Binary Inspector
See how a program file you own or have the right to inspect is built: its format, architecture, sections, and the libraries and functions it uses. Free, with no sign up. Your file stays in this browser; nothing is uploaded.
Sections
| Name | Offset | File size | Address | Memory size | Access | Entropy |
|---|
This file lists no sections.
Segments
| Type | Offset | File size | Address | Memory size | Access |
|---|
Resources
| Type | Items | Size |
|---|
Libraries it loads
Imports
Exports
What a program file's structure can tell you
- Whether a download is really for your computer: Windows, Linux or Mac, Intel or ARM, 32-bit or 64-bit.
- Which libraries and system functions it uses, such as networking, files or the registry.
- Whether it carries a signature, a .NET header, or packed data with very high entropy.
- What a library offers to other programs, before you link against it.
Open only files you own or have the right to inspect. This page reads structure only; it does not run, change or unlock anything.
How to use this tool
Pick a program file you own or have the right to inspect, or try a sample. Read its format and architecture, hover the size map to see each section, and search its imports and exports.
Frequently asked questions
Is my file uploaded?
No. The page reads the file's headers and tables in small slices inside your browser, and makes no network call with it. A large program stays on your device.
Which files can it open?
Windows programs and libraries (EXE, DLL, SYS and other PE files, 32-bit and 64-bit), Linux and Android ELF files (programs, .so libraries, object files), and Mac Mach-O files, including universal binaries that hold more than one architecture.
What are sections, imports and exports?
Sections are the parts a program file is split into: code, data, resources and tables. Imports are the functions it uses from other libraries, such as CreateFileW from KERNEL32.dll. Exports are the functions it offers to other programs by name.
What does entropy tell me?
How mixed the bytes are, from 0 to 8 bits per byte. Code is usually 5 to 7, text about 4 to 5, and padding near 0. A section above 7.5 is usually compressed or encrypted, which is common in installers and packed programs.
Does it check the signature?
No. It only says whether the file carries a certificate table (Windows) or a code signature (Mac). It does not check whether the signature is valid or who made it.
Why is the link time a strange value?
Windows files store a link time, but many build tools now put a hash there so every build of the same code is byte-for-byte the same. A value far in the future or before 1990 is labelled as not a real date. ELF and Mach-O files do not store a build time.
API Tool Calls MCP
Use it from an AI agent
This tool is also an MCP tool named inspect_binary at https://apitoolcalls.com/mcp.
Agent tools are free: 20 calls a day per IP, no key needed.
Example tools/call arguments:
{"name":"inspect_binary","arguments":{"file":"f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAABBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAAAAEAAAAAAAA=="}}