Any binary,
read.
Pseudocode, names and behaviour, in seconds per file. The program never runs on a host.
Source is a claim.
The binary is what ships.
Machine code, names stripped, types gone, one of dozens of instruction sets. Reading it took a desktop suite, a specialist and days per file. Most binaries are never read.
openbinary reads it by itself, in seconds. Each instruction set is translated into one common form first. Out come named functions, pseudocode and what it does on the system and the network.
The decompiler. Side by side with Ghidra.
Same five encode calls, same order. openbinary keeps the method's real name and reads fields by name; the struct above the body still says field_8, a bug on our side.
Ghidra keeps the helper names, objc_msgSend among them, and the text keys, where openbinary shows addresses.
One binary, read eight ways.
usr/libexec/syspolicyd, #094e625d, the macOS 26 daemon that decides whether software may run. Every figure below is what the engine wrote down, unedited.
Identity. File hashes, and the structural hashes that survive a rebuild.
Each moves only when its part of the program moves, so a rebuild with the same code and new metadata still matches on Code and Symbols.
Structure. Segments, sections, entropy, load commands. The map a packer cannot hide in.
36 MORE SECTIONS · 76 LOAD COMMANDS: LC_SEGMENT_64 ×5, LC_LOAD_DYLIB ×59, LC_CODE_SIGNATURE, LC_MAIN …
Strings. Sectioned by what they are, with the function that uses each.
/dev/null · /tmp/file.XXXXXX · /usr/share/file/magic
https://api.apple-cloudkit.com/database/1/%@/%@/public/records/lookup
Code. Names on stripped functions, the call graph, the nearest binaries.
Behaviour. What it does, by category, with every call site.
Read from the IL, not the import table, so a row opens the function that does it, at the call site.
What is fetched from outside about the hash is labelled enrichment, never a fact about the binary.
sub_10003df8d +0x4b · sub_10003e0ba +0x108 · sub_10003e46b +0x1e1 · sub_10003edfc +0x48d
Attack surface. Every way in, who can send to it, and the findings behind it.
Components. The libraries it links and the code compiled in, with versions.
Posture. Hardening flags, signing, entitlements, provenance.
The emulator. The program's own code, run over the IL, never on a host.
Runs the same on every instruction set the engine lifts. Hard limits on steps, memory, call depth and wall clock. No file, socket, process or system call ever happens.
memcpy, allocators, loaders, RC4 and base64 are modelled, not invoked, so the run continues. A value it cannot prove stays unknown.
Fuzzing · paid add-on · measured 2026-10-14: 65K runs a second on one lane, 132K on eight
Instruction sets. 48 decompiled, against the three desktop tools.
Name matches against Ghidra's 37 processor directories and the IDA and Binary Ninja decompiler lists, read 2026-09-18 · ∼ no matching spec found
Chips. Chip, load address and RTOS from a bare image, no file system to lean on.
On 195 vendor images the chip is known on 92%, a load address on 88%.
62 bare-metal images, curated 2026-10-15
Decompile.
25x faster than Ghidra.
locationd, all 25,406 functions: 12.0 seconds against 302.73, same file, same Mac, fastest of three runs each. Functions found agree within 2%.
The engine, asked plainly.
- 01
Is this a Ghidra or IDA replacement?
Not at the desk; they are interactive tools for one file. In a pipeline, yes: it reads every binary by itself and serves the result over an API.
- 02
Can I take the result back into Ghidra or IDA?
Not as a plugin yet. Names, pseudocode, call graph and strings come out as JSON and text, findings as SARIF, components as CycloneDX and SPDX.
- 03
How does a file get in?
Drop a file, call the API or let an agent upload it. Up to 1,000 hashes verified in one call.
- 04
Where does it run, and who sees my binaries?
Cloud, on-prem or air-gapped. Public uploads are free and visible to everyone, private uploads need Pro and stay inside your workspace.
- 05
What about packed or obfuscated binaries?
UPX is the one packer it unpacks outright. For the rest, the entry stub and decryptor loops run in the bounded emulator; what they produce is kept with the call site.
- 06
Can I run it from a script?
Yes. The CLI runs the analysis; the API and 72 MCP tools serve the same stored facts to a script or an agent.
Drop a binary.
Mach-O, ELF, PE, DEX, WASM, firmware, container and archive images. Up to 2 GB. The report is public unless you sign in.