits?...",
  CLAUDEAI_SUCCESS_URL:"https://platform.claude.com/oauth/code/success?app=claude-code",
  MANUAL_REDIRECT_URL:"https://platform.claude.com/oauth/code/callback",
  CLIENT_ID:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",
  OAUTH_FILE_SUFFIX:"",
  MCP_PROXY_URL:"https://mcp-proxy.anthropic.com",
  MCP_PROXY_PATH:"/v1/mcp/{server_id}"
}

How I knew what VW8 was

6. Decoding CH9 — The Beta Header

This was the single most critical discovery — without this header, nothing works.

How I found it

After the first API call failed with "OAuth authentication is currently not supported", I knew there was something extra needed. I searched for beta-related strings:

$ strings /path/to/claude | grep -E "anthropic-beta|oauth-20" | sort -u

But this returned noise. The breakthrough came from a broader URL-extraction search:

$ strings /path/to/claude | grep -E "api\.anthropic\.com" \
  | grep -v "github\|docs\|mailto\|billing" | sort -u

This returned a large chunk of minified code, and within it was this fragment:

CH9="files-api-2025-04-14,oauth-2025-04-20",bH9="2023-06-01"

How I knew these were HTTP headers

7. Decoding eK_ — The OAuth Scopes

The search

To find the refresh token request format, I searched for code patterns containing refresh_token as a JSON/object key:

$ strings /path/to/claude | grep -oE '\{[^}]*refresh_token[^}]*\}' | grep -v azure -i

This clever regex (\{[^}]*refresh_token[^}]*\}) matches any {...} block containing the text refresh_token, extracting just the object literal. The -v azure filters out Azure SDK noise.

One of the results was:

{let q={grant_type:"refresh_token",refresh_token:H,client_id:m8().CLIENT_ID,scope:((_?.length)?_:eK_).join(" ")}}

How I decoded this line

Then I searched for eK_ to find its definition:

eK_=[A1H,_S,"user:sessions:claude_code","user:mcp_servers","user:file_upload"]

Three string literals are visible directly. A1H and _S are minified references. From another nearby line:

eK_,CLAUDE_AI_INFERENCE_SCOPE:()=>_S,ALL_OAUTH_SCOPES:()=>a96

The export name CLAUDE_AI_INFERENCE_SCOPE tells us _S = "user:inference:claude_code" (or similar). And by process of elimination with standard Anthropic scope naming, A1H = "user:inference".

8. Decoding the Refresh Request Shape

Beyond the request body, I also found the response shape in the same search:

{access_token:O,refresh_token:T=H,expires_in:z}

Decoding the destructuring

This is a JavaScript destructuring assignment. In readable form:

// Minified:
{access_token:O, refresh_token:T=H, expires_in:z}

// De-minified (what the developer wrote):
{
  access_token: newAccessToken,        // O = the new access token
  refresh_token: newRefreshToken = oldRefreshToken,  // T=H means: default to old if not present
  expires_in: expiresIn               // z = seconds until expiry
}

9. Connecting Code to curl — The Translation Process

Here's how each piece of minified JS maps to the final curl command:

For the usage check (API call)

For the token refresh

10. General Binary Analysis Techniques

Summary of techniques used, applicable to any Bun/Electron/Node.js compiled binary:

Technique 1: URL Extraction

# Extract all URLs mentioning a domain
strings binary | grep -oE "https://[^ \"']*yourdomain[^ \"']*" | sort -u

When to use: First step in any analysis. Gives you all API endpoints, auth URLs, CDN paths, etc.

Technique 2: Object Literal Extraction

# Extract {key:value} objects containing a specific key
strings binary | grep -oE '\{[^}]*keyword[^}]*\}'

When to use: When you know a field name (like refresh_token) and want to see the full request/response shape.

Limitation: Doesn't work for nested objects (the regex stops at the first }).

Technique 3: Identifier Frequency Analysis

# Find minified names related to a concept
strings binary | grep -oE '[A-Za-z_][A-Za-z0-9_]*Refresh[A-Za-z0-9_]*' | sort | uniq -c | sort -rn

When to use: To get an overview of how a concept (auth, refresh, token) is used across the codebase. High-frequency names are usually important.

Technique 4: Contextual Sibling Search

# Find what's defined near a known string
strings binary | grep -B2 -A2 "known_string"

When to use: When you've found one piece (e.g., the API version string) and want to find related values defined nearby (e.g., the beta header).

Caveat: strings output lines don't correspond to source code lines. Long minified JS might be one enormous string that spans one "line." Use -o (only matching) to manage output size.

Technique 5: Export/Module Boundary Analysis

# Find exported names (these retain semantic meaning)
strings binary | grep -oE '[A-Z_]{2,}:' | sort | uniq -c | sort -rn | head -20

When to use: Module export names (like CLAUDE_AI_INFERENCE_SCOPE) are preserved because they're part of the public API between modules. They give you semantic context for the minified variable names they reference.

Technique 6: Negative Filtering

# Filter OUT known noise sources
strings binary | grep "pattern" | grep -iv "azure\|aws\|google\|msal\|microsoft\|github\|notion"

When to use: Always. Bundled SDKs are the #1 source of noise. Build up a negative filter as you encounter junk libraries. The negative filters I used progressively in this project:

1. azure — Azure Identity SDK (massive)
2. aws — AWS SDK
3. google — Google auth libraries
4. msal — Microsoft Authentication Library
5. github — GitHub links in comments
6. notion — Notion MCP integration

Technique 7: UUID/Key Extraction

# Find UUID-shaped strings (potential client_ids, API keys)
strings binary | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | sort | uniq -c | sort -rn

When to use: When you need to find client IDs, tenant IDs, or other identifiers. Cross-reference with known values from other discoveries.