Hexvoyant v0.1 / alpha
A local binary analysis workbench for macOS. Read instructions, follow references, and find the structure inside Mach-O, PE, and ELF files. Your files stay on your machine.
Native macOS app · Built with Rust
One workbench. Three binary formats.
The workbench
Explore a recorded analysis. Real output from our own C fixture. Try the tabs, follow an address, or export the report.
The interactive snapshot is unavailable here. The verified, owned-fixture captures below remain available.
For the interactive explorer, run
python3 -m http.server 4173 --directory site
and open http://127.0.0.1:4173/.
Native app / verified captures
Captured from Hexvoyant 0.1.0 while statically inspecting the repository-owned benign fixture. The fixture was parsed, never executed. These captures show the Metagross interface in the native app, including its connected analysis views.
Presentation captures—not golden UI tests or claims of parity with established reverse-engineering suites.
Fixture SHA-256: 04b55233…a317a7ef
In your toolkit
Start with the file. Follow the evidence. Six ways to explore what your software is made of.
01 / FILE STRUCTURE
Headers, sections, imports, exports, symbols, and strings in one place.
Inspect Mach-O, PE/COFF, and ELF metadata. Every result retains its file identity, address mapping, and analysis coverage.
02 / INSTRUCTIONS
ARM64, x86, and x86-64 instructions with addresses, bytes, and references.
Jump between a call and its resolved target. Share the same virtual address and file offset across the native instruction, graph, and byte views.
03 / CONNECTIONS
Basic blocks, function graphs, and typed edges make branches easier to follow.
Explore a bounded function graph in the desktop app, with zoom, pan, and pagination. Unresolved and ambiguous references stay explicit.
04 / TWO BUILDS
Compare two builds with exact evidence and a clear match basis.
Inspect additions, removals, compatibility, fingerprints, and coverage for each input. Incomplete or ambiguous evidence remains visible.
05 / MACH-O & BUNDLES
Explore universal Mach-O files, load commands, and Apple bundle contents.
Dedicated desktop workspaces inspect accepted Mach-O slices and discover bundle candidates. Signature structure is reported separately from signer trust.
06 / CLI & MCP
A CLI, JSON and Markdown reports, and 18 typed local MCP tools.
Use bounded queries, authenticated loopback automation, saved projects, and separate annotations. Your inspected binary is never launched.
Honest scope: Hexvoyant is an early static-analysis MVP. It does not yet promise decompilation, malware verdicts, full debugger coverage, or parity with established tools.
Your next move
An early alpha for learning static analysis and inspecting authorized binaries. Start with the owned fixture; no account or file upload is needed.
01 / Browser preview
Explore a recorded analysis of our own C fixture. This website does not analyze your files; it demonstrates selected desktop concepts.
Explore the fixture02 / Native macOS app
Build the desktop from source with Rust and Xcode Command Line Tools. Python 3 builds the fixture provenance. No App Store account is needed.
Build & first-session steps03 / Help test the alpha
Try five short tasks, then keep a local feedback sheet. Nothing is submitted automatically. Share only redacted feedback with the person who invited you.
Download tester checklistUnder the hood
The code keeps parsing, interface code, automation, and future debugger access separate. Normal frontend analysis uses a supervised worker; it is not an operating-system sandbox.
Built to stay local
The static MVP has no accounts, hosted relays, or automatic uploads. Automation starts in inspect mode, and every future mutation must cross an explicit capability boundary.
The current listener rejects nonlocal peers and requires a fresh random bearer token.
Reading metadata is separate from observing a process, changing memory, or taking dangerous actions.
Requests and capability decisions belong in a reviewable session timeline.
Parser limits, deterministic fixtures, and explicit failure states are current; dedicated fuzz targets are planned next.
The journey so far
The static core and its three interfaces are implemented. Every next milestone keeps a testable exit condition instead of promising full tool parity.
Now · static evidence workflow
Owned fixtures, functions/xrefs, evidence-backed findings, exact diff, multi-slice Mach-O, bundle discovery, CLI, dedicated desktop workspaces, and authenticated local MCP.
Now · project lifecycle
Saved projects and annotations, named-stage progress, analysis profiles, paged bytes, supervised native workers, and schema-3 per-collection coverage.
Next · validation and depth
Complete browser and release-audit runs, review upstream notices, then deepen relocations/data references, debug symbols, fuzzing, and measured performance budgets.
Planned · observe
Owned development fixtures, explicit process permissions, bounded memory reads, and an append-only audit timeline.
Made to be explored
Explore the owned fixture, try the source-build alpha, and help make the first analysis session easier.