
BinDetective 二进制侦探是一款多架构二进制反编译与识别引擎,共计支持 40 条机器码映射规则、覆盖 约 30 种 CPU 架构,兼容 PE、ELF、Mach-O 三大主流可执行文件格式。其中 23 条规则可对接 Sleigh 语言,支持直接自动化反编译,同时可兜底识别十余家常见非二进制文件格式。工具自动完成 大小端字节序、32/64 位位数 判定,覆盖 x86、ARM、AArch64、RISC-V、LoongArch、eBPF、PowerPC、MIPS 等主流架构,部分小众架构支持名称识别,全面提升二进制样本快速分析与反编译适配能力。
其中的接口读写、交叉引用、代码溯源等功能均为自研实现,项目共实现了113个接口调用,可以很好的让AI完成逆向工程。
程序分为两种接口:
程序运行后会在后台运行:



程序仅有一个可执行文件,大小为5MB,非常小巧灵活。
如下将一个个进行测试,确保接口全部可用完善。以作为软件上线发布前的全量测试。
测试之前使用POST MAN直接对接输入KEY。

X-Auth-Token 7f3c9a1e5b8d2046c9e7f1a3b5d2c4e8f Content-Type application/json
识别处理器架构:IdentifyArchitecture
{
"interface": "IdentifyArchitecture",
"params": [
"C://data/demo/bash"
]
}
{
"status": "success",
"result": {
"file_path": "C://data/demo/bash",
"format": "ELF64-LE",
"machine": "x86-64",
"machine_raw": 62,
"is_64bit": true,
"is_little_endian": true,
"file_size": 1446024,
"entry": "0x34360",
"image_base": "0x400000",
"section_count": 0,
"os_abi": "System V",
"suggested_language": "x86:LE:64:default",
"detail": "x86-64"
},
"timestamp": 48129640
}
{
"interface": "IdentifyArchitecture",
"params": [
"C://data/demo/Win32_Debug.exe"
]
}
{
"status": "success",
"result": {
"file_path": "C://data/demo/Win32_Debug.exe",
"format": "PE",
"machine": "x86 (32-bit)",
"machine_raw": 332,
"is_64bit": false,
"is_little_endian": true,
"file_size": 41984,
"entry": "0x1121c",
"image_base": "0x400000",
"section_count": 7,
"suggested_language": "x86:LE:32:default",
"detail": "PE32 (32-bit)"
},
"timestamp": 49172390
}拷贝下"suggested_language": "x86:LE:32:default" 部分用于指定后续解码架构,默认会创建session_id=s1,也可以自己执行session名字,session名字是为了可以直接关闭或调用其他功能的一个标识。
有会话状态的功能,就必须要先打开创建一个session会话,才可以继续操作。
Open 是用来打开会话的。
{
"interface": "Open",
"params": [
"C://data/demo/Win32_Debug.exe",
"x86:LE:32:default",
"0x10000000"
]
}
{
"status": "success",
"result": {
"message": "The binary file has been successfully opened",
"file_path": "C://data/demo/Win32_Debug.exe",
"file_size": 41984,
"session_id": "S1",
"language": "x86:LE:32:default:windows",
"format": "PE",
"machine": "PE image (raw load)",
"is_64bit": 0,
"entry": "0x10000000"
},
"timestamp": 49459437
}使用ListLangguages查询支持的所有CPU架构
{
"interface": "ListLanguages",
"params": [
]
}
{
"status": "success",
"result": {
"count": 483,
"languages": [
"6502:LE:16:default",
"6502:LE:16:default:default",
"65C02:LE:16:default",
"65C02:LE:16:default:default",
"68000:BE:32:CPU32",
"68000:BE:32:CPU32:default",
"68000:BE:32:Coldfire",
"68000:BE:32:Coldfire:default",
"68000:BE:32:Coldfire:register",
"68000:BE:32:MC68020",
"68000:BE:32:MC68020:default",
"68000:BE:32:MC68030",
"68000:BE:32:MC68030:default",
"68000:BE:32:default",
"68000:BE:32:default:default",
"6805:BE:16:default",
"6805:BE:16:default:default",
"6809:BE:16:default",
"6809:BE:16:default:default",
"80251:BE:24:default",
"80251:BE:24:default:default",
"80390:BE:24:default",
"80390:BE:24:default:default",
"8048:LE:16:default",
"8048:LE:16:default:default",
"8051:BE:16:default",
"8051:BE:16:default:Archimedes",
"8051:BE:16:default:default",
"8051:BE:24:cip-51",
"8051:BE:24:cip-51:default",
"8051:BE:24:mx51",
"8051:BE:24:mx51:default",
"8085:LE:16:default",
"8085:LE:16:default:default",
"AARCH64:BE:32:ilp32",
"AARCH64:BE:32:ilp32:default",
"AARCH64:BE:32:ilp32:golang",
"AARCH64:BE:64:v8A",
"AARCH64:BE:64:v8A:default",
"AARCH64:BE:64:v8A:golang",
"AARCH64:LE:32:ilp32",
"AARCH64:LE:32:ilp32:default",
"AARCH64:LE:32:ilp32:golang",
"AARCH64:LE:64:AppleSilicon",
"AARCH64:LE:64:AppleSilicon:default",
"AARCH64:LE:64:AppleSilicon:golang",
"AARCH64:LE:64:AppleSilicon:swift",
"AARCH64:LE:64:v8A",
"AARCH64:LE:64:v8A:default",
"AARCH64:LE:64:v8A:golang",
"AARCH64:LE:64:v8A:swift",
"AARCH64:LE:64:v8A:windows",
"ARM:BE:32:Cortex",
"ARM:BE:32:Cortex:apcs",
"ARM:BE:32:Cortex:default",
"ARM:BE:32:v4",
"ARM:BE:32:v4:apcs",
"ARM:BE:32:v4:default",
"ARM:BE:32:v4t",
"ARM:BE:32:v4t:apcs",
"ARM:BE:32:v4t:default",
"ARM:BE:32:v5",
"ARM:BE:32:v5:apcs",
"ARM:BE:32:v5:default",
"ARM:BE:32:v5t",
"ARM:BE:32:v5t:apcs",
"ARM:BE:32:v5t:default",
"ARM:BE:32:v6",
"ARM:BE:32:v6:apcs",
"ARM:BE:32:v6:default",
"ARM:BE:32:v7",
"ARM:BE:32:v7:apcs",
"ARM:BE:32:v7:default",
"ARM:BE:32:v8",
"ARM:BE:32:v8-m",
"ARM:BE:32:v8-m:apcs",
"ARM:BE:32:v8-m:default",
"ARM:BE:32:v8:apcs",
"ARM:BE:32:v8:default",
"ARM:BE:32:v8T",
"ARM:BE:32:v8T:apcs",
"ARM:BE:32:v8T:default",
"ARM:LE:32:Cortex",
"ARM:LE:32:Cortex:apcs",
"ARM:LE:32:Cortex:default",
"ARM:LE:32:v4",
"ARM:LE:32:v4:apcs",
"ARM:LE:32:v4:default",
"ARM:LE:32:v4t",
"ARM:LE:32:v4t:apcs",
"ARM:LE:32:v4t:default",
"ARM:LE:32:v5",
"ARM:LE:32:v5:apcs",
"ARM:LE:32:v5:default",
"ARM:LE:32:v5t",
"ARM:LE:32:v5t:apcs",
"ARM:LE:32:v5t:default",
"ARM:LE:32:v6",
"ARM:LE:32:v6:apcs",
"ARM:LE:32:v6:default",
"ARM:LE:32:v7",
"ARM:LE:32:v7:apcs",
"ARM:LE:32:v7:default",
"ARM:LE:32:v7:windows",
"ARM:LE:32:v8",
"ARM:LE:32:v8-m",
"ARM:LE:32:v8-m:apcs",
"ARM:LE:32:v8-m:default",
"ARM:LE:32:v8:apcs",
"ARM:LE:32:v8:default",
"ARM:LE:32:v8:windows",
"ARM:LE:32:v8T",
"ARM:LE:32:v8T:apcs",
"ARM:LE:32:v8T:default",
"ARM:LE:32:v8T:windows",
"ARM:LEBE:32:v7LEInstruction",
"ARM:LEBE:32:v7LEInstruction:apcs",
"ARM:LEBE:32:v7LEInstruction:default",
"ARM:LEBE:32:v7LEInstruction:windows",
"ARM:LEBE:32:v8LEInstruction",
"ARM:LEBE:32:v8LEInstruction:apcs",
"ARM:LEBE:32:v8LEInstruction:default",
"ARM:LEBE:32:v8LEInstruction:windows",
"BPF:LE:32:default",
"BPF:LE:32:default:default",
"CP1600:BE:16:default",
"CP1600:BE:16:default:default",
"CR16C:LE:16:default",
"CR16C:LE:16:default:default",
"DATA:BE:64:default",
"DATA:BE:64:default:pointer16",
"DATA:BE:64:default:pointer32",
"DATA:BE:64:default:pointer64",
"DATA:LE:64:default",
"DATA:LE:64:default:pointer16",
"DATA:LE:64:default:pointer32",
"DATA:LE:64:default:pointer64",
"Dalvik:LE:32:DEX_Android10",
"Dalvik:LE:32:DEX_Android10:default",
"Dalvik:LE:32:DEX_Android11",
"Dalvik:LE:32:DEX_Android11:default",
"Dalvik:LE:32:DEX_Android12",
"Dalvik:LE:32:DEX_Android12:default",
"Dalvik:LE:32:DEX_Android13",
"Dalvik:LE:32:DEX_Android13:default",
"Dalvik:LE:32:DEX_Base",
"Dalvik:LE:32:DEX_Base:default",
"Dalvik:LE:32:DEX_KitKat",
"Dalvik:LE:32:DEX_KitKat:default",
"Dalvik:LE:32:DEX_Lollipop",
"Dalvik:LE:32:DEX_Lollipop:default",
"Dalvik:LE:32:DEX_Nougat",
"Dalvik:LE:32:DEX_Nougat:default",
"Dalvik:LE:32:DEX_Oreo",
"Dalvik:LE:32:DEX_Oreo:default",
"Dalvik:LE:32:DEX_Pie",
"Dalvik:LE:32:DEX_Pie:default",
"Dalvik:LE:32:Marshmallow",
"Dalvik:LE:32:Marshmallow:default",
"Dalvik:LE:32:ODEX_KitKat",
"Dalvik:LE:32:ODEX_KitKat:default",
"Dalvik:LE:32:default",
"Dalvik:LE:32:default:default",
"H6309:BE:16:default",
"H6309:BE:16:default:default",
"HC-12:BE:16:default",
"HC-12:BE:16:default:default",
"HC05:BE:16:M68HC05TB",
"HC05:BE:16:M68HC05TB:default",
"HC05:BE:16:default",
"HC05:BE:16:default:default",
"HC08:BE:16:MC68HC908QY4",
"HC08:BE:16:MC68HC908QY4:default",
"HC08:BE:16:default",
"HC08:BE:16:default:default",
"HCS-12:BE:24:default",
"HCS-12:BE:24:default:default",
"HCS-12X:BE:24:default",
"HCS-12X:BE:24:default:default",
"HCS08:BE:16:MC9S08GB60",
"HCS08:BE:16:MC9S08GB60:default",
"HCS08:BE:16:default",
"HCS08:BE:16:default:default",
"HCS12:BE:24:default",
"HCS12:BE:24:default:default",
"Hexagon:LE:32:default",
"Hexagon:LE:32:default:default",
"JVM:BE:32:default",
"JVM:BE:32:default:default",
"Loongarch:LE:32:ilp32d",
"Loongarch:LE:32:ilp32d:default",
"Loongarch:LE:32:ilp32f",
"Loongarch:LE:32:ilp32f:default",
"Loongarch:LE:64:lp64d",
"Loongarch:LE:64:lp64d:default",
"Loongarch:LE:64:lp64f",
"Loongarch:LE:64:lp64f:default",
"M16C/60:LE:16:default",
"M16C/60:LE:16:default:default",
"M16C/80:LE:16:default",
"M16C/80:LE:16:default:default",
"M8C:BE:16:default",
"M8C:BE:16:default:default",
"MCS96:LE:16:default",
"MCS96:LE:16:default:default",
"MIPS:BE:32:16e",
"MIPS:BE:32:16e:default",
"MIPS:BE:32:16e:eabi",
"MIPS:BE:32:16e:windows",
"MIPS:BE:32:R6",
"MIPS:BE:32:R6:default",
"MIPS:BE:32:default",
"MIPS:BE:32:default:default",
"MIPS:BE:32:default:eabi",
"MIPS:BE:32:default:windows",
"MIPS:BE:32:micro",
"MIPS:BE:32:micro:default",
"MIPS:BE:64:16e",
"MIPS:BE:64:16e:default",
"MIPS:BE:64:64-32R6addr",
"MIPS:BE:64:64-32R6addr:default",
"MIPS:BE:64:64-32R6addr:n32",
"MIPS:BE:64:64-32R6addr:o32",
"MIPS:BE:64:64-32R6addr:o64",
"MIPS:BE:64:64-32addr",
"MIPS:BE:64:64-32addr:default",
"MIPS:BE:64:64-32addr:n32",
"MIPS:BE:64:64-32addr:o32",
"MIPS:BE:64:64-32addr:o64",
"MIPS:BE:64:R6",
"MIPS:BE:64:R6:default",
"MIPS:BE:64:default",
"MIPS:BE:64:default:default",
"MIPS:BE:64:micro",
"MIPS:BE:64:micro64-32addr",
"MIPS:BE:64:micro64-32addr:default",
"MIPS:BE:64:micro64-32addr:n32",
"MIPS:BE:64:micro64-32addr:o32",
"MIPS:BE:64:micro64-32addr:o64",
"MIPS:BE:64:micro:default",
"MIPS:LE:32:16e",
"MIPS:LE:32:16e:default",
"MIPS:LE:32:16e:eabi",
"MIPS:LE:32:16e:windows",
"MIPS:LE:32:R6",
"MIPS:LE:32:R6:default",
"MIPS:LE:32:default",
"MIPS:LE:32:default:default",
"MIPS:LE:32:default:eabi",
"MIPS:LE:32:default:windows",
"MIPS:LE:32:micro",
"MIPS:LE:32:micro:default",
"MIPS:LE:32:micro:windows",
"MIPS:LE:64:16e",
"MIPS:LE:64:16e:default",
"MIPS:LE:64:16e:windows",
"MIPS:LE:64:64-32R6addr",
"MIPS:LE:64:64-32R6addr:default",
"MIPS:LE:64:64-32R6addr:n32",
"MIPS:LE:64:64-32R6addr:o32",
"MIPS:LE:64:64-32R6addr:o64",
"MIPS:LE:64:64-32R6addr:windows",
"MIPS:LE:64:64-32addr",
"MIPS:LE:64:64-32addr:default",
"MIPS:LE:64:64-32addr:n32",
"MIPS:LE:64:64-32addr:o32",
"MIPS:LE:64:64-32addr:o64",
"MIPS:LE:64:64-32addr:windows",
"MIPS:LE:64:R6",
"MIPS:LE:64:R6:default",
"MIPS:LE:64:R6:windows",
"MIPS:LE:64:default",
"MIPS:LE:64:default:default",
"MIPS:LE:64:default:windows",
"MIPS:LE:64:micro",
"MIPS:LE:64:micro64-32addr",
"MIPS:LE:64:micro64-32addr:default",
"MIPS:LE:64:micro64-32addr:n32",
"MIPS:LE:64:micro64-32addr:o32",
"MIPS:LE:64:micro64-32addr:o64",
"MIPS:LE:64:micro64-32addr:windows",
"MIPS:LE:64:micro:default",
"MIPS:LE:64:micro:windows",
"NDS32:BE:32:default",
"NDS32:BE:32:default:default",
"NDS32:LE:32:default",
"NDS32:LE:32:default:default",
"PIC-12:LE:16:PIC-12C5xx",
"PIC-12:LE:16:PIC-12C5xx:default",
"PIC-16:LE:16:PIC-16",
"PIC-16:LE:16:PIC-16:default",
"PIC-16:LE:16:PIC-16C5x",
"PIC-16:LE:16:PIC-16C5x:default",
"PIC-16:LE:16:PIC-16F",
"PIC-16:LE:16:PIC-16F:default",
"PIC-17:LE:16:PIC-17C7xx",
"PIC-17:LE:16:PIC-17C7xx:default",
"PIC-18:LE:24:PIC-18",
"PIC-18:LE:24:PIC-18:default",
"PIC-24E:LE:24:default",
"PIC-24E:LE:24:default:default",
"PIC-24F:LE:24:default",
"PIC-24F:LE:24:default:default",
"PIC-24H:LE:24:default",
"PIC-24H:LE:24:default:default",
"PowerPC:BE:32:4xx",
"PowerPC:BE:32:4xx:default",
"PowerPC:BE:32:MPC8270",
"PowerPC:BE:32:MPC8270:default",
"PowerPC:BE:32:QUICC",
"PowerPC:BE:32:QUICC:default",
"PowerPC:BE:32:default",
"PowerPC:BE:32:default:default",
"PowerPC:BE:32:default:macosx",
"PowerPC:BE:32:e500",
"PowerPC:BE:32:e500:default",
"PowerPC:BE:32:e500mc",
"PowerPC:BE:32:e500mc:default",
"PowerPC:BE:64:64-32addr",
"PowerPC:BE:64:64-32addr:default",
"PowerPC:BE:64:A2-32addr",
"PowerPC:BE:64:A2-32addr:default",
"PowerPC:BE:64:A2ALT",
"PowerPC:BE:64:A2ALT-32addr",
"PowerPC:BE:64:A2ALT-32addr:default",
"PowerPC:BE:64:A2ALT:default",
"PowerPC:BE:64:VLE-32addr",
"PowerPC:BE:64:VLE-32addr:default",
"PowerPC:BE:64:VLEALT-32addr",
"PowerPC:BE:64:VLEALT-32addr:default",
"PowerPC:BE:64:default",
"PowerPC:BE:64:default:default",
"PowerPC:BE:64:default:macosx",
"PowerPC:LE:32:4xx",
"PowerPC:LE:32:4xx:default",
"PowerPC:LE:32:4xx:windows",
"PowerPC:LE:32:QUICC",
"PowerPC:LE:32:QUICC:default",
"PowerPC:LE:32:QUICC:windows",
"PowerPC:LE:32:default",
"PowerPC:LE:32:default:default",
"PowerPC:LE:32:default:windows",
"PowerPC:LE:32:e500",
"PowerPC:LE:32:e500:default",
"PowerPC:LE:32:e500mc",
"PowerPC:LE:32:e500mc:default",
"PowerPC:LE:64:64-32addr",
"PowerPC:LE:64:64-32addr:default",
"PowerPC:LE:64:64-32addr:windows",
"PowerPC:LE:64:A2-32addr",
"PowerPC:LE:64:A2-32addr:default",
"PowerPC:LE:64:A2-32addr:windows",
"PowerPC:LE:64:A2ALT",
"PowerPC:LE:64:A2ALT-32addr",
"PowerPC:LE:64:A2ALT-32addr:default",
"PowerPC:LE:64:A2ALT-32addr:windows",
"PowerPC:LE:64:A2ALT:default",
"PowerPC:LE:64:default",
"PowerPC:LE:64:default:default",
"RISCV:LE:32:AndeStar_v5",
"RISCV:LE:32:AndeStar_v5:gcc",
"RISCV:LE:32:default",
"RISCV:LE:32:default:gcc",
"RISCV:LE:64:default",
"RISCV:LE:64:default:gcc",
"SuperH4:BE:32:default",
"SuperH4:BE:32:default:default",
"SuperH4:LE:32:default",
"SuperH4:LE:32:default:default",
"SuperH4:LE:32:default:windows",
"SuperH:BE:32:SH-1",
"SuperH:BE:32:SH-1:default",
"SuperH:BE:32:SH-2",
"SuperH:BE:32:SH-2:default",
"SuperH:BE:32:SH-2A",
"SuperH:BE:32:SH-2A:default",
"TI_MSP430:LE:16:default",
"TI_MSP430:LE:16:default:default",
"TI_MSP430X:LE:32:default",
"TI_MSP430X:LE:32:default:default",
"Toy:BE:32:builder",
"Toy:BE:32:builder.align2",
"Toy:BE:32:builder.align2:default",
"Toy:BE:32:builder:default",
"Toy:BE:32:default",
"Toy:BE:32:default:default",
"Toy:BE:32:posStack",
"Toy:BE:32:posStack:posStack",
"Toy:BE:32:wordSize2",
"Toy:BE:32:wordSize2:default",
"Toy:BE:64:default",
"Toy:BE:64:default:default",
"Toy:BE:64:default:long8",
"Toy:BE:64:harvard",
"Toy:BE:64:harvard:default",
"Toy:BE:64:harvard_rev",
"Toy:BE:64:harvard_rev:default",
"Toy:LE:32:builder",
"Toy:LE:32:builder.align2",
"Toy:LE:32:builder.align2:default",
"Toy:LE:32:builder:default",
"Toy:LE:32:default",
"Toy:LE:32:default:default",
"Toy:LE:32:wordSize2",
"Toy:LE:32:wordSize2:default",
"Toy:LE:64:default",
"Toy:LE:64:default:default",
"V850:LE:32:default",
"V850:LE:32:default:default",
"V850:LE:32:v850e3v5",
"V850:LE:32:v850e3v5:default",
"Xtensa:BE:32:default",
"Xtensa:BE:32:default:default",
"Xtensa:LE:32:default",
"Xtensa:LE:32:default:default",
"avr32:BE:32:default",
"avr32:BE:32:default:default",
"avr8:LE:16:atmega256",
"avr8:LE:16:atmega256:gcc",
"avr8:LE:16:default",
"avr8:LE:16:default:gcc",
"avr8:LE:16:default:iarV1",
"avr8:LE:16:default:imgCraftV8",
"avr8:LE:16:extended",
"avr8:LE:16:extended:gcc",
"avr8:LE:24:xmega",
"avr8:LE:24:xmega:gcc",
"dsPIC30F:LE:24:default",
"dsPIC30F:LE:24:default:default",
"dsPIC33C:LE:24:default",
"dsPIC33C:LE:24:default:default",
"dsPIC33E:LE:24:default",
"dsPIC33E:LE:24:default:default",
"dsPIC33F:LE:24:default",
"dsPIC33F:LE:24:default:default",
"eBPF:BE:64:default",
"eBPF:BE:64:default:default",
"eBPF:LE:64:default",
"eBPF:LE:64:default:default",
"pa-risc:BE:32:default",
"pa-risc:BE:32:default:default",
"sparc:BE:32:default",
"sparc:BE:32:default:default",
"sparc:BE:64:default",
"sparc:BE:64:default:default",
"tricore:LE:32:default",
"tricore:LE:32:default:default",
"tricore:LE:32:tc172x",
"tricore:LE:32:tc172x:default",
"tricore:LE:32:tc176x",
"tricore:LE:32:tc176x:default",
"tricore:LE:32:tc29x",
"tricore:LE:32:tc29x:default",
"x86:LE:16:Protected Mode",
"x86:LE:16:Protected Mode:default",
"x86:LE:16:Real Mode",
"x86:LE:16:Real Mode:default",
"x86:LE:32:System Management Mode",
"x86:LE:32:System Management Mode:default",
"x86:LE:32:default",
"x86:LE:32:default:borlandcpp",
"x86:LE:32:default:borlanddelphi",
"x86:LE:32:default:clangwindows",
"x86:LE:32:default:gcc",
"x86:LE:32:default:golang",
"x86:LE:32:default:windows",
"x86:LE:64:compat32",
"x86:LE:64:compat32:gcc",
"x86:LE:64:compat32:windows",
"x86:LE:64:default",
"x86:LE:64:default:clangwindows",
"x86:LE:64:default:gcc",
"x86:LE:64:default:golang",
"x86:LE:64:default:swift",
"x86:LE:64:default:windows",
"z180:LE:16:default",
"z180:LE:16:default:default",
"z182:LE:16:default",
"z182:LE:16:default:default",
"z80:LE:16:default",
"z80:LE:16:default:default",
"z8401x:LE:16:default",
"z8401x:LE:16:default:default"
]
},
"timestamp": 49592968
}






