AegisRE

Going to do a lot of rework for this one

AegisRE — offline binary analysis, with its evidence attached

• Separates fact from guess. Everything decoded from the file is kept apart from everything inferred — every conclusion carries the evidence it rests on, so you can disagree in one step instead of trusting a black box.

• Zero dependencies. The engine ships its own SHA-256, JSON, DEFLATE and SAT solver. Builds and runs air-gapped. No supply chain to vet before pointing it at something you don't trust.

• Reads what you actually get: PE, ELF, Mach-O, .NET, Java, scripts — stripped or not. Function recovery comes from the unwind tables, so it works with no symbols.

• Reads and runs. Static analysis says what a program can do; the live debugger says what it did — syscalls, network, unpacking — with conditional breakpoints, stepping and call stacks, contained by the kernel or inside a throwaway VM.

• Same addresses both sides. A function the tracer reports is the number the decompiler takes.