DLL, PE, ELF & Mach-O structure viewer for Windows.
Open a .dll, .exe, driver, shared object or dylib — plus WebAssembly modules
and static/import libraries — and inspect headers, imports, exports, sections,
resources, dependencies, .NET metadata, Authenticode signatures, hardening
mitigations, strings and raw bytes. Output is validated byte-for-byte against
Microsoft dumpbin and GNU readelf.
Download for Windows — the 30-day trial is the full product, no email or signup. Windows 10/11 (64-bit), ~6 MB installed.
| Format | Files | Coverage |
|---|---|---|
| PE (Windows) | .exe .dll .sys .ocx .drv .cpl .scr .efi .mui .ax .winmd |
Headers, imports, exports, sections, resources, .NET/CLR metadata, Authenticode, dependencies |
| ELF (Linux) | .so .so.* .ko .elf .axf |
Headers, dynamic symbols, sections, needed libraries, build-id, checksec-style hardening scorecard |
| Mach-O (macOS) | .dylib .bundle .o, thin & fat/universal |
Header and load commands, segments, linked dylibs, symbols, UUID, code-signature detection |
| WebAssembly | .wasm |
Section table, function-type signatures, typed imports & exports, memory/table limits, producer toolchain |
| Static & import libraries | .lib .a .rlib |
Every archive member, its type, and the symbols each defines |
| 16-bit NE | Windows 3.x / OS/2 .exe .dll |
Header and segment table |
- Embedded binaries — finds PE and ELF files wrapped in overlays, sections, resources and .NET managed resources, and lets you step into each one in its own tab, recursively, cross-format (a PE inside an ELF and vice versa).
- Signature & tamper verdicts — Authenticode digests are recomputed from the raw bytes by a built-in cryptographic engine (no Windows API, no network). Verdicts are byte-proven: intact, tampered, invalid, or stuffed — and a whole folder can be audited in one pass.
- Symbol demangling — nine schemes: MSVC and Itanium C++, Rust, Swift,
Objective-C, Delphi/C++Builder, Java (JNI), Fortran and Free Pascal. C++ and
Rust verified for exact parity against
undnameandc++filt. Plain C imports get prototypes from a bundled offline database of 17,000+ Win32/CRT signatures. - Semantic strings — ASCII and UTF-16 strings categorized into URLs, IPs, file paths, registry keys, GUIDs and versions, each with its section, offset and RVA.
- Compare — two builds side by side: export, import, section and header diffs with ordinals and RVAs. Works across PE and ELF.
- Hardening scorecards — ASLR, DEP, CFG, CET, SafeSEH and stack cookies for PE; NX, PIE, RELRO and stack canary for ELF. Evidence the parser can't reach is reported as unknown, never counted as off.
- Hostile-file tolerant — every structure parses independently, so a corrupted import table doesn't take down exports, sections or strings. Fuzzed against thousands of truncated and mutated files.
Everything is 100% static and read-only — nothing is ever executed, decrypted, or decompressed.
No. Binocular is a commercial product by Hunter Works Software, and this repository is its public home:
Website: hunterworks.software/binocular · Pricing · EULA
Open an issue. One rule: never attach or link a live malware sample — paste its SHA-256 instead. For anything else: support@hunterworks.software.
Reporting a security vulnerability in Binocular itself: see SECURITY.md.
Built by Nathan (@nHunter0) · Hunter Works Software