Binocular

Binocular is a desktop binary analyzer for Windows that opens PE (.exe, .dll, .sys), ELF, and Mach-O files and shows what is actually inside them, without uploading anything, creating an account, or paying a subscription.

It answers the questions people actually ask about a binary: what it imports and exports, whether the signature is genuine, what is hidden inside it, and what changed between two builds. Most tools that answer them date from the Windows XP era.

CORE VIEWS

• Headers and directories: DOS/NT/optional headers, sections, data directories, TLS callbacks, Rich header
• Imports and exports: demangled names, offline Win32/CRT prototype lookup, and static binding checks that flag imports the target DLL does not export
• Dependency tree: apiset resolution, missing and circular badges, plus a folder-wide dependency and export audit
• Resources: full tree with previews and extraction for icons, bitmaps, string tables, manifests, version info, Delphi DFM
• .NET metadata: streams, table counts, ReadyToRun, strong name, P/Invoke, references, target framework
• Strings: streamed, hunting URLs, IPs, and registry paths instead of dumping everything
• Hex viewer: structure-aware coloring, named byte regions, data inspector, cross-navigation with the structure view
• Hardening: ASLR/DEP/CFG/GS mitigation scorecard for PE, checksec equivalent for ELF

WHAT THE FREE TOOLS DO NOT DO

• Authenticode tamper verdicts: recomputes the digest offline and compares it to what the signature covers, flagging CVE-2013-3900-style certificate-table stuffing that stays valid because the hash excludes those bytes
• Nine demangling schemes: MSVC (100% parity with undname), Itanium, Rust legacy and v0, Swift (Apple's own demangler compiled in), Objective-C, Delphi, JNI, Fortran, Free Pascal
• Binary diff: compare two builds across sections, imports, exports, functions, hashes, and strings
• Folder and drive scanning: file types identified by signature, not extension, so a PE hiding under a .dat name still surfaces
• Embedded binary hunt: finds binaries packed inside a file, shows the nesting chain, extracts at any depth
• Multi-gigabyte files: hex, strings, search, and hashing are streamed, so 5 GB binaries open instead of hanging

HONEST BY DESIGN

Corrupt and hostile files are a first-class case. A lying header is shown as lying, and unknown is reported as unknown, never as a plausible guess or silently as "off". Toolchain identification comes from verifiable stamps only.

OFFLINE, AND YOURS

No account, no telemetry, no analytics. The only network request Binocular's own code makes is the update check you click yourself. Licenses are offline Ed25519-signed keys, with no license server and no activation call, so your copy keeps working if the vendor disappears.

One-time purchase, no subscription. 30-day trial, no email needed to download.

A modern alternative to CFF Explorer, PE Explorer, PEview, PE-bear, pestudio, Dependency Walker, and Detect It Easy.