# kano92-dir/binkeep architecture

> Architecture diagram of the GitHub repository kano92-dir/binkeep, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kano92-dir/binkeep
- Repository: https://github.com/kano92-dir/binkeep

## Overview

binkeep is a browser-based binary triage and reverse-engineering tool. The user drops or opens a file; the app identifies supported formats, parses the binary, and presents overview and code-inspection results. Additional branches cover .NET, Android and ZIP contents, YARA, comparison, annotations, and report export or sharing. Analysis stays in the browser; the README says the file is never uploaded and the app can work offline. Some modules were not sampled, so their internal call paths are omitted where evidence is unavailable.

Main entry points: [`js/app.js`](https://github.com/kano92-dir/binkeep/blob/main/js/app.js) (Browser app), [`js/extras.js`](https://github.com/kano92-dir/binkeep/blob/main/js/extras.js) (Format reports), [`js/disasm.js`](https://github.com/kano92-dir/binkeep/blob/main/js/disasm.js) (Disassembler), [`js/parsers/pe.js`](https://github.com/kano92-dir/binkeep/blob/main/js/parsers/pe.js) (PE parser)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["App interface"]
  node_app["Browser app<br/>[app.js]"]
end

subgraph group_formats["Format parsing"]
  node_pe["PE parser<br/>[pe.js]"]
  node_elf["ELF parser<br/>[elf.js]"]
  node_macho["Mach-O parser<br/>[macho.js]"]
  node_peextra["PE resources<br/>[pe-extra.js]"]
  node_dotnet[".NET analysis<br/>[dotnet.js]"]
  node_android["Android analysis<br/>[android.js]"]
  node_zip["ZIP reader<br/>[zip.js]"]
end

subgraph group_analysis["Analysis"]
  node_analysiscore["Binary analysis<br/>[analysis.js]"]
  node_capabilities["Capability mapping<br/>[capabilities.js]"]
  node_packers["Packer detection<br/>[packers.js]"]
  node_extras["Format reports<br/>[extras.js]"]
end

subgraph group_inspection["Inspection and workflow"]
  node_disasm["Disassembler<br/>[disasm.js]"]
  node_codeanalysis["Code references<br/>[codeanalysis.js]"]
  node_cfg["Control-flow graphs<br/>[cfg.js]"]
  node_findmain["Main discovery<br/>[findmain.js]"]
  node_yara["YARA scanning<br/>[yara.js]"]
  node_diff["File comparison<br/>[diff.js]"]
  node_notes["Analyst notes<br/>[notes.js]"]
  node_palette["Command palette<br/>[palette.js]"]
  node_report["Report export<br/>[report.js]"]
end

node_user(("File analyst"))

node_user -->|"opens file"| node_app
node_app -->|"detects and parses"| node_pe
node_app -->|"detects and parses"| node_elf
node_app -->|"detects and parses"| node_macho
node_app -->|"uses API flags"| node_analysiscore
node_app -->|"creates disassembler"| node_disasm
node_app -->|"parses DEX"| node_android
node_app -->|"runs rules"| node_yara
node_app -->|"analyzes assemblies"| node_dotnet
node_app -->|"reads PE extras"| node_peextra
node_app -->|"handles archives"| node_zip
node_app -->|"builds format reports"| node_extras
node_app -->|"detects packers"| node_packers
node_app -->|"analyzes code"| node_codeanalysis
node_app -->|"finds main"| node_findmain
node_app -->|"exports reports"| node_report
node_app -->|"compares files"| node_diff
node_app -->|"saves annotations"| node_notes
node_app -->|"offers navigation"| node_palette
node_app -->|"maps behaviors"| node_capabilities
node_macho -->|"uses hex helper"| node_pe
node_elf -->|"uses hex helper"| node_pe
node_peextra -->|"calculates entropy"| node_analysiscore
node_extras -->|"reads entries"| node_zip
node_extras -->|"parses manifest and DEX"| node_android
node_extras -->|"links techniques"| node_capabilities
node_extras -->|"categorizes strings"| node_analysiscore
node_findmain -->|"resolves operands"| node_disasm
node_codeanalysis -->|"uses disassembly"| node_disasm
node_cfg -->|"uses disassembly"| node_disasm

click node_app "https://github.com/kano92-dir/binkeep/blob/main/js/app.js"
click node_pe "https://github.com/kano92-dir/binkeep/blob/main/js/parsers/pe.js"
click node_elf "https://github.com/kano92-dir/binkeep/blob/main/js/parsers/elf.js"
click node_macho "https://github.com/kano92-dir/binkeep/blob/main/js/parsers/macho.js"
click node_peextra "https://github.com/kano92-dir/binkeep/blob/main/js/parsers/pe-extra.js"
click node_dotnet "https://github.com/kano92-dir/binkeep/blob/main/js/dotnet.js"
click node_android "https://github.com/kano92-dir/binkeep/blob/main/js/android.js"
click node_zip "https://github.com/kano92-dir/binkeep/blob/main/js/zip.js"
click node_analysiscore "https://github.com/kano92-dir/binkeep/blob/main/js/analysis.js"
click node_capabilities "https://github.com/kano92-dir/binkeep/blob/main/js/capabilities.js"
click node_packers "https://github.com/kano92-dir/binkeep/blob/main/js/packers.js"
click node_extras "https://github.com/kano92-dir/binkeep/blob/main/js/extras.js"
click node_disasm "https://github.com/kano92-dir/binkeep/blob/main/js/disasm.js"
click node_codeanalysis "https://github.com/kano92-dir/binkeep/blob/main/js/codeanalysis.js"
click node_cfg "https://github.com/kano92-dir/binkeep/blob/main/js/cfg.js"
click node_findmain "https://github.com/kano92-dir/binkeep/blob/main/js/findmain.js"
click node_yara "https://github.com/kano92-dir/binkeep/blob/main/js/yara.js"
click node_diff "https://github.com/kano92-dir/binkeep/blob/main/js/diff.js"
click node_notes "https://github.com/kano92-dir/binkeep/blob/main/js/notes.js"
click node_palette "https://github.com/kano92-dir/binkeep/blob/main/js/palette.js"
click node_report "https://github.com/kano92-dir/binkeep/blob/main/js/report.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app toneBlue
class node_pe,node_elf,node_macho,node_peextra,node_dotnet,node_android,node_zip toneAmber
class node_analysiscore,node_capabilities,node_packers,node_extras toneMint
class node_disasm,node_codeanalysis,node_cfg,node_findmain,node_yara,node_diff,node_notes,node_palette,node_report toneRose
class node_user toneIndigo
```

## Components

### App interface

- [Browser app](https://github.com/kano92-dir/binkeep/blob/main/js/app.js): `js/app.js`

### Format parsing

- [PE parser](https://github.com/kano92-dir/binkeep/blob/main/js/parsers/pe.js): `js/parsers/pe.js`
- [ELF parser](https://github.com/kano92-dir/binkeep/blob/main/js/parsers/elf.js): `js/parsers/elf.js`
- [Mach-O parser](https://github.com/kano92-dir/binkeep/blob/main/js/parsers/macho.js): `js/parsers/macho.js`
- [PE resources](https://github.com/kano92-dir/binkeep/blob/main/js/parsers/pe-extra.js): `js/parsers/pe-extra.js`
- [.NET analysis](https://github.com/kano92-dir/binkeep/blob/main/js/dotnet.js): `js/dotnet.js`
- [Android analysis](https://github.com/kano92-dir/binkeep/blob/main/js/android.js): `js/android.js`
- [ZIP reader](https://github.com/kano92-dir/binkeep/blob/main/js/zip.js): `js/zip.js`

### Analysis

- [Binary analysis](https://github.com/kano92-dir/binkeep/blob/main/js/analysis.js): `js/analysis.js`
- [Capability mapping](https://github.com/kano92-dir/binkeep/blob/main/js/capabilities.js): `js/capabilities.js`
- [Packer detection](https://github.com/kano92-dir/binkeep/blob/main/js/packers.js): `js/packers.js`
- [Format reports](https://github.com/kano92-dir/binkeep/blob/main/js/extras.js): `js/extras.js`

### Inspection and workflow

- [Disassembler](https://github.com/kano92-dir/binkeep/blob/main/js/disasm.js): `js/disasm.js`
- [Code references](https://github.com/kano92-dir/binkeep/blob/main/js/codeanalysis.js): `js/codeanalysis.js`
- [Control-flow graphs](https://github.com/kano92-dir/binkeep/blob/main/js/cfg.js): `js/cfg.js`
- [Main discovery](https://github.com/kano92-dir/binkeep/blob/main/js/findmain.js): `js/findmain.js`
- [YARA scanning](https://github.com/kano92-dir/binkeep/blob/main/js/yara.js): `js/yara.js`
- [File comparison](https://github.com/kano92-dir/binkeep/blob/main/js/diff.js): `js/diff.js`
- [Analyst notes](https://github.com/kano92-dir/binkeep/blob/main/js/notes.js): `js/notes.js`
- [Command palette](https://github.com/kano92-dir/binkeep/blob/main/js/palette.js): `js/palette.js`
- [Report export](https://github.com/kano92-dir/binkeep/blob/main/js/report.js): `js/report.js`

### Other components

- **File analyst**

## Connections

- File analyst → Browser app: opens file (evidence: `README.md`)
- Browser app → PE parser: detects and parses (evidence: `js/app.js`)
- Browser app → ELF parser: detects and parses (evidence: `js/app.js`)
- Browser app → Mach-O parser: detects and parses (evidence: `js/app.js`)
- Browser app → Binary analysis: uses API flags (evidence: `js/app.js`)
- Browser app → Disassembler: creates disassembler (evidence: `js/app.js`)
- Browser app → Android analysis: parses DEX (evidence: `js/app.js`)
- Browser app → YARA scanning: runs rules (evidence: `js/app.js`)
- Browser app → .NET analysis: analyzes assemblies (evidence: `js/app.js`)
- Browser app → PE resources: reads PE extras (evidence: `js/app.js`)
- Browser app → ZIP reader: handles archives (evidence: `js/app.js`)
- Browser app → Format reports: builds format reports (evidence: `js/app.js`)
- Browser app → Packer detection: detects packers (evidence: `js/app.js`)
- Browser app → Code references: analyzes code (evidence: `js/app.js`)
- Browser app → Main discovery: finds main (evidence: `js/app.js`)
- Browser app → Report export: exports reports (evidence: `README.md`)
- Browser app → File comparison: compares files (evidence: `README.md`)
- Browser app → Analyst notes: saves annotations (evidence: `README.md`)
- Browser app → Command palette: offers navigation (evidence: `README.md`)
- Browser app → Capability mapping: maps behaviors (evidence: `README.md`)
- Mach-O parser → PE parser: uses hex helper (evidence: `js/parsers/macho.js`)
- ELF parser → PE parser: uses hex helper (evidence: `js/parsers/elf.js`)
- PE resources → Binary analysis: calculates entropy (evidence: `js/parsers/pe-extra.js`)
- Format reports → ZIP reader: reads entries (evidence: `js/extras.js`)
- Format reports → Android analysis: parses manifest and DEX (evidence: `js/extras.js`)
- Format reports → Capability mapping: links techniques (evidence: `js/extras.js`)
- Format reports → Binary analysis: categorizes strings (evidence: `js/extras.js`)
- Main discovery → Disassembler: resolves operands (evidence: `js/findmain.js`)
- Code references → Disassembler: uses disassembly (evidence: `js/codeanalysis.js`)
- Control-flow graphs → Disassembler: uses disassembly (evidence: `js/cfg.js`)