Mach-O / Universal
Per-slice architecture and ranges, headers, sections, segments, relocations, imports, exports, symbols, dylibs, entry point and signature blob.
Available for macOS, Windows & Linux
Know what’s
inside.
A native workbench for safe static triage, release comparison, and platform-aware auditing across applications, packages, archives, disk images, and binaries.
macOS Apple silicon · Windows x64 · Linux amd64 · Apache-2.0
DETAILED SUPPORT
From package identity
to the last useful byte.
Audit means platform-aware release semantics and findings. Inspect means bounded structural parsing and navigation. Identify means reliable recognition with universal search, strings, hashes, entropy, and Hex still available.
01
Applications & release packages
ArtifactLevelImplemented capabilities
macOS apps & bundlesInspect
Logical component tree, Info.plist, Mach-O slices, frameworks, dependencies, signatures, entitlements, Hardened Runtime and Gatekeeper/notarization assessment.
iOS IPAAudit
Payload app discovery, identity and versions, installed/compressed sizes, targets, frameworks, extensions, architectures, localizations, privacy manifests, provisioning, entitlements, evidence-linked findings and IPAView-compatible JSON.
Android APKAudit
Binary manifest, package/version/SDK identity, permissions, components, intent filters, deep links, DEX counts, resources, native libraries, signing indicators and release findings.
Windows APPX / MSIXAudit
Manifest identity, publisher, version, architecture, target families, normal/restricted capabilities, applications, executables, block map, package signature and findings.
Debian DEBAudit
Control identity and dependencies, installed size, payload files and modes, largest files, privileged-file checks, maintainer scripts and findings.
Apple PKG / XARInspect
Bounded table of contents, member sizes, checksums, embedded signature count and unsafe paths without launching Installer or extracting payloads.
02
Binaries, containers & data
PE / COFF
Windows executables and libraries: headers, architecture, sections, relocations, imports, exports, symbols, dependencies, entry point and Authenticode metadata.
ELF
Class, endian, architecture, interpreter, sections, segments, relocations, dynamic symbols, dependencies, entry point and build metadata.
ZIP / tar / ar
Bounded virtual member tables, sizes, modes, links, CRC data and traversal, symlink, absolute-path, expansion-ratio and expanded-size hazards.
DMG / ISO
Structure-based recognition, partitions, volume and sector metadata, compressed blocks and ratios. Images are never mounted.
Structured data
JSON, XML, binary/XML plist, SQLite headers, image dimensions, UTF-8 text and desktop-entry metadata with explicit parser limits.
Unknown files
Magic detection where possible, metadata, artifact-wide search, bounded Hex, strings, SHA-256/SHA-1/MD5 and entropy.
Identify-only
7z, RAR and standalone compressed streams are recognized, but do not yet receive full member browsing or platform-semantic audits.
03
Views, comparison & automation
Artifact Tree, Overview, Metadata, Headers, Slices, Sections and Segments.
Imports, exports, symbols, relocations, per-file dependencies and a Canvas-rendered node graph with clickable nodes and precision table.
Names, metadata, symbols, ASCII/UTF-8/UTF-16 strings and direct hexadecimal byte queries.
Read-only Hex plus a distributed entropy Area Chart and clickable heatmap that jumps directly to suspicious blocks.
Static signature data plus opt-in bounded macOS signer, entitlement, Hardened Runtime and Gatekeeper checks.
SHA-256-backed added, removed, modified and moved files; growth, duplicates and IPA privacy/signing changes.
Shared generic, IPA, Android, Windows and Linux policies with profiles, overrides and expiring suppressions.
One-click comprehensive Markdown or branded multi-page PDF analysis reports, local SVG dashboards, native window screenshots, versioned JSON, standalone HTML and SARIF; atomic files, stable exit codes and cancellation.
Resizable panels with persisted widths, saved Standard/Focus/Analysis layouts, independent windows and an optional high-contrast appearance.
Metric cards, donut/bar/area charts, treemaps, signature timelines, architecture/privacy matrices and severity filters.
INSPECTION SURFACE
One artifact.
Every useful angle.
Structure
Navigate applications, frameworks, executables, resources, archives, packages, and disk images as one logical tree.
Binary internals
Read headers, slices, sections, segments, relocations, imports, exports, symbols, dependencies, and metadata.
Content
Search artifact-wide strings and bytes, inspect mapped addresses, and move through 4 KiB hex windows on demand.
Trust signals
Read signature and provisioning timelines, architecture/privacy matrices, entropy heatmaps, dependency maps and filtered findings without executing the target.
DESIGNED FOR UNTRUSTED INPUT
Static by default.
Bounded by design.
Hexlora does not execute imported programs, mount disk images, or extract archives. Explicit limits cover parser input, recursion, file count, strings, tables, command output, and time.
- ✓ No symlink traversal during discovery
- ✓ Lazy hashing, entropy, strings, and dependency work
- ✓ Cancellable background analysis
- ✓ External tools launch only when requested
EVIDENCE, NOT PROMISES
Tested from parser
to Homebrew install.
Deterministic fixtures keep semantics stable. Pinned public artifacts exercise real packaging and trust behavior. Every distributed macOS build completes the full Apple and Homebrew release chain.
IPA, APK, MSIX, signed and corrupted apps, notarized PKG, DMG, ISO, PE, ELF, DEB, RPM, and damaged APPX cases.
Identity, targets, architectures, privacy, provisioning, entitlements, findings, and IPAView-compatible output.
The declared minimum toolchain is compiled in CI alongside stable tests, Clippy, CLI contracts, and app launch checks.
Strict code-signature verification, stapled-ticket validation, and Gatekeeper assessment run on the final archived app and again after Homebrew installation.
GET HEXLORA
Choose your
platform.
Install the native workbench or use a portable archive. Windows and Linux packages are built and verified by GitHub Actions.
WINDOWS · X64
Windows
Use the installer for a standard setup, or unzip the portable build and run it directly.
LINUX · AMD64
Linux
Install the Debian package, or extract the portable tarball on another compatible distribution.
macOS · Apple silicon · 13+
$ brew install --cask everettjf/tap/hexloraVerified: Distributed releases are Developer ID signed, Apple-notarized, and include a stapled ticket for offline Gatekeeper verification.
Optional · Command-line tool
$ brew install everettjf/tap/hexlora-cli11 interface languages
English · 简体中文 · 日本語 · 한국어 · Deutsch · Français · Español · Italiano · Português (Brasil) · Русский · Tiếng Việt
Switch languages instantly from the Language menu. Your choice is remembered across launches.