Repolode
Submit
horsicq

horsicq/Detect-It-Easy

Cross-platform file identification and static analysis tool that detects file types, compilers, packers and protections in executables.

View on GitHubWebsite
Stars
11,886
Forks
996
Open issues
34
Last commit
12 hours ago

What is it?

Detect It Easy (DiE) identifies file formats and inspects executables without running them. It parses PE, ELF, Mach-O, APK, IPA, JAR, DEX and other formats, and reports the compiler, linker, language, packer or protector used to build a file, along with its version where detectable.

Detection is driven by a signature database written in DiE-JS, a scripting layer where rules can use format-aware parsing, bounded searches and disassembly primitives. A PE heuristic engine adds separately labeled findings for structural anomalies, obfuscation, anti-analysis code and suspicious traits, which are kept distinct from exact signature matches. It is not an antivirus and does not declare a file safe.

DiE ships as a GUI (die), a command-line tool for batch processing (diec), and a lightweight scanner-only GUI (diel), with builds for Windows, Linux and macOS. A DiE API library is available for developers.

Key features

  • 01Identifies file formats including PE, ELF, Mach-O, APK, IPA, JAR and DEX
  • 02Detects compilers, linkers, languages, packers and protectors from signatures
  • 03Optional PE heuristic engine reports structural anomalies and obfuscation separately from exact matches
  • 04Extensible DiE-JS scripting for writing custom detection rules
  • 05Command-line tool suitable for batch scanning

Use cases

  • Triaging unknown executables to see which compiler or packer produced them
  • Reverse engineering work that starts with identifying a binary's build toolchain
  • Malware analysis workflows that need static evidence before dynamic analysis
  • Batch-checking a set of binaries from a script or CI pipeline

Quick start

  1. 1

    Download the release from the releases page

  2. 2

    Clone the repository

Things to know

  • DiE is not an antivirus and cannot declare a file safe.
  • Heuristic results are leads that need manual verification.

In collections

Reverse engineering tools

Topics

#binary-analysis#reverse-engineering#malware-analysis#file-identification#packer-detection#static-analysis#pe-files#elf#debugger#detect

FAQ

What is Detect-It-Easy?
Cross-platform file identification and static analysis tool that detects file types, compilers, packers and protections in executables. Detect It Easy (DiE) identifies file formats and inspects executables without running them. It parses PE, ELF, Mach-O, APK, IPA, JAR, DEX and other formats, and reports the compiler, linker, language, packer or protector used to build a file, along with its version where detectable.
Is Detect-It-Easy free to use? What license does it have?
Detect-It-Easy is open source under the MIT license. Check the license terms before using it in commercial products.
Is Detect-It-Easy still maintained?
Actively maintained. The last commit to Detect-It-Easy was on Nov 6, 2026.
What can I use Detect-It-Easy for?
Triaging unknown executables to see which compiler or packer produced them Reverse engineering work that starts with identifying a binary's build toolchain Malware analysis workflows that need static evidence before dynamic analysis Batch-checking a set of binaries from a script or CI pipeline
How do I install Detect-It-Easy?
Download the release from the releases page Clone the repository
Where can I get Detect-It-Easy?
The source code and installation instructions are on GitHub: https://github.com/horsicq/Detect-It-Easy

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects