Architectures and platforms
Coverage is generated, not asserted: every number below comes from the engine's coverage report (COVERAGE.md). Cross-tool parity today: 57/57 Rizin arches, 63/63 Rizin formats, 37/37 Ghidra arches. Manifest coverage is 12,987/13,161 (98.7%) spec items dispatched across 98 targets; 5 are exercised against real binary corpora (arm64 / arm64e / x86_64 / mips32 / ebpf — ~10.6M instructions, 0–0.032 % unknown), 11 against the rizin golden-vector corpus (sparc / xtensa / avr / h8300 / msp430 / superh / v850 / z80 / tricore / m68k = 4,382 assertions plus a hand-authored nds32 db of 104 vectors), and 1 against the radare2 ESIL corpus (loongarch = 15 vectors), all at 100 % pass with zero len_fail / decode_fail / mnem_gap. The remaining targets are manifest-validated.
Executable formats (56)
The format router recognises 56 executable formats. Six are measured against a binary corpus; the rest are manifest-validated against the published structure spec. Apple containers (dyld shared cache, kernel collections, universal binaries) are handled by dedicated loaders on top of these.
Primary — measured against corpus
| Format | Spec items | Dims | Corpus |
|---|---|---|---|
| Mach-O | 632 | 51 | 9 binaries |
| ELF | 895 | 22 | 550 binaries |
| PE32+ | 249 | 16 | n/a |
| DEX | 31 | 3 | n/a |
| WASM | 22 | 3 | partial — 13.6% lift |
| SEP64 | 29 | 4 | n/a — Apple Secure Enclave |
Extended — manifest-validated
| Target | Spec items / dims | Covers |
|---|---|---|
| android_bootimg | 27 / 3 | Android boot images |
| art | 8 / 2 | Android Runtime ART / OAT |
| axml | — | Android binary XML (AndroidManifest.xml) |
| bflt | 19 / 4 | uClinux BFLT (IoT firmware) |
| coff | 16 / 3 | standalone COFF objects (56% lift) |
| dol | 13 / 2 | Nintendo GameCube / Wii |
| dyldcache | 7 / 3 | Apple dyld shared cache |
| java | 6 / 2 | Java class files |
| mbn | 15 / 2 | Qualcomm MBN bootloader |
| mz | 15 / 2 | DOS MZ |
| ne | 16 / 2 | Windows 16-bit New Executable |
| nx_homebrew | 24 / 3 | Nintendo Switch NRO / NSO |
| pef | 19 / 3 | Mac OS Classic PEF (84% lift) |
| te | 25 / 4 | UEFI Terse Executable (56% lift) |
| windows_dumps | 21 / 3 | Windows MDMP + kernel pagedump (DMP64) |
| xnu_kernelcache | 5 / 2 | MH_FILESET kernel collections |
| retro_formats | 46 / 6 | Amiga HUNK, Xbox XBE, ECOFF, Plan 9 a.out, DOS LE/LX |
| console_formats | 49 / 8 | NES, Mega Drive, Master System, SNES SPC700, PSX-EXE, N64, Game Boy |
| misc_formats | 40 / 8 | C64 PRG, Qualcomm MDT, DARPA CGC, Pebble, GBA, SNES, Nintendo DS |
| final_formats | 40 / 7 | PC BIOS / Option ROM, MenuetOS, QNX 4 LMF, Apple .symbols, VICE snapshot, Atari 2600 |
| closing_formats | 32 / 6 | Apple GNS1 baseband, Infineon C166, Nintendo 3DS FIRM, Intel OMF, OMF166 |
Lua (luac), Python (pyc), .NET CIL, JVM and EFI Byte Code are bytecode formats that double as architectures — they are lifted in the ISA layer (see Architectures). Mach-O universal / fat binaries are sliced transparently. The minidump loader is a richer container parser that supersedes the header-only windows_dumps path when both are built in.
Architectures (66)
Coverage is generated from the engine, not asserted. Opcodes = decoder breadth (ISA spec items dispatched). The capability columns are gated per-chipset by engine-lift/tests/capability_matrix.rs. Legend: ✓ verified · ○ TODO · – n/a or out-of-tier · ✗ gap.
Lifted — full IL analysis (36)
| Arch | Opcodes | Lift | ASM | Width | Syscall | Value-range | Conv | Args |
|---|---|---|---|---|---|---|---|---|
| arm64 | 1008 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| arm64e | 45 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| x86_64 | 1186 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| x86 | 756 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| arm | 310 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| powerpc | 390 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| mips32 | 281 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| mips64 | 72 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| riscv | 198 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| ebpf | 94 | ✓ | ✓ | – | – | – | ✓ | ✓ |
| sparc | 297 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| xtensa | 197 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| avr | 119 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| msp430 | 79 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| h8300 | 42 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| superh | 74 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| sh4 | 127 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| v850 | 135 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| z80 | 71 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| tricore | 250 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| hexagon | 196 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| m68k | 82 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| s390x | 490 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| nds32 | 88 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| loongarch | 267 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| lm32 | 64 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| or1k | 36 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| 8051 | 44 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| 6502 | 64 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| 8085 | 80 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| 8048 | 56 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| mc6800 | 118 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| pic | 76 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| hcs08 | 92 | ✓ | ✓ | – | – | ✓ | ✓ | ✓ |
| pa-risc | 37 | ✓ | ✓ | ○ | – | ✓ | ✓ | ✓ |
| cr16 | 76 | ✓ | ✓ | ○ | – | ✓ | ✓ | ✓ |
Bytecode / VM (9)
Decode + disassemble via a non-native seam. 9/9 also emit real IL (lift_one → Vec<IlOp>) so the standard analyses can consume them. dalvik lifts the curated DEX instruction classes to register-VM IL; const-pool names are resolved by a later DEX-container bridge.
| Arch | Opcodes | Lift | IL analysis |
|---|---|---|---|
| dalvik | 195 | ✓ | ✓ |
| jvm | 165 | ✓ | ✓ |
| wasm | 22 | ✓ | ✓ |
| cil | 66 | ✓ | ✓ |
| ebc | 56 | ✓ | ✓ |
| luac | 12 | ✓ | ✓ |
| pyc | 19 | ✓ | ✓ |
| bpf | 27 | ✓ | ✓ |
| cbpf | 28 | ✓ | ✓ |
Decode-only (21) — the coverage frontier
Recognized + disassembled (decoder breadth = Opcodes), but no IL lift yet → no taint / CWE / value-range. Promoting one means wiring a lifter.
| Arch | Opcodes | Lift | IL analysis |
|---|---|---|---|
| 68000 | 162 | ✗ | – |
| alpha | 51 | ✗ | – |
| amd29k | 32 | ✗ | – |
| chip8 | 26 | ✗ | – |
| cp1600 | 55 | ✗ | – |
| dcpu16 | 36 | ✗ | – |
| h8500 | 22 | ✗ | – |
| hcs12 | 171 | ✗ | – |
| i4004 | 45 | ✗ | – |
| lh5801 | 35 | ✗ | – |
| m16c | 81 | ✗ | – |
| m8c | 41 | ✗ | – |
| malbolge | 8 | ✗ | – |
| mcore | 25 | ✗ | – |
| mcs96 | 101 | ✗ | – |
| propeller | 64 | ✗ | – |
| rl78 | 44 | ✗ | – |
| rx | 33 | ✗ | – |
| tms320 | 36 | ✗ | – |
| xap | 16 | ✗ | – |
| xcore | 32 | ✗ | – |
Corpus validation (evidence the lifters hold on real binaries): arm64 ~4.16M instructions / 0 unknown across 8 binaries; x86_64 ~6.12M / 0–0.032% (jq 141/436,578, AVX-512 VEX tail); mips32 537 binaries / 0 unknown; plus 100%-pass rizin/ESIL golden-vector corpora for sparc/xtensa/avr/h8300/msp430/superh/v850/z80/tricore/m68k/nds32/loongarch.
Calling conventions (44)
Selected automatically from (architecture, image format):
AAPCS64-Apple, AAPCS64-Objc, AAPCS64-SysV, SwiftCC, SwiftMethod, GoRegabi, SysVAmd64, MS_X64, MsX86Stdcall, MIPS_O32, MIPS_N64, SysV_PPC32, SysV_PPC64, Darwin_PPC, AAPCS, AAPCS-VFP, BPF_Helpers, cBPF_Seccomp, RISC-V, SPARC v8, Xtensa CALL0, Hexagon QDSP6, AVR (avr-gcc), MSP430 EABI, SuperH (SH-1/2), TriCore EABI, H8/300 (GCC), V850 EABI, Z80 (SDCC), MCS-51 (8051, SDCC), MOS 6502 (cc65), 8080/8085 (SDCC), MCS-48 (8048), 6800 (Motorola), PIC18 (Microchip), HC08/HCS08 (NXP), m68k (GCC), s390x (Linux ELF), LoongArch LP64D, Nds32 (Andes ELF), LM32 (LatticeMico32), OpenRISC 1000, Hppa (PA-RISC SysV), CR16 (CR16C stdcall).
Platforms (5)
| Platform | Syscall tables | Framework / API surface | Capability mapping |
|---|---|---|---|
| Apple (macOS, iOS) | 457 BSD + 67 Mach traps | 1,209 items across 54 framework dimensions | 12-axis behavioral taxonomy, 10 capability domains |
| Linux | 7 arch tables — 2,804 entries total (x86_64 385, x86_32 423, arm64 328, ARM32 EABI 424, MIPS32 o32 445, MIPS64 374, PowerPC 425); RISC-V (rv32/rv64) resolves via the arm64 asm-generic table (shared numbering, not a separate table) | — | 29 library families, 10 capability domains, 37 syscall aspects |
| BSD family | 4 tables — 1,403 entries total (FreeBSD 496, OpenBSD 231, NetBSD 360, DragonFly 316) | — | family-specific syscalls (OpenBSD pledge / unveil, FreeBSD Capsicum cap_* and jail control) |
| Solaris / illumos | 246 entries | — | shared with the Linux capability table via aspect mapping |
| Windows | 143 NT SSDT + 21 win32k.sys + 59 versioned (Win10 1809 → Win11 24H2, 6 releases) + Win7-era legacy tables (402 NT SSDT + 819 win32k.sys) | 12 api-sets, 9 COM classes, 4 TEB/PEB structure classes, curated Win32 imports across kernel32, ws2_32, bcrypt, crypt32, ole32 | DLL-to-domain mapping → 5 domains |
Apple frameworks (1,209 / 54 dims): Foundation, GCD, objc runtime, Mach traps, BSD syscalls, ARC barriers, Swift runtime, CryptoKit, SecurityFramework, NetworkExtension, Network, CFNetwork, IOKit, EndpointSecurity, DriverKit, XPC, os_log, SystemConfiguration, SystemExtensions, ServiceManagement, ContainerizationKit, Virtualization, Photos, PhotosUI, ScreenCaptureKit, CoreLocation, CoreBluetooth, AVFoundation, Apple Intelligence, AppleIntelligenceRuntime, NaturalLanguage, Speech, Vision, CoreML, AppIntents, AlarmKit, EventKit, MetricKit, UserNotifications, ExtensionKit, CoreData, CloudKit, CoreSpotlight, Combine, AuthenticationServices, LocalAuthentication, PassKit, StoreKit, SwiftUI, WebKit, OSAKit, AccessorySetupKit, GameSave, Contacts.
Linux capability domains: Network, Process, Filesystem, Memory, IPC, Crypto, DynamicCode, Time, SystemInfo, Threading. musl-vs-glibc detected from PT_INTERP.
BSD specifics: OpenBSD pledge / unveil, FreeBSD Capsicum cap_* / jail*.
Solaris / illumos specifics: door_call, port_create, modctl, zone_*, processor_*, pset_* — bridged 1:1 to the Linux taxonomy.
Windows versioning: 59 per-version syscall numbers across Win10 1809 / 22H2 and Win11 21H2 / 22H2 / 23H2 / 24H2, plus separate Win7-era SSDT and win32k tables for Vista / 7 / Server 2008. Version selected from PE MajorOperatingSystemVersion or manifest supportedOS GUIDs.
Unpackers (91 container formats)
91 container formats recognized, 85 with a working extractor, 6 identification-only (btrfs, logfs, compress, zlib, seama, mbn). Baseline: binwalk 2.3.4 (111 / 72). (The identify authority recognizes 157 format identities in all; the rest are executables, inert media, and in-binary markers that route elsewhere.)
| Category | Identified | Extracted | Identified-only |
|---|---|---|---|
| filesystem | 15 | 13 | 2 |
| archive | 10 | 10 | 0 |
| compression | 10 | 8 | 2 |
| firmware / vendor carrier | 38 | 36 | 2 |
| kernel + disk image | 6 | 6 | 0 |
| Apple OTA / container | 9 | 9 | 0 |
| Docker/OCI · MSI · RAR | 3 | 3 | 0 |
Filesystem: cramfs, ext2, FAT, ISO 9660, JFFS2, NTFS, qcow, romfs, squashfs, UBI, UBIFS, UFS, YAFFS2 — plus btrfs, logfs (identified-only).
Archive: 7-zip, ar, ARJ, CAB, cpio, Dahua, RPM, tar, xar, zip.
Compression: bzip2, gzip, lz4, lzfse, LZMA, lzop, xz, zstd — plus compress (.Z), zlib (identified-only). Raw LZMA1 / xz streams are also extracted by name.
Firmware / vendor carrier: U-Boot, uImage, TRX, Android boot / sparse, device tree (DTB), FIT, cpio, UEFI FFS / capsule, Zyxel 2RDH / sig, CFE, CHK, packimg, RTK, TP-Link / RTOS, JBOOT arm / sch2 / stag, Arcadyan, csman, dkbs, D-Link TLV, DLKE, DMS, shrs, QNX IFS, WinCE, pchrom, Autel, DLOB, Matter OTA, SEP64, NSIS — plus Seama, mbn (identified-only).
Kernel + disk image: Linux boot images (arm32 zImage, arm64 boot, x86), MBR, EFI-GPT, DMG.
Apple OTA / container: dyld shared cache, pbzx, pbze, AppleArchive, AEA (key-gated), Img4, Trustcache, BOM, BuildManifest, APFS.
Docker / OCI · MSI · RAR: OCI / docker save images, OLE (MSI), RAR.
Apple containers (bypass magic-scan): DMG, dyld shared cache, MH_FILESET kernel collections, Mach-O universal.
Versus binwalk: 8 formats are extracted only here with no binwalk entry at all (ar, xar, LZMA1-raw, xz-raw, Zyxel 2RDH / sig, FIT, SEP64), and 15 more are extracted here where binwalk only identifies them.