> ## Documentation Index
> Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# scan

Scan binaries and firmware for vulnerabilities.

```
vulhunt-ce scan [OPTIONS] -o <OUTPUT> -d <data> -r <rules> <INPUT>
```

| Option                              | Required | Description                                       |
| :---------------------------------- | :------: | :------------------------------------------------ |
| `-o, --output <OUTPUT>`             |    Yes   | Path to write output JSON                         |
| `-d, --data <data>`                 |    Yes   | Path to the VulHunt data directory                |
| `-r, --rules <rules>`               |    Yes   | Directory or file containing VulHunt rules        |
| `<INPUT>`                           |    Yes   | Path to the binary or firmware to scan            |
| `--loader <loader>`                 |    No    | Loader to use for the input source (see below)    |
| `--component-attribute <key=value>` |    No    | Component attributes (repeatable, see below)      |
| `-m, --modules <modules>`           |    No    | Directory containing VulHunt modules              |
| `--pretty`                          |    No    | Render each issue to stdout for human consumption |
| `--stream`                          |    No    | Stream results as JSONL for machine consumption   |
| `--compress`                        |    No    | Compress output JSONL stream with Zstandard       |

`--pretty` and `--stream` are mutually exclusive. `--compress` and `--pretty` are mutually exclusive.

## Loaders

The `--loader` option selects how the input is loaded for analysis. The default is `component` for the Community Edition and `ba2` for the Enterprise Edition.

| Value       | Description                   |
| :---------- | :---------------------------- |
| `component` | Component loader              |
| `ba2`       | BA2 loader (alias: `default`) |
| `uefi`      | UEFI firmware loader          |
| `bndb`      | Binary Ninja database loader  |

## Component attributes

The `--component-attribute` option can be repeated to pass additional metadata during loading analysis. Each attribute is a `key=value` pair:

```shell theme={null}
vulhunt-ce scan \
  --loader component \
  --component-attribute kind=SmmModule \
  --component-attribute guid=FEAB1234-5678-90AB-CDEF-1234567890AB \
  ...
```

Only supported with the `component` loader.