Features
Everything You Need to Read a Binary
Binocular parses the formats you actually ship and analyze — PE, ELF and Mach-O — and presents them cleanly. Here’s the full picture.
Inspect
Headers, Imports, and Exports — Decoded
Drop in a DLL, EXE, driver, or shared object and get an immediate, navigable view of its structure. The COFF and optional headers, data directories, and section flags are parsed into plain language, and the import and export tables stay fast even with tens of thousands of entries.
- COFF and optional headers, fully decoded
- Section table with sizes, offsets, and R/W/X flags
- Searchable, virtualized import & export tables
Compare
See Exactly What Changed Between Builds
Open two builds of a binary side by side and review the differences with precision — which exports appeared or vanished, how the import table shifted, and what changed across sections and headers. Ideal for auditing an update, comparing architectures, or vetting a third-party library.
- Export and import diffs with ordinals and RVAs
- Section and header changes highlighted
- Works across PE and ELF files alike
Investigate
Follow Dependencies and Metadata All the Way Down
Trace the recursive dependency tree with circular-reference detection and missing-DLL alerts, decode .NET and CLR metadata, browse the resource tree with previews and one-click extraction, surface categorized strings, and drop into a raw hex view where every offset maps back to a parsed structure.
- Recursive dependency resolution (Windows)
- .NET / CLR assembly identity and references
- Resource tree with previews and extraction
- Semantic strings and a structure-aware hex view
Investigate
Every URL a Binary Talks To, One Click Away
Strings are the fastest way to learn what a file really does, and Binocular sorts them for you. Every ASCII and UTF-16 string is extracted and categorized into URLs, IPs, file paths, registry keys, GUIDs and versions. Open Microsoft Edge and one click on the URLs filter cuts 64,947 strings down to the 23 that matter — telemetry endpoints, crash reporters and certificate servers — each with its section, offset and RVA.
- Semantic categories: URLs, IPs, paths, registry keys, GUIDs, versions
- ASCII and UTF-16 extraction, with section, offset and RVA per string
- Filter by plain text or /regex/, tune minimum length and encoding
- Export the filtered list for reports or further tooling
Investigate
Browse and Extract the Whole Resource Tree
Every icon, cursor, bitmap, string table, version block and manifest — decoded from the PE resource directory and shown as a filterable tree with rendered previews. Reconstructs multi-size .ico icons, decodes RT_STRING tables and Delphi forms, and lets you save any single leaf, or the entire tree at once with correct file extensions.
- Rendered previews for icons, cursors, bitmaps, PNG and JPEG resources
- Decoded string tables, version info and application manifests
- One-click export of any leaf — or all resources at once
Understand
Every Symbol, Readable
Import and export tables are full of names no human should have to read raw. The viewer demangles nine compiler schemes — MSVC and Itanium C++, Rust, Swift, Objective-C, Delphi/C++Builder, Java (JNI), Fortran and Free Pascal — where most inspectors lean on Windows' own MSVC-only undecorator, if they demangle at all. Plain C names get one-line Win32 and CRT reference prototypes from a bundled offline database generated from Microsoft's own actively-maintained Win32 metadata — not a hand-typed list frozen years ago. And the Overview names the toolchain that built the file, read from the file itself.
- Nine demangling schemes — C++ and Rust verified for exact parity against the reference tools (undname, c++filt) on thousands of real-world symbols, Swift decoded by Apple's own demangler
- 17,000+ Win32/CRT prototypes, fully offline — rows marked API are reference lookups, always kept distinct from facts read from the file
- Ordinal imports resolved from the real dependency DLL, and toolchain detection from the PE Rich header or ELF .comment
Verify
Catch Tampered and Unsigned Binaries at a Glance
Binocular recomputes each file's Authenticode digest from its raw bytes with a built-in cryptographic engine — no Windows API, no network — and compares it to the digest sealed in the signature. Run it across a whole folder and sort by the Signature column: files whose signed content was modified (TAMPERED), signatures that don't verify, and certificate tables stuffed with foreign data all rise straight to the top.
- Byte-proven verdicts: intact, TAMPERED, invalid, or stuffed
- Fleet-wide — audit an entire folder in one offline pass
- Sort the bad actors to the top; nothing is ever executed
Goes deeper
Open the Binaries Hidden Inside a Binary
Most inspectors stop at the outer file. We're not aware of another tool that surfaces and opens wrapped binaries this directly.
Binaries routinely carry whole other executables inside themselves — appended to the overlay, tucked into sections or resources, or stored as .NET managed resources. Binocular finds those wrapped PE and ELF files, shows exactly where each one lives, and lets you step straight into it — the contained binary opens in its own tab with the full structure view, recursively, as deep as the nesting goes.
- Finds PEs and ELFs tucked into overlays, sections, resources, and .NET managed resources
- Step into any match — it opens in a new tab titled with the full nesting chain, e.g. installer.exe › overlay › System.dll
- Cross-format aware: a PE inside an ELF — or an ELF inside a PE — is detected and steppable
- Recursive to arbitrary depth, with one-click export of any extracted binary and real names read from the file itself
At a glance
The Full Capability Set
Headers & overview
Machine type, entry point, linker and subsystem versions, data directories, COFF and DLL characteristics — decoded.
Imports
Grouped by source DLL with hints and ordinal imports. Virtualized for very large tables.
Exports
Searchable export table with ordinals, RVAs and forwarded exports.
Symbol demangling
MSVC and Itanium C++, Rust, Swift, Objective-C, Delphi/C++Builder, Java (JNI), Fortran and Free Pascal names shown as readable signatures — raw name always on hover.
API prototype reference
Plain C imports and exports matched to 17,000+ Win32/CRT prototypes from a bundled offline database built from Microsoft's Win32 metadata.
Sections
Virtual and raw sizes, addresses, file offsets, and READ / WRITE / EXECUTE flags.
Resources
The complete resource tree — icons, cursors, bitmaps, string tables, version info and manifests — with rendered previews, multi-size .ico reconstruction and Delphi form (DFM) decoding. Save any single resource, or all of them at once with correct file extensions.
Dependency tree
Recursive Windows resolution with circular-reference detection and missing-DLL alerts.
.NET / CLR metadata
Framework kind, target framework, strong naming, referenced assemblies, R2R and mixed-mode.
Signature & tamper verdict
Authenticode checked by a built-in cryptographic engine, not a Windows API call — the signed digest is recomputed from the raw bytes and the signer's RSA/ECDSA signature verified directly. The verdict is byte-proven: intact, tampered, forged or stuffed — catching data smuggled into an otherwise-valid certificate table.
Hardening scorecard
A winchecksec-class mitigation report for PE — ASLR, DEP, Control Flow Guard, CET shadow stack, SafeSEH, stack cookies and high-entropy VA — and a checksec-style twin for ELF: NX, PIE, RELRO and stack canary. Honest about the difference between off and unreadable: evidence the parser couldn't reach is reported as unknown, never counted as off.
TLS callbacks
The TLS directory and its callback array fully decoded — every callback rebased to its real address and section, mapped in the hex view, and diffed in Compare. Hide-from-tools tricks are called out: a zero-size directory is still parsed, and an unreadable callback array is reported as unreadable, never as none.
Semantic strings
ASCII and UTF-16 extraction, categorized into paths, URLs, registry keys, GUIDs and versions.
Hex view
Raw byte inspector with structure overlays and semantic region labels.
Embedded binaries
Detects PE and ELF files wrapped in overlays, sections, resources and .NET managed resources — step into each in its own tab, recursively, and export it. Cross-format and fully static.
Deep folder analysis
Optional deep passes over a whole folder: every file is signature-sniffed to expose binaries hiding behind the wrong extension, name/format mismatches are flagged in a sortable column, each file can be hunted for embedded PE and ELF payloads — and the entire folder can be audited for hardening mitigations in one pass.
Coverage
What's Supported, Per Format
PE (Windows) is the primary target and most deeply supported; ELF (Linux) and Mach-O (macOS) viewing cover the essentials, opened from Windows. WebAssembly, static & import libraries (.lib / .a / .rlib) and 16-bit NE executables open with their own views too — see Supported Formats below.
| Capability | PE (Windows) | ELF (Linux) | Mach-O (macOS) |
|---|---|---|---|
| Headers & data directories | Full | Full | Header + load cmds |
| Imports | Full | Dynamic symbols | Dynamic symbols |
| Exports | Full | Dynamic symbols | Dynamic symbols |
| Symbol demangling (C++ / Rust / Swift / ObjC / Delphi / Java / Fortran / Pascal) | Full | Full | Full |
| Win32 / CRT API prototype reference | Full | C runtime | — |
| Toolchain detection | Rich header | .comment | Build version |
| Sections | Full | Full | Segments + sections |
| Recursive dependency tree | Windows only | Library list | Dylib list |
| .NET / CLR metadata | Full | — | — |
| Resources — browse, preview, extract | Full | — | — |
| Digital signatures (Authenticode) | Full | — | Code sign: detected |
| Signature tamper / stuffing verdict | Full | — | — |
| Debug directory & PDB path | Full | Build ID | UUID |
| Hardening scorecard (ASLR / DEP / CFG / CET …) | Full | NX / PIE / RELRO / canary | PIE / header flags |
| Rich header | Full | — | — |
| TLS directory & callbacks | Full | — | — |
| Overlay & entropy report | Full | Full | Full |
| Embedded binary detection & extraction | Full | Full | — |
| Cross-format carving (PE-in-ELF) | Full | Full | — |
| Semantic strings | Full | Full | Full |
| Hex view + overlays | Full | Full | Full |
| Binary compare (diff) | Full | Full | Full |
| Folder / batch browser | Full | Full | Full |
| Deep scan (disguised binaries) | Full | Full | Full |
| Export to JSON / CSV | Full | Full | Full |
File types
Supported Formats
Every format below opens into a full structure view — each has its own parser in the shared core, not a generic hex fallback.
PE — Windows
The primary target — headers, imports, exports, sections, resources, .NET/CLR metadata, Authenticode and dependencies.
ELF — Linux
Headers, dynamic symbols, sections, needed libraries, build-id and a checksec-style hardening scorecard (NX / PIE / RELRO / stack canary).
Mach-O — macOS
Header and load commands, segments, linked dylibs, symbols, UUID and code-signature detection — thin and universal.
WebAssembly
Section table, function-type signatures, typed imports & exports, memory / table limits, and the toolchain from the producers section.
Static & import libraries
ar archives — MSVC / COFF import & static libs, Unix .a and Rust .rlib: every member, its type, and the symbols each one defines.
16-bit NE
Legacy New Executable (Windows 3.x / OS-2) header and segment table — so vintage binaries aren’t a dead end.
Broken, Truncated and Hostile Files Still Open
Real-world binaries are often truncated by a bad download, mangled by a packer, or deliberately malformed to break analysis tools. Binocular parses every structure independently — a corrupted import table doesn't take down the exports, sections, resources, or strings. You get everything that's readable, and a clear warning naming each part that isn't.
- Best-effort by design: every readable structure is shown, every unreadable one is flagged with a named warning — never silently dropped
- Hostile values are capped and validated, not trusted — fuzz-tested against thousands of deliberately truncated and mutated files
- Packed or encrypted regions are flagged by per-section entropy, and the hex and strings views work on the raw bytes regardless
- If even the headers are unreadable, the app says exactly that — and the standalone hex and strings viewers still open the file
100% static and read-only — nothing is executed, decrypted, or decompressed.
Try It Free for 30 Days
Every feature unlocked, no account required. Buy a license when you’re ready — one payment, yours to keep.