Linear sweep lands you in the middle of a subroutine you didn't write. The decompiler, set to C output, renames a stub to sub_100003f80 and marks an indirect call you need to trace backward. The entropy graph shows a dense block right after the __stubs section.
Switch to the HLIL view and click through to the call site. Back-tab into the caller. The graph renders a single decision node before the branch you care about. You rename the flag, retype the argument, and the decompiled output collapses three dead paths into one readable line. The analysis finishes locally. No telemetry, no cloud.
The extension manager loads a Python snippet that dumps cross-references to a plain text list. You save the annotated database and close the workspace. The binary gave up its entry point logic in under twenty minutes.
Extension Manager
Version 6.0 replaced the old Plugin Manager with the Extension Manager. You install, update, and remove extensions from one panel. The interface keeps fewer tabs open.
The MCP server arrived. External tools can query the analysis database over a local socket. A headless session exposes function names, types, and cross-references without touching the GUI. Scripts that ran inside the Python console now run from outside, too.
Binary Similarity lands on the right-click menu. Select a function, pick Find Similar Functions, and the platform ranks matches across the loaded binary or another database. Malware analysts spot reused routines without diffing hex dumps.
HLIL gained structure initializers. A stack variable typed as a struct now decompiles with field assignments inline. You read the initialization without switching to disassembly view.
Calling convention handling was refactored. Fewer mismatched arguments show up when you flip between calling conventions on ARM or x86 targets. Memory usage dropped on large databases. The TMS320C6x architecture joined the supported list.
Before you load a binary
Does the decompiler output full C? It emits C-like pseudocode, plus BNIL. The output is meant for analysis, not recompilation. You switch between four IL levels as you narrow a question. HLIL reads like terse C. MLIL shows raw control flow.
Can I patch without leaving the tool? Yes. Edit assembly, type raw hex, or compile C with the built-in SCC compiler. Patches apply to the database. Export a patched binary when you finish.
Will it handle a stripped Mach-O from an older macOS? The PE, Mach-O, and ELF loaders parse headers and create symbols where signatures exist. For stripped files, you start with the entry point and work outward. The entropy graph flags packed or encrypted sections before you scroll through hex.
One hour with a suspicious kext
A kernel extension arrives without source. You load it cold. The entropy graph spikes near offset 0x3a00. You scroll there; the hex editor shows high-density bytes that disassembly skips. A packed block.
You mark the section, apply a comment, and move to the init routine. The decompiler names two callbacks. You rename the second one and type its struct argument. The cross-reference panel surfaces a single caller outside the kext binary—an I/O registry hook.
You run binary similarity on the hook function. The platform returns a 94% match from a malware sample you analyzed last month. You annotate the match, export the analysis database, and hand off the finding. No symbol table required.
