See inside any binary.
A free online disassembler and binary analysis tool. Drop an executable and get headers, functions, xrefs, strings, YARA matches and disassembly in seconds. Nothing is uploaded.
- Private by designParsing, hashing, YARA and disassembly all run in this tab, even offline.
- Functions and xrefsEvery call, jump and string reference, with your own names and comments.
- Packers and signaturesDetects UPX, Themida and friends, and checks Authenticode digests.
- Real YARAlibyara in WebAssembly, with the pe, elf and math modules.
- Compare two buildsSee which imports, sections and strings changed between versions.
- Share without uploadingThe report lives inside the link itself. No server ever sees it.
Reverse engineering in the browser
binkeep is a web-based reverse engineering tool for the first look at an unknown binary. It parses Windows PE files (.exe, .dll, .sys), Linux ELF files (.so and executables) and macOS Mach-O files (including universal binaries) directly in the page, with no install and no upload.
It finds functions with a full linear sweep, builds cross-references for calls, jumps, imports and strings, and disassembles x86, x64, ARM and ARM64 code with Capstone compiled to WebAssembly. Real libyara runs your YARA rules locally. It also detects packers such as UPX, Themida and VMProtect, and recomputes Authenticode digests to show whether a signed file was modified.
It is free and open source, works offline once loaded, and is built for malware triage, CTF challenges and quick checks before you reach for Ghidra or IDA.
Entropy
Values near 8 bits per byte mean compressed or encrypted data. Click anywhere to open that offset in the hex view.
Click a line, then N rename function, ; comment, X cross-references.
Rules
libyara in WebAssembly, runs locallyMatches
Run your rules to see matches here. Rules are kept in this browser and run automatically on every file you open.