List which analysis engines are available in this install.

Use this first if a tool reports a missing dependency, to see what is installed (pefile, lief, capstone, jsbeautifier) and which optional external engines are present (radare2/r2pipe, Ghidra, YARA).

One-shot triage of a binary: identification + format summary + notable strings + entry-point disassembly. Start here when handed an unknown file (.exe/.dll/.so/.dylib/.wasm/etc.); then drill in with the specific tools.

Identify a file: format (by magic bytes), size, MD5/SHA1/SHA256 hashes, and entropy (flags likely packing/encryption). Cheap first look.

Extract printable strings (ASCII + UTF-16LE) with file offsets.

minlen: minimum run length. limit: max strings returned. offset/length:
restrict to a byte window. include_wide: also pull UTF-16 (important on
Windows). highlight: tag URLs, paths, registry keys, module names, and
suspicious Win32 APIs.

Hex + ASCII dump of a byte window (like hexdump -C). offset may be negative to read from the end of the file.

Full PE/PE32+ analysis for Windows .exe/.dll/.sys: headers, machine, subsystem, entry point, timestamp, imphash, security mitigations (ASLR/DEP/CFG/SEH), Authenticode signing state, PDB path, TLS callbacks, sections with per-section entropy, imports (by DLL), and exports.

ELF analysis (Linux/Unix): header, arch, PIE/NX, interpreter, needed libraries, sections, imported and exported functions.

Mach-O analysis (macOS/iOS), including fat/universal binaries: header, CPU type, PIE/NX, code-signature presence, linked libraries, segments, imports and exports.

Disassemble a window of machine code from a file offset with Capstone.

arch: auto|x86|x64|arm|thumb|arm64 (auto detects from the file header).
count: number of instructions. base_addr: virtual address to show as the
first instruction's address (defaults to the file offset).

Resolve a PE or ELF entry point to its file offset and virtual address, then disassemble from there. The fastest way to see where execution begins.

Run static radare2 commands via r2pipe (requires the r2 binary).

Opens the target read-only in static mode; the debug command family is
refused. analyze=True runs `aaa` first. Useful commands: iI (info),
ii (imports), iE (exports), afl (functions), 'pdf @ main' (disasm a
function), 'axt @ sym.name' (xrefs), '/ <bytes>' (search).

Decompile to pseudo-C with Ghidra's headless analyzer (requires Ghidra; set GHIDRA_HOME). function: a name or address to decompile just one function; omit to decompile all (slower). Large binaries take minutes.

Beautify/unminify JavaScript and flag suspicious patterns (eval, Function(), base64, char-code building, hex/unicode blobs, network calls, anti-debug). Provide either a file path or inline code.

Parse a WebAssembly (.wasm) module: version, section layout, and imported/exported names (functions, memories, globals, tables).

Read-only GET of a remote text/script/wasm asset so it can be analyzed (e.g. a site's bundle.js). Returns the content and content-type; it is not executed. http(s) only.

Scan a file with YARA (requires yara-python). Provide inline rules_source or a path to a .yar file in rules_file. Returns matched rules with string offsets.