ANALYSIS FORENSIC EXECUTABLE

Executable Inspector

Drop in a Windows EXE/DLL, a Linux ELF binary, or a macOS Mach-O that won't run. This walks the real PE, ELF, or Mach-O header structure — architecture, entry point, sections/segments, and library dependencies — and flags exactly where the file is truncated, malformed, or built for a different platform than you're running it on.

File

Common error messages this diagnoses

If you're here because something threw one of these, this tool shows you exactly what's wrong and how much is recoverable:

  • "This app can't run on your PC" — (Windows) — usually a wrong-architecture PE (e.g. ARM64 binary on x86) or a corrupted header; this tool reads the real machine type.
  • "is not a valid Win32 application" — (Windows, classic wording) — the MZ stub is present but the PE signature or optional header is missing or malformed.
  • "cannot execute binary file: Exec format error" — (Linux/bash) — the ELF header's class, machine type, or magic bytes don't match what the OS expects.
  • "bad ELF interpreter: No such file or directory" — (Linux) — the dynamic linker path recorded in the PT_INTERP segment doesn't exist; this tool reads that exact path.
  • "Bad CPU type in executable" — (macOS) — the Mach-O (or one slice of a universal binary) was built for a different CPU architecture than the Mac running it.

What this tool doesn't do

This reads real header structures — it doesn't disassemble code, resolve individual imported/exported function names (PE import DLL names are listed, but not the functions inside them), verify a PE checksum or Authenticode/code-signing signature, parse ELF symbol tables, or decode Mach-O LC_UNIXTHREAD entry points (only the newer LC_MAIN). For a Mach-O universal (fat) binary, each contained architecture slice is listed with its own offset/size and can be downloaded separately, but isn't parsed further — run the extracted slice back through this tool. For byte-level inspection beyond what's shown here, use Binary Structure Viewer or Hex Damage Map.