How kano92-dir/binkeep works
binkeep is a browser-based binary triage and reverse-engineering tool. The user drops or opens a file; the app identifies supported formats, parses the binary, and presents overview and code-inspection results. Additional branches cover .NET, Android and ZIP contents, YARA, comparison, annotations, and report export or sharing. Analysis stays in the browser; the README says the file is never uploaded and the app can work offline. Some modules were not sampled, so their internal call paths are omitted where evidence is unavailable.
Main entry points: app.js Browser app · extras.js Format reports · disasm.js Disassembler · pe.js PE parser
Components 22
App interface
- Browser app
js/app.js
Format parsing
- PE parser
js/parsers/pe.js - ELF parser
js/parsers/elf.js - Mach-O parser
js/parsers/macho.js - PE resources
js/parsers/pe-extra.js - .NET analysis
js/dotnet.js - Android analysis
js/android.js - ZIP reader
js/zip.js
Analysis
- Binary analysis
js/analysis.js - Capability mapping
js/capabilities.js - Packer detection
js/packers.js - Format reports
js/extras.js
Inspection and workflow
- Disassembler
js/disasm.js - Code references
js/codeanalysis.js - Control-flow graphs
js/cfg.js - Main discovery
js/findmain.js - YARA scanning
js/yara.js - File comparison
js/diff.js - Analyst notes
js/notes.js - Command palette
js/palette.js - Report export
js/report.js
Other components
- File analyst
Connections 30
- File analyst → Browser app: opens file
README.md - Browser app → PE parser: detects and parses
js/app.js - Browser app → ELF parser: detects and parses
js/app.js - Browser app → Mach-O parser: detects and parses
js/app.js - Browser app → Binary analysis: uses API flags
js/app.js - Browser app → Disassembler: creates disassembler
js/app.js - Browser app → Android analysis: parses DEX
js/app.js - Browser app → YARA scanning: runs rules
js/app.js - Browser app → .NET analysis: analyzes assemblies
js/app.js - Browser app → PE resources: reads PE extras
js/app.js - Browser app → ZIP reader: handles archives
js/app.js - Browser app → Format reports: builds format reports
js/app.js - Browser app → Packer detection: detects packers
js/app.js - Browser app → Code references: analyzes code
js/app.js - Browser app → Main discovery: finds main
js/app.js - Browser app → Report export: exports reports
README.md - Browser app → File comparison: compares files
README.md - Browser app → Analyst notes: saves annotations
README.md - Browser app → Command palette: offers navigation
README.md - Browser app → Capability mapping: maps behaviors
README.md - Mach-O parser → PE parser: uses hex helper
js/parsers/macho.js - ELF parser → PE parser: uses hex helper
js/parsers/elf.js - PE resources → Binary analysis: calculates entropy
js/parsers/pe-extra.js - Format reports → ZIP reader: reads entries
js/extras.js - Format reports → Android analysis: parses manifest and DEX
js/extras.js - Format reports → Capability mapping: links techniques
js/extras.js - Format reports → Binary analysis: categorizes strings
js/extras.js - Main discovery → Disassembler: resolves operands
js/findmain.js - Code references → Disassembler: uses disassembly
js/codeanalysis.js - Control-flow graphs → Disassembler: uses disassembly
js/cfg.js