Register a local file or directory for analysis. Returns its id, size, hash and detected format. Ids are stable per content.

List targets opened in this session.

Release a target and its retained analysis.

Run the built-in analyzer for the target's format (ELF/PE/Mach-O, Go, .NET, WASM, EVM, SQLite, plist, APK, ZIP, Electron ASAR, JavaScript apps, source maps, HAR). Returns a summary, findings with confidence, limitations, a compact overview and the collections available for paging. Large JavaScript apps are read in batches: when complete is false, coverage says how many files are unread and every list covers the scanned part only; call again with scan to read more.

Page through one named list from the analysis, e.g. symbols, imports, exports, sections, libraries, types, methods, pinvokes, selectors, instructions, tables, columns, requests, endpoints, permissions, components, modules, edges, ipcChannels, findings. Use hexvero_analyze to see which exist.

Printable ASCII (and optional UTF-16LE) strings with offsets and tags (url, path, email, ip, format, secret-ish, base64-ish).

Read a bounded window (max 64 KiB) of the target as hex plus an ASCII gutter.

Write the complete analysis as JSON to a file and return its path and size. Use this instead of paging when you need everything.

Write recoverable sources into a new directory: the modules of a webpack/Rspack/browserify/esbuild bundle (one file each plus hexvero-bundle.json with requires/exports), or the original files embedded in a source map (sourcesContent). No engine needed; nothing is executed.

Record a material question the investigation could not answer (with what was already checked), list open or resolved unknowns, or resolve one. Unknowns are exported with the analysis so reports never silently drop them.

Diff one collection between two targets: added, removed, changed (with the fields that differ) and unchanged items, matched by key (auto-detected: name, channel, id, path, url, type+name … or pass key, a+b for composites). States completeness; unknown items are neither added nor removed. Each list pages on its own (list + offset). Without collection: counts per shared collection, to pick one.

Apply a release policy (inline JSON or file) to two builds, as hexvero check; omit targetB to audit targetA alone against the Electron security rules, as hexvero audit (policy optional). Status pass, fail or incomplete, findings paged by offset. Reads a baseline, never writes one.

Map a generated line/column of a source map target back to its original source, line, column and name.

Detect optional external engines (radare2/rizin, Ghidra) and the operations each supports.

Run one engine operation on a target: functions, disassemble, decompile, strings, imports, xrefs (references to an address), callers, callees, callgraph or search (names + strings). Output is bounded and cached.

Bounded call-graph neighborhood around a function (callers, callees or both, by depth and node count), or the shortest call path from root to goal. One engine run per target, cached; levels state what was cut.