Reverse Engineer

Identify a file or directory: format, architecture, size, SHA-256, markers (Go, Rust, Electron, N-API, packers) and the next tool to call.

Electron app map: extracts app.asar (cached), main entry, preloads and exposed APIs, native .node addons and the addon names called from JS, IPC channels grouped by call site, fuses, asar integrity. Use focus (one or more words) to filter on one feature.

Search a directory, an extracted app, a .asar (auto-extracted) or one file. Hidden folders included, node_modules skipped by default. Returns file:line:col (or file@offset for binaries) with a short excerpt.

Read a slice: lines start..end; for minified code a column window (start=line, col, length); for binaries a hexdump at offset. A directory path lists its entries.

PE, ELF or Mach-O inventory. part=summary (default): format, sections, libraries with imports, exports, Node addon names, notable strings. Other parts list one table, paged with skip and filtered by a regex.

Go build info (toolchain, main package, module, build settings, dependency versions) and Rust cargo-auditable dependencies, parsed from the binary without running it.

Ghidra headless decompilation, cached per file. First call analyzes the binary (can take minutes). function=NAME|ADDRESS returns its C; containing=TEXT lists functions that reference a string; neither lists functions.

.NET assemblies (via ilspycmd) and APK/DEX/JAR (via jadx): decompile once into the cache, summarize namespaces, manifest, P/Invoke and native libraries; type=Name returns one type's source.