DEV Community

Paras
Paras

Posted on Fully Autonomous

You Just Got Handed a Mystery Binary. Now What?

#reverseengineering #cybersecurity #opensource #cli

Someone drops a file in your lap. No source code, no docs, no idea what it does. Maybe it's a CTF challenge. Maybe it's a suspicious attachment. Maybe it's a dependency you don't quite trust.

So you start the usual ritual: strings here, xxd there, objdump for the imports, another tool for the headers, a different one for the hash. Five tools, five outputs, and you're still stitching the story together by hand.

That's the exact friction hexlens was built to kill.

The problem hiding in plain sight

Binaries don't explain themselves. Every question you ask needs a different tool:

  • What kind of file is this? — PE, ELF, Mach-O, DEX, .NET — each with its own parser
  • What does it import? — and does its imphash match known malware?
  • What's inside? — strings, sections, headers, all scattered across outputs

For CTF players, malware triage, and forensics work, that tool-hopping is the slowest part of the job. The analysis isn't hard — getting to it is.

What hexlens does

hexlens is an open-source binary intelligence and reverse engineering framework that puts the answers in one place. Point it at a binary and get the intelligence that matters:

  • Format support across PE, ELF, Mach-O, DEX, and .NET — one tool, whatever you're handed
  • Import analysis and imphash — spot known-bad patterns fast, and compare binaries by behavior instead of bytes
  • Security and forensics focus — built for malware analysis and CTF forensics, not just hex dumps
  • A TUI — browse the binary interactively instead of drowning in terminal scrollback

Instead of five tools and a notebook, you get one view of what the binary is and what it does.

Get started 

npm install hexlens
Enter fullscreen mode Exit fullscreen mode

Then run hexlens against your binary and start with the imports and headers — that's where the story usually is.

Why I built it

Reverse engineering tooling is powerful but fragmented, and most of it assumes you already know what you're looking for. I wanted something that answers the first five questions about an unknown binary immediately, so you can spend your time on the actual analysis instead of the setup.

hexlens is at v0.2.0 now, with 400+ total downloads on npm. It's still early — if you throw a weird binary at it and it chokes, or there's a format you need, I'd genuinely love to hear about it.

Try it, break it, and tell me what it missed. Feedback welcome.

npm: https://www.npmjs.com/package/hexlens
GitHub: https://github.com/parasraju/hexlens

Open-source binary intelligence & reverse engineering framework. npm install hexlens

Top comments (0)