DevLune · Static analysis · Windows

Read the binary. Never run it.

Read-only static analysis of Windows PE/COFF binaries — headers, sections, entropy, imports and exports, disassembly, strings, hidden URLs and MITRE ATT&CK mapping. The binary is read as data, never executed.

Download v2.0.0

Windows 10/11 · 64-bit · 6.4 MB · released 1 September 2026 · updates itself

The binary is opened as bytes and never executed, modified, or sent anywhere. Analysis is entirely offline.

Three editions, one codebase

All-in-oneDevLune Inspector

Both engines and every Learn track. Start here.

View
Windows onlyPE Inspector

PE/COFF analysis and the PE Learn track. Slim.

You're here
Android onlyAPK Inspector

APK analysis and the Android Learn track. Slim.

View

What it examines

Headers
DOS, COFF and optional headers
Sections & entropy
Packed-region flags per section
Imports & exports
Linked APIs and exposed symbols
Disassembly
Linear sweep with cross-references
Strings & resources
Embedded data, classified
Hidden endpoints
Obfuscated URLs recovered as evidence
Authenticode
Offline signature integrity
MITRE ATT&CK
Techniques mapped to evidence

What's new

v2: the full PE workstation and an expanded Learn track

v2.0.0 · 1 September 2026 · 6.4 MB
  • Full workstation: disassembly, cross-references, decision points, ATT&CK, signature and triage, recovered strings, hex, rules, sessions
  • Expanded Learn PE track (16 lessons) with a Practice Lab that loads a real specimen
  • Shared design with the DevLune Inspector: five themes, command palette, reactive settings
  • Signed auto-updates; read-only, never executed

All versions

  1. v2.0.0Latest1 September 2026 · 6.4 MB

    v2: the full PE workstation and an expanded Learn track

    • Full workstation: disassembly, cross-references, decision points, ATT&CK, signature and triage, recovered strings, hex, rules, sessions
    • Expanded Learn PE track (16 lessons) with a Practice Lab that loads a real specimen
    • Shared design with the DevLune Inspector: five themes, command palette, reactive settings
    • Signed auto-updates; read-only, never executed
    Download v2.0.0
  2. v0.1.01 September 2026 · 4.8 MB

    First release

    • Read-only static analysis of Windows PE/COFF binaries, the file is read as data, never executed or modified
    • Sections & entropy, imports/exports, linear-sweep disassembly with cross-references, strings, resources and debug/PDB info
    • Recovers strings the binary stored obfuscated (constant/position-dependent XOR, base64), hidden endpoints surface as evidence with byte offsets
    • Auth/license decision-point mapping, MITRE ATT&CK heuristics, offline Authenticode integrity, YARA-style rules
    • Signed auto-updates, light/dark themes, command palette, and a full accessibility pass
    Download v0.1.0

Every build is cryptographically signed; the app verifies each update before installing. Windows SmartScreen may still warn on a new release; choose More info, then Run anyway.

Crafted in the dark. Shipped to the world.

Tell us what you are building. You get a private project space with a proposal and a line-by-line quote within a day.

Start a projectsidharth@devlune.in