Identify container properties, architecture signals, integrity conditions, compiler and build indicators, and version-sensitive constraints — the profile everything downstream is calibrated against.
Recover accessible code and data regions, candidate functions, references, call relationships, control flow, constants, strings, and platform interactions into a navigable structural map.
Where the target and authorization permit, scripted instrumentation collects reproducible execution evidence — transitions, register and memory state, module and call-path activity — under defined, logged conditions.
Lift low-level instructions into an architecture-aware intermediate representation modeling blocks, calls, state, types, and side effects — the common language every later stage reasons over.
Evaluate competing interpretations under structural, data-flow, type, calling-convention, platform, and runtime constraints — eliminating everything the evidence forbids and ranking what survives.
Authorized high-capability models classify routines, infer types and roles, correlate distant evidence, and flag ambiguity — proposing hypotheses, never declaring verdicts.
Compare independent passes, expose contradictions, reject incompatible hypotheses, and return ambiguous regions for deeper analysis before anything is allowed to progress.
Label each finding by evidentiary strength — verified, high, probable, tentative, or unresolved — so a strong result in one region never disguises uncertainty in another.
No single tool decides the answer
One disassembler gives a view. One debugger gives a trace. One model gives an opinion. The pipeline correlates them, rejects candidates the binary forbids, records provenance, and only promotes a finding once independent evidence agrees.
Run all eight stages on your own EX5
Review the published license terms and preview the planned checkout experience for the local Windows workflow. The current demo does not accept payment or issue software.