Read-only static analysis for Windows PE and Android. Disassembly, hidden-endpoint recovery, ATT&CK, and a built-in course. It never runs what it reads.
Windows 10/11 · 64-bit · signed auto-updates · free
Capabilities
Headers, sections and entropy, imports and exports, linear-sweep disassembly with cross-references, Authenticode integrity, ATT&CK.
Manifest, resources, DEX and reconstructed source, native libraries and JNI, certificates, permissions and attack surface.
Obfuscated strings (XOR, position-dependent XOR, base64) solved and surfaced as evidence, hidden endpoints included, with byte offsets.
An interactive reverse-engineering course, 50 lessons across foundations, PE and Android, run against real evidence with a Practice Lab.
Under the hood
Linear-sweep x86/x64 with callers, callees, and import and string references. Walk the control flow and jump straight to the bytes.
Strings a binary tried to hide are derived back with the exact transform and parameters, so a URL buried in a native library shows up as evidence you can re-derive by hand.
Imported APIs and embedded strings map to techniques the binary could perform, each with the concrete evidence that triggered it. Evidence, not attribution.
Offline Authenticode integrity for PE and v1 to v3 signing schemes for Android, with signer identity. It reports what it verified, never more.
A full course on how binaries and packages work, the toolbox, and how protections work in principle, with a benign specimen you load in a click.
Where a program appears to make auth or licence decisions is mapped with its evidence. It reports the location, it never alters or bypasses the check.
Learn
A built-in interactive course, 50 lessons from the foundations to the deep end of PE and Android, read inside the app. A Practice Lab loads a benign specimen so every step runs against something real. It teaches how protections work in principle, for defence, and never ships a way to defeat them.
Input bytes are never modified or executed. It refuses circumvention: no keygen, no auth bypass, no patching out licence or auth checks, no cracking encryption, no forging a signer, no running the analysed binary. Only analyse software you are authorised to inspect.
FAQ
Yes. All three editions are free, with no licence key and no account.
No. Files are opened as data and read on your machine. Nothing is ever executed, modified, or installed.
The installers are for Windows 10 and 11, 64-bit. The analysis engines are read-only and offline.
The all-in-one DevLune Inspector, unless you only work one platform, in which case the slim PE Inspector or APK Inspector are for you.
It is read-only by design and refuses circumvention. Only analyse software you own or are authorised to inspect.
Yes. Every build is cryptographically signed and the app checks for signed updates on launch.
Free, signed, and updating itself. Pick a build.
or open the full download pages on devlune.in