No file loaded
Disassembly
idleUpload a binary to begin
Upload a binary to begin emulation...
Enable strace to see syscall trace output.
R W
H:
Click byte to edit
Enter an address and click Go.
No binary loaded
No binary loaded
ELF structure
Load an ELF or PE (Windows) binary to view its structure (headers, sections, exports).
PE Resources viewer
Load a PE (EXE/DLL) binary to view its resources.
Strings
Load an ELF or PE binary to view extracted strings.
Memory Accesses
Step or seek trace to see accesses
No memory accesses to display. Enable Timeless and step through instructions.
Memory Context
Click an access to preview memory
Results
Write YARA rules and click "Run all rules" to scan memory and see all results.
Listing
Assemble to see address, bytes, and source.
Hex bytes
—
No binary loaded
No call stack data. Step through code to see the call stack.
Instruction (address)
Syscall
No breakpoints set
Track data addresses to see all reads/writes across execution. Use j/k to navigate invocations, J/K for data accesses.
No bookmarks. Right-click an address in Disassembly or Memory to add a label.
No comments. Right-click an address in Disassembly or Memory to add a comment.
Value history for the tracked address (daddr). Click a row to seek.
Set a memory breakpoint (click a byte in Memory) and record a trace to see value history.
Click an address in the disassembly to see its cross-references here.
Virtual filesystem: libraries and files visible to the emulated program.
Drop file or click to add
Path
Size
No files in VFS. Add libraries or files above.