Binary inspector for Windows — reads PE, ELF and Mach-O
Look inside any binary with total clarity.
Binocular is a fast, dependable tool for examining Windows PE, Linux ELF, and macOS Mach-O files. Open a DLL, EXE, driver, shared object, or dylib and review its headers, imports, exports, sections, and dependencies — accurately, every time.
30-day free trial · Windows 10/11 · no account needed
Inspect
Open a binary and read its complete layout — headers, data directories, sections, imports, and exports — presented in plain, readable terms.
Learn MoreCompare
Place two files side by side and see exactly what changed between them: exports, imports, sections, and headers.
Learn MoreInvestigate
Walk the recursive dependency tree, decode .NET metadata, browse and extract resources, and inspect strings and raw bytes.
Learn More
Inspect
Headers, Imports, and Exports — Decoded
Drop in a DLL, EXE, driver, or shared object and get an immediate, navigable view of its structure. The COFF and optional headers, data directories, and section flags are parsed into plain language, and the import and export tables stay fast even with tens of thousands of entries.
- COFF and optional headers, fully decoded
- Section table with sizes, offsets, and R/W/X flags
- Searchable, virtualized import & export tables
Compare
See Exactly What Changed Between Builds
Open two builds of a binary side by side and review the differences with precision — which exports appeared or vanished, how the import table shifted, and what changed across sections and headers. Ideal for auditing an update, comparing architectures, or vetting a third-party library.
- Export and import diffs with ordinals and RVAs
- Section and header changes highlighted
- Works across PE and ELF files alike
Investigate
Follow Dependencies and Metadata All the Way Down
Trace the recursive dependency tree with circular-reference detection and missing-DLL alerts, decode .NET and CLR metadata, browse the resource tree with previews and one-click extraction, surface categorized strings, and drop into a raw hex view where every offset maps back to a parsed structure.
- Recursive dependency resolution (Windows)
- .NET / CLR assembly identity and references
- Resource tree with previews and extraction
- Semantic strings and a structure-aware hex view
Investigate
Every URL a Binary Talks To, One Click Away
Strings are the fastest way to learn what a file really does, and Binocular sorts them for you. Every ASCII and UTF-16 string is extracted and categorized into URLs, IPs, file paths, registry keys, GUIDs and versions. Open Microsoft Edge and one click on the URLs filter cuts 64,947 strings down to the 23 that matter — telemetry endpoints, crash reporters and certificate servers — each with its section, offset and RVA.
- Semantic categories: URLs, IPs, paths, registry keys, GUIDs, versions
- ASCII and UTF-16 extraction, with section, offset and RVA per string
- Filter by plain text or /regex/, tune minimum length and encoding
- Export the filtered list for reports or further tooling
Investigate
Browse and Extract the Whole Resource Tree
Every icon, cursor, bitmap, string table, version block and manifest — decoded from the PE resource directory and shown as a filterable tree with rendered previews. Reconstructs multi-size .ico icons, decodes RT_STRING tables and Delphi forms, and lets you save any single leaf, or the entire tree at once with correct file extensions.
- Rendered previews for icons, cursors, bitmaps, PNG and JPEG resources
- Decoded string tables, version info and application manifests
- One-click export of any leaf — or all resources at once
Understand
Every Symbol, Readable
Import and export tables are full of names no human should have to read raw. The viewer demangles nine compiler schemes — MSVC and Itanium C++, Rust, Swift, Objective-C, Delphi/C++Builder, Java (JNI), Fortran and Free Pascal — where most inspectors lean on Windows' own MSVC-only undecorator, if they demangle at all. Plain C names get one-line Win32 and CRT reference prototypes from a bundled offline database generated from Microsoft's own actively-maintained Win32 metadata — not a hand-typed list frozen years ago. And the Overview names the toolchain that built the file, read from the file itself.
- Nine demangling schemes — C++ and Rust verified for exact parity against the reference tools (undname, c++filt) on thousands of real-world symbols, Swift decoded by Apple's own demangler
- 17,000+ Win32/CRT prototypes, fully offline — rows marked API are reference lookups, always kept distinct from facts read from the file
- Ordinal imports resolved from the real dependency DLL, and toolchain detection from the PE Rich header or ELF .comment
Verify
Catch Tampered and Unsigned Binaries at a Glance
Binocular recomputes each file's Authenticode digest from its raw bytes with a built-in cryptographic engine — no Windows API, no network — and compares it to the digest sealed in the signature. Run it across a whole folder and sort by the Signature column: files whose signed content was modified (TAMPERED), signatures that don't verify, and certificate tables stuffed with foreign data all rise straight to the top.
- Byte-proven verdicts: intact, TAMPERED, invalid, or stuffed
- Fleet-wide — audit an entire folder in one offline pass
- Sort the bad actors to the top; nothing is ever executed
Goes deeper
Open the Binaries Hidden Inside a Binary
Most inspectors stop at the outer file. We're not aware of another tool that surfaces and opens wrapped binaries this directly.
Binaries routinely carry whole other executables inside themselves — appended to the overlay, tucked into sections or resources, or stored as .NET managed resources. Binocular finds those wrapped PE and ELF files, shows exactly where each one lives, and lets you step straight into it — the contained binary opens in its own tab with the full structure view, recursively, as deep as the nesting goes.
- Finds PEs and ELFs tucked into overlays, sections, resources, and .NET managed resources
- Step into any match — it opens in a new tab titled with the full nesting chain, e.g. installer.exe › overlay › System.dll
- Cross-format aware: a PE inside an ELF — or an ELF inside a PE — is detected and steppable
- Recursive to arbitrary depth, with one-click export of any extracted binary and real names read from the file itself
Binocular — Validated on real-world binaries.
Output is checked byte-for-byte against Microsoft dumpbin and GNU readelf.