Download Binocular · v1.2.0

New

• Build tab for PE and ELF files. It shows the source commit (from version strings such as 7.0.0+d099f07…), PDB paths, the build root, the compiler and linker, the Go version and build settings from Go build info, the Rust version, and the Rust crates and Go modules the file was built with, with versions. Every row says how it is known (recorded by the file, or suggested by its strings) and links to the bytes in Hex or Strings.
• CI layouts are recognised from build paths: Azure Pipelines, GitHub Actions, GitLab Runner, Jenkins, TeamCity, CircleCI and Mozilla Taskcluster. They are shown as consistent with the path, not as proof, because CI folders can be configured.
• Leak check. The Build tab lists account names in build paths, internal hosts and network shares, and complete token shapes (Stripe live keys, GitHub, Slack and npm tokens, PEM private keys, and AWS key IDs, which are flagged more strongly when their secret key sits beside them). Values are masked on screen and in exports unless you choose Reveal, and nothing is checked online. Each finding comes with a fix that says what it covers and what it doesn't.
• A one-line Build summary on the Overview, with a link to the tab.
• Compare > Build shows what changed between two builds: toolchain and dependency versions, and leaks added or removed.
• Folder view: an Audit menu groups Verify Signatures, Audit Hardening and the new Build Info pass, which adds a Build column. Sorting it lists files with findings first, then the files that record the most about their build.
• Settings: list your own internal domains, and hosts and shares under them are listed in the Build tab. Build can also be chosen as the default tab.
• Tools > Export report includes a Build section in JSON and Markdown.

Improved

• Very large files (opened from disk rather than memory) now show their version resource, PDB path and ELF section headers, which used to come back empty. Anything that can't be read is named, never shown as missing.
• Compare now says why the Strings or Build tab is missing when one file was opened from disk.
• Stop in the folder view ends a pass at once, and closing a tab stops its background work.

New

• Watch words in Compare > Strings. Enter words such as password, api. or debug, and any string containing one is listed first in its own Watch words group, in both Notable and All modes. Matching is plain text and not case-sensitive. A warning appears before you apply if a word will be ignored or is short enough to match many strings.
• Custom notable strings. The gear next to the Notable / All toggle lets you choose which string categories count as notable, for example adding format strings. The label reads Notable strings (custom) while your choice differs from the defaults, and Reset to defaults restores them. Your choices apply to every comparison.

Improved

• Recent records files in the view you opened them in (Structure, Hex or Strings, each with its own icon) as well as PE Compare pairs, and clicking a row reopens it the same way.
• Folder rows in Recent list the scans you ran on that folder (Deep Scan, Hunt for Embedded, Verify Signatures, Audit Hardening), and the right-click menu can reopen the folder straight into one of them. Only the fact that a scan ran is kept, not its results, because files change between visits.
• Deep Scan reports its result in the folder header, including when it found nothing new and how many files it checked. Previously a scan that found nothing looked as if it had not run.

Fixed

• Long forwarded exports, such as those in ole32.dll, no longer spill into the rows below in the Exports table. The forwarder is shortened with an ellipsis and the full name shows on hover.
• The folder list no longer goes blank after switching to another tab and back.
• Python (.pyd) and Node (.node) native modules, Excel add-ins (.xll), Delphi packages (.bpl) and other DLLs under another extension no longer show a false ⚠ PE mismatch in the folder view.
• The folder view follows the Sizes shown as setting instead of always showing KB and MB.
• The Hex and Strings buttons in the folder detail panel use the same icons as the rest of the app.

Fixed

• Installing the .msi on a machine that already has Binocular from setup.exe now removes that copy first. Previously both stayed installed and Apps & Features showed two entries. Installing 1.1.1 also cleans up a machine already left with two copies. Trial and licence data are not touched.

Improved

• Dual-signed binaries now have each nested signature verified and shown on its own row in the Digital Signature section.

New

• Multi-row selection in the Strings view. Click, Ctrl+click, Shift+click, Ctrl+A and the arrow keys select rows, using the same model as the Resources tab.
• Ctrl+C copies the selected strings, one per line. The context menu adds Copy with offsets, which uses the same layout as the .txt export.
• Selection is stored as row ranges, so Select All on a file with millions of strings is instant. Copies from streamed files read the real bytes, never placeholder text.

Improved

• The folder view Signature column no longer labels files without a certificate table as Unsigned. Most Windows components are catalog-signed and the check does not read catalogs, so the cell, its tooltip, the CSV export, the verdict label and the help entry now all report that no embedded signature was found and that catalog entries were not read.
• Verify Signatures across a folder shows n/a for files Authenticode does not apply to, such as ELF binaries and archive members, instead of a warning. This matches how the Hardening column already treats unsupported formats.
• Copy buttons in the Tools dialogs use a dedicated copy icon. The previous export glyph read as a download.
• The printed manual no longer carries the app's internal page address in the footer. Each page now has a repeating Binocular header and footer with consistent spacing.

Fixed

• ECDSA Authenticode signatures written with the key algorithm identifier (id-ecPublicKey), which is how signtool records them, now verify. Binaries signed with DigiCert ECC certificates previously reported that the signature check was not attempted even though the digest matched.
• Help > About reports the installed version. It previously showed a fixed placeholder.

Included

• Structure views for Windows PE, Linux ELF and macOS Mach-O binaries, plus WebAssembly, static and import libraries (.lib, .a, .rlib) and 16-bit NE executables.
• Decoded headers, sections, imports, exports, resources, TLS callbacks and .NET / CLR metadata, with a recursive dependency tree on Windows.
• Symbol demangling for nine compiler schemes, and Win32 / CRT prototypes from a bundled offline database.
• Authenticode verification by a built-in cryptographic engine, PE checksum verification, and hardening scorecards for PE and ELF.
• Categorized strings, a structure-aware hex view, side-by-side compare of two builds, and embedded PE and ELF detection with step-in.
• Folder scanning with deep passes, export of any view to JSON or CSV, Windows Explorer right-click integration, and signed .msi and .exe installers.