horsicq/detect-it-easyProgram for determining types of files for Windows, Linux and MacOS.
Detect It Easy (DiE) is a cross-platform tool for file identification and static inspection, used by malware analysts, cybersecurity experts, and reverse engineers. It combines native format parsers with an extensible DiE-JS analysis layer, supporting both compact signatures and multi-stage static analysis across Windows, Linux, and MacOS.
[!WARNING]
detectiteasy.comis not affiliated with the Detect It Easy project or its official website. Do not trust it as an official source or use it to download DiE. Use only the release links provided in this repository.
Detect It Easy combines format-aware parsing, signature matching, and programmable analysis for malware analysis, reverse engineering, and digital forensics. DiE-JS modules can use parsed structures and low-level inspection primitives to implement bounded algorithms while keeping detection policy reviewable in the database.
A signature can tell you what a file resembles. The Generic Heuristic Analysis engine (__GenericHeuristicAnalysis_By_DosX.7.sg) goes further: it reports concrete structural and behavioral anomalies together with the evidence behind them. The PE heuristic engine is created and maintained by DosX.
[!NOTE] DiE-JS is the implementation language of this analysis engine, not a shorthand for a few native detector calls. The native DiE core supplies format parsing, bounded reads, address translation, searching, and disassembly primitives. The PE heuristic engine builds analysis algorithms on those primitives: it selects candidates, maintains state, traverses bounded control flow, validates relationships across structures, rejects benign explanations, correlates independent evidence, and reconciles results.
Heuristic analysis is not merely a fallback used when signatures fail. When enabled, it runs as a separate higher-level analysis engine and can corroborate, qualify, or reject earlier database results while keeping every heuristic conclusion visibly marked.
With heuristic scanning enabled, the PE heuristic engine makes a series of specialized passes over native and managed images. The file is never launched. Instead, the engine works with headers, data directories, sections, imports, exports, resources, .NET metadata, bytecode, overlays, debug records, and reachable startup code rooted at the entry point. The same coverage extends to DLL initialization code, closing a common blind spot when protected or suspicious behavior begins inside a library rather than an application. This makes it useful both when an exact signature is known and when a sample has been modified enough to evade ordinary identification.
The PE heuristic engine's native-code analysis combines cached linear disassembly with bounded traversal of reachable startup code and purpose-built state machines. It tracks the register, flag, stack, address-provenance, and instruction-boundary facts required by each rule without pretending to be a sandbox or full CPU emulator. This allows DiE to expose opaque and degenerate branches, synthetic and indirect transfers, overlapping instruction streams, position-independent and self-modifying stubs, bitstream unpackers, anti-analysis probes, and irregular control flow used by polymorphic packers and protectors. The checks remain effective across register substitution, neutral padding, equivalent arithmetic forms, and bounded reordering of independent instructions commonly produced by commercial generators and private cryptors.
For managed code, the PE heuristic engine uses an internal MSIL opcode model to build operand-aware bytecode patterns for indirect calls and function pointers, control-flow transformations, arithmetic mutations, invalid instruction sequences, and other forms of obfuscation. It is not a CLR emulator, but it allows the engine to reason about executable IL patterns instead of treating a managed assembly as little more than metadata and strings.
Much of the analysis comes from joining evidence across layers. The engine can relate version-resource identity to Authenticode state, Rich build metadata, runtime model, and detected protection; cross-check the file-system extension; interpret mangled import and export symbols used by MSVC, GNU/MinGW, Borland, and Swift; and recognize fingerprints left by dumpers, unpackers, and PE reconstructors. Native checks are architecture-aware across x86/x64 and the ARM family, while security-mitigation flags are checked as meaningful combinations rather than isolated bits.
A single scan may independently identify a known protector, recognize its characteristic section layout, describe entry-point transformations, recover toolchain or game-engine provenance, and associate licensing metadata. These findings come from separate analysis paths; no single backend predicate produces the complete report.
These are the main passes rather than a complete inventory of every check:
