Inspect PE, ELF, Mach-O, fat binaries, and ar archives locally. Review headers, sections, imports, exports, mitigations, signature structures, and suspicious regions.
The inspector uses bounded, defensive parsers for Windows PE, Linux ELF, Mach-O, universal Mach-O, and Unix ar archives. It reports architecture, file type, entry point, sections, segments, dependencies, imports, exports, symbols, and archive members.
Look for writable-and-executable regions, high-entropy executable data, overlays, powerful Windows imports, executable stacks, PIE, RELRO, DEP, ASLR, Control Flow Guard, and code-signature containers. Signature presence is reported separately from cryptographic validity and operating-system trust.
Universal-binary slices and archive members can become derived Binary Lab artifacts for focused analysis in another tool. Parsing never executes the uploaded file.
The bounded parser supports PE32 and PE32+, ELF32 and ELF64 in either endianness, Mach-O 32/64, universal Mach-O, and Unix ar archives.
No. The tool distinguishes an embedded Authenticode or Mach-O signature structure from digest verification, certificate trust, revocation, and platform policy. Trust remains explicitly not checked.
Yes. ar members and universal Mach-O slices can be copied into a new derived Binary Lab artifact for focused inspection.
Keep binary artifacts, hashes, notes, findings, derived files, and analysis-tool handoffs together in a private browser workspace.
Free online disassembler: convert hex machine code to assembly. Multi-architecture (x86, x86-64, ARM, ARM64, RISC-V, MIPS, PowerPC, SPARC, 68K), Intel/AT&T syntax, 100% client-side.
Free online hex editor and binary file viewer. Upload a file to view and edit raw bytes in hex/ASCII, inspect int/float/string values with endianness, search hex or text, and export. 100% client-side.
Extract ASCII and Unicode strings from binary files for malware analysis. Detect URLs, IPs, file paths, registry keys, and email addresses.
Author, compile, and run YARA-X rules against local artifacts with exact pattern offsets, bounded scans, and evidence handoff.