Reverse engineering in your browser. Drop an executable, get a first look in seconds. binkeep is a free, open source binary analysis tool for PE, ELF and Mach-O: disassembler, functions, cross-references, strings, imports, YARA and packer detection. The file is never uploaded, and after the first visit it works offline.

Try it: https://kano92-dir.github.io/binkeep/

It is not a Ghidra replacement. It covers the first part of looking at an unknown binary, without installing anything: malware triage, CTF challenges, checking what a downloaded tool imports, or comparing two builds.

Control flow graph of a function, with taken / not taken branches and a minimap

Disassembly with clickable branches

Features

Formats

PE32 / PE32+ (Windows), ELF32 / ELF64 (Linux, either endianness), Mach-O 32/64 and universal binaries (macOS, iOS)
Anything else still gets hex, strings, entropy and YARA

Overview

Headers, entry point, compile time, linked libraries, platform and SDK versions
Security mitigations: ASLR, DEP, CFG (PE); PIE, NX, RELRO, canary, FORTIFY (ELF); PIE, canary, ARC, hardened runtime (Mach-O)
Packer detection: UPX, Themida, VMProtect, ASPack, MPRESS, PECompact, Enigma, .NET obfuscators and more, by section names and byte signatures, plus heuristics (code entropy, import count, entry point placement)
Authenticode: signer, issuer, validity, timestamp, and the file digest recomputed to show whether the file changed after signing
Mach-O code signature: identifier, team ID, ad-hoc or developer, hardened runtime
Toolchain hints: Go, Rust, Nim, PyInstaller, NSIS, Inno Setup, AutoIt, Electron, .NET, GCC

Code

Function list from a full linear sweep of the code, plus .pdata (x64 PE) and LC_FUNCTION_STARTS (Mach-O)
Cross-references: who calls a function, which code uses an import, which code reads a string
Disassembly (x86, x64, ARM, ARM64 via Capstone in WebAssembly) with API names through the IAT, GOT and Mach-O stubs, inline strings, clickable branches
Control flow graph for any function: basic blocks with taken / not taken / loop edges, pan and zoom, Space to switch between the listing and the graph
Your own function names and comments (N, ;, X in the disassembly), saved in the browser per file hash

Data

Entropy graph with section bands, sections with R/W/X flags
Imports with heuristic tags (injection, anti-debug, network, crypto, persistence, ...) and call counts
Strings (ASCII and UTF-16) with regex filter, categories, and a "referenced by code" filter
PE resources: version info, manifest (requested execution level), the application icon, and embedded executables or archives
Hex view that stays fast on large files

Workflow

YARA: real libyara compiled to WebAssembly, with the pe, elf and math modules. Your rules are kept in the browser and run on every file you open
Compare two files: changed headers, sections, imports, exports and strings
Share link: the report is compressed into the URL fragment (#r=...), which browsers never send to a server. The file itself is never included
Export the report as Markdown or JSON
Command palette (Ctrl+K / Cmd+K): jump to any function, import, symbol, string, address or action
Installable as an app, works offline

Host it yourself

It is a static site with no build step. GitHub Pages works as is: push the repository, then in Settings > Pages pick the main branch and the root folder.

Run locally

python serve.py

Then open http://localhost:8765. Any static file server works, as long as it serves .js as text/javascript and .wasm as application/wasm.

No build step. Capstone (capstone-wasm 1.0.3) and libyara (libyara-wasm 1.2.1) are bundled in vendor/.

Privacy

All analysis happens in the page. The only network requests are the app files and Google Fonts. The share link carries the report, not the file, and the part after # is never sent to any server.

Limits

Function discovery is a linear sweep: data inside code can be misread, and functions that are only reached through pointers may be missed
The Authenticode certificate chain is not verified, only the file digest
No decompiler yet (planned)
API tags are hints. Legitimate software uses every one of those APIs

License

binkeep is MIT licensed, see LICENSE.

Bundled third-party code, with license texts next to it in vendor/:

Capstone (BSD), via the capstone-wasm 1.0.3 build
libyara-wasm 1.2.1 (ISC)
YARA (BSD-3-Clause)

binkeep