Binocular analyzes binary files across operating systems, including Windows PE, Linux ELF, and macOS Mach-O formats. This tool lets you open and examine a range of file types, including DLLs, EXEs, drivers, shared objects, and dylibs. You can easily review key components like headers, imports, exports, sections, and dependencies with precision and consistency.

What Does Binocular Do?

Binocular is a powerful tool that allows users to analyze the internal structure of various binary files, including DLLs, EXEs, drivers, and shared objects. It provides a comprehensive and user-friendly view of COFF and optional headers, data directories, and section flags, translating complex information into plain language. Users can efficiently work with import and export tables, even when handling files with tens of thousands of entries.

With Binocular, you can gain clear insights into any binary file. It parses the formats commonly used in software development—PE, ELF, and Mach-O—and presents the information in an organized, accessible way.

Binocular Can Perform Side-by-Side Comparisons

One of Binocular's standout features is the ability to compare two binary builds side by side. This functionality enables precise examination of differences, such as which exports have been added or removed, shifts in the import table, and changes across sections and headers. This feature is particularly useful for auditing updates, comparing different architectures, or vetting third-party libraries.

Recursive Dependency Tree Tracing

Additionally, Binocular allows you to trace the recursive dependency tree, complete with circular-reference detection and alerts for missing DLLs. It can decode .NET and CLR metadata, browse resource trees with previews and one-click extraction, and categorize strings for better visibility. For users who require deeper insight, Binocular offers a raw hex view of files.

Includes a Built-In Cryptographic Engine

Binocular also includes a built-in cryptographic engine that recalculates each file's Authenticode digest from its raw bytes, without Windows API calls or network access. It matches these calculated digests against the signatures sealed within the files. This functionality extends to batch processing within a folder, where users can sort by the Signature column to identify tampered files, signatures that fail verification, and certificate tables with foreign data—all of which are prioritized in the results for swift examination.

Geek Verdict

If you're looking for an efficient and accurate desktop tool to analyze the structure of Windows PE and Linux ELF binaries, Binocular is an excellent option. It delivers quick results and precise insights, making it ideal for developers and security professionals alike.