Disassembler · CFG & call-graph builder · pseudo-C decompiler · concrete emulator. One CLI, one C library, one npm package: same core underneath.
CAPABILITIES
Every pass below shares the same fault-isolated core: a malformed function fails its own pass and the rest of the run continues.
x86-64, AArch64, and RISC-V RV64GC, with instruction-group coloring, xrefs, and string annotations.
Read the docs →Two-pass control-flow construction with jump-table and opaque-predicate handling, plus dominator-based loop detection.
Read the docs →Typed SSA-style IR lifting with pointer/flags/integer type tags and resolved direct call targets, on ARM64 and RISC-V.
Read the docs →Interpreter-level execution engine for ARM64 and RISC-V functions, with documented software (not OS-level) sandboxing.
Read the docs →Expression-pool-bounded symbolic execution across ARM64, x86-64, and RISC-V, exposed via -P and .symexec().
Entropy scanning, an instruction validity filter, polymorphic-map detection, and AIRE's confidence-scored heuristic signals.
Read the docs →CLI
28 flags cover the full surface, from a plain disassembly to -X, which runs every pass including the decompiler, emulator, and obfuscation heuristics.
-xStandard analysis: disasm, symbols, functions, xrefs, CFG, loops, call graph, switch tables-DDecompile to pseudo-C (type tagging, resolved direct calls)-IEmulate functions (ARM64, RISC-V)-PSymbolic execution (ARM64, x86-64, RISC-V)--aireHeuristic pattern signals with confidence scoring, cached to .aire_memory-XEverything: all of the above plus --poly --vm-trace --dsaOPEN SOURCE
Apache 2.0, no dark-pattern gating. If a hosted playground with higher limits ever exists as a paid tier, it will be clearly separate from the free, open-source project: not blended into it.
Contributors
Populated from the GitHub API at build time: not hand-maintained.
69 sequential lessons, from "what is binary analysis" to building your own plugins, or go straight to the CLI reference if you already know what you're looking for.