DISCOVERY · REVERSE
Syniray Reverse
Understand how software works — with evidence you can check.
Upload an app, a program, a firmware image or point to a web page you are allowed to examine. Isolated tools collect the evidence, a model writes the report, and every statement says how sure it is.
Open Syniray ReverseOverview
A report you can check, not a guess
Syniray Reverse helps you understand software you own or are allowed to examine. You give it an artifact — an app, a program, a library, a firmware image, an archive — or a website and the domains you authorise, plus a question in your own words. It works out what the artifact is from its content, plans the analysis that fits your question, runs the right tools in isolation, keeps what they find as numbered evidence, and asks the model you choose to write the report.
It is a static analysis: the artifact is read, never run. What comes back describes how the software is built and what it appears to do, with the evidence behind each statement and a plain note of how sure it is. It does not recover the original source code, and it does not help defeat licences, DRM, sign-in or other protections.
Syniray Reverse is in beta and part of the Pro and Max plans. The table further down shows exactly what was measured and what was not.
How it works
From a file to a report in six steps
The same path for every kind of artifact; what changes is which tools run.
Give it something to examine
Upload a file (up to 256 MB) or enter a website and the domains you authorise — a name outside the address’s own site name (and the names under it) also needs your proof that you control its domain (a DNS TXT record or a file on the site). Write the question you want answered and choose how deep to go: quick, standard or deep.
It is identified from its content
The type comes from the bytes, never from the file name. A program renamed to look like a picture is still recognised as a program, and the evidence records the mismatch.
The plan fits your question
Which steps run depends on what the artifact is, on your question and on the depth. The plan also lists what could not run on this server — it is never hidden.
Tools run in isolation
Each tool runs in a sandbox with no network and one folder it may write to. ZIP, TAR and ASAR archives are opened by Syniray’s own readers, which refuse unsafe entries by name.
What they find becomes evidence
Every result is kept as a numbered evidence item: its type, where it was found, which tool produced it and how sure it is. Credential-shaped values are masked in the evidence. What the tools recover — listings, declarations and their raw output — is kept in full, encrypted, and can be browsed in the Code tab.
A model writes the report
The model you choose writes the report from the evidence. Every finding cites the evidence it rests on; an id that does not exist is dropped, and a confidence the evidence cannot support is lowered.
What it can examine
From a web page to a firmware image
Each category has its own analysis. What each one produces is measured, not promised — see the table below.
Websites
Loads one page in a headless browser, through a filter that only lets the domains you authorised out, and records the requests, scripts, source maps, security headers, cookie names, storage keys and forms it sees. It signs in nowhere, clicks nothing and submits nothing.
JavaScript and Electron apps
Reads packaged apps — including Electron’s ASAR archives and zipped projects: manifests and dependencies, entry points, IPC channels, endpoints, configuration and source maps.
Android apps (APK)
Manifest, permissions, components and signing; the DEX tables read directly (every string, class and method, and the platform APIs the code references); decompiled code and resources. Flutter apps are described honestly: the engine, assets and strings, not the Dart source.
iOS and macOS apps
IPA files, app bundles, DMG and PKG installers: Info.plist, entitlements, every file of the bundle, frameworks, the Mach-O inside with its complete import, export, symbol and string tables, every Objective-C class and method with its declaration rebuilt from the runtime metadata, Swift types and — at deep depth — C-like pseudocode and disassembly of the app’s functions, within a time budget. No jailbreak, and no decryption of protected binaries.
Programs and libraries (PE, ELF, Mach-O)
Headers, sections, imports, exports, symbols, strings and functions, complete; the code around interesting strings, disassembled; and a decompilation of the most relevant functions (standard) or of every function the time budget allows (deep).
.NET assemblies
Metadata, references, every type and member, resources, the code decompiled to C# type by type — an approximation of the source, never the source itself — and, at deep depth, the IL of each type.
Firmware images
Carved into file systems and components, with the component versions found in the bytes. What can be extracted depends on the format, and the report says where it stopped.
WebAssembly, HAR, SQLite and archives
WebAssembly modules (imports, exports, functions), HAR network captures, SQLite schemas with a bounded sample of rows, and ZIP, TAR and 7z archives opened by safe readers.
Compatibility
What is measured, and where
This table is generated from the engine’s own test runs: fixtures built for the purpose were analysed with the real tools on the hosts below, and each category shows what that host answered. It is a measurement, not a promise — a tool that does not answer is shown as such.
- macOS (Apple silicon) development host — 28 of 28 fixtures passed · 11 of 11 hostile inputs contained
- Ubuntu 24.04 LTS (aarch64) server environment — 28 of 28 fixtures passed · 11 of 11 hostile inputs contained
| Category | macOS (Apple silicon) | Ubuntu 24.04 LTS (aarch64) |
|---|---|---|
| Linux programs (ELF)Headers, sections, imports, exports, symbols, strings, functions and disassembly; decompilation at deep depth. | Full4 of 4 fixtures passed46 of 46 expected facts foundDeep sample: 2 of 2 passed | Full4 of 4 fixtures passed46 of 46 expected facts foundDeep sample: 2 of 2 passed |
| Windows programs (PE)Headers, sections, imports, exports, resources, strings, functions and disassembly; decompilation at deep depth. | Full2 of 2 fixtures passed8 of 8 expected facts foundDeep sample: 1 of 1 passed | Full2 of 2 fixtures passed8 of 8 expected facts foundDeep sample: 1 of 1 passed |
| macOS programs (Mach-O)Load commands, segments, libraries, symbols, strings and functions, universal binaries included; decompilation at deep depth. | Partial2 of 2 fixtures passed28 of 28 expected facts foundDeep sample: 1 of 1 passedDid not fully run here (4)
| Partial2 of 2 fixtures passed28 of 28 expected facts foundDeep sample: 1 of 1 passedDid not fully run here (3)
|
| .NET assembliesAssembly metadata and references, types and members, resources, and decompiled C#. | Full1 of 1 fixtures passed16 of 16 expected facts foundDeep sample: 1 of 1 passed | Full1 of 1 fixtures passed16 of 16 expected facts foundDeep sample: 1 of 1 passed |
| Android (APK)Manifest, permissions, components, signing, every string, class and method in the DEX tables and the APIs they reference, decompiled code and resources, native libraries. | Full2 of 2 fixtures passed66 of 66 expected facts foundDeep sample: 1 of 1 passed | Full2 of 2 fixtures passed66 of 66 expected facts foundDeep sample: 1 of 1 passed |
| Flutter appsThe Android package as above, plus the Flutter engine and assets; the Dart snapshot is described, not decompiled. | Partial1 of 1 fixtures passed51 of 51 expected facts foundDid not fully run here (2)
| Partial1 of 1 fixtures passed51 of 51 expected facts foundDid not fully run here (2)
|
| iOS (IPA)Info.plist, entitlements, frameworks, the Mach-O inside, strings and symbols. No jailbreak, no decryption. | Partial1 of 1 fixtures passed14 of 14 expected facts foundDid not fully run here (2)
| Partial1 of 1 fixtures passed14 of 14 expected facts foundDid not fully run here (3)
|
| macOS apps, DMG, PKGApp bundles, DMG and PKG installers opened and examined like an app: Info.plist, entitlements, frameworks, the Mach-O inside. | Partial3 of 3 fixtures passed35 of 35 expected facts foundDid not fully run here (2)
| Partial3 of 3 fixtures passed35 of 35 expected facts foundDid not fully run here (3)
|
| Electron and JavaScript appsManifests and dependencies, entry points, IPC channels, endpoints, configuration and source maps; ASAR archives and zipped projects. | Partial3 of 3 fixtures passed40 of 40 expected facts foundDeep sample: 1 of 1 passedDid not fully run here (1)
| Full3 of 3 fixtures passed40 of 40 expected facts foundDeep sample: 1 of 1 passed |
| Web sitesRequests and hosts contacted, scripts, source maps, security headers, cookie names, storage keys, forms and technology fingerprints. | Full1 of 1 fixtures passed12 of 12 expected facts found | Full1 of 1 fixtures passed12 of 12 expected facts found |
| Firmware imagesFile systems and components carved from the image, the component versions found in the bytes, strings and indicators. | Partial1 of 1 fixtures passed6 of 6 expected facts foundDeep sample: 1 of 1 passedDid not fully run here (1)
| Full1 of 1 fixtures passed6 of 6 expected facts foundDeep sample: 1 of 1 passed |
| WebAssemblyModule sections, imports, exports, functions and strings. | Partial2 of 2 fixtures passed24 of 24 expected facts foundDid not fully run here (1)
| Partial2 of 2 fixtures passed24 of 24 expected facts foundDid not fully run here (1)
|
| SQLite, HAR, archivesSQLite schemas with a bounded sample of rows, HAR requests, and the contents of ZIP, TAR and 7z archives. | Full5 of 5 fixtures passed21 of 21 expected facts found | Full5 of 5 fixtures passed21 of 21 expected facts found |
How to read the table
- Full Every tool of the category answered on that host and every step of the tests ran.
- Partial The core tools answered; a tool or a step did not fully run there. It is listed in the cell, with the reason the test run recorded.
- Unavailable A core tool did not answer: the category is not offered on that host.
Tools and versions
Each tool is installed at an exact, pinned version: downloads are checked against the publisher’s checksum, and a few common tools come from the operating system’s package repository. A version below is the one the test runs reported.
| Tool | Version | What it is used for |
|---|---|---|
| rizin | 0.9.1 | Headers, sections, symbols, imports, functions and disassembly of native code. |
| Ghidra | 12.1.4 | Decompilation of the most relevant functions, at deep depth. |
| REA | 6.7.0 | Inventories and read-only inspections from a closed list of commands. |
| JADX | 1.5.6 | Decompiles Android code to Java. |
| Apktool | 3.0.3 | Decodes Android resources and the manifest. |
| ILSpy (ilspycmd) | 11.1.0.9782 | Decompiles .NET assemblies to C#. |
| .NET SDK | 10.0.402 | The .NET runtime that ILSpy needs. |
| Java (JDK) | 21.0.12.1 | The Java runtime for JADX, Apktool and Ghidra. |
| keytool | 21.0.12.1 | Reads Android signing certificates. |
| Playwright | 1.63.0 | Headless Chromium for the web collector. |
| binwalk | 3.1.0 | Finds and carves embedded content in firmware images. |
| unblob | 26.6.4 | Extracts firmware and container formats. |
| 7-Zip | macOS (Apple silicon): 26.04Ubuntu 24.04 LTS (aarch64): 23.01 | Opens 7z, DMG and other containers. |
| wasm-objdump (WABT) | macOS (Apple silicon): 1.0.42Ubuntu 24.04 LTS (aarch64): 1.0.34 | Reads WebAssembly modules. |
| SQLite | macOS (Apple silicon): 3.54.0Ubuntu 24.04 LTS (aarch64): 3.45.1 | Reads SQLite databases. |
| ipsw | 3.1.739 | Reads Apple binaries. |
| Node.js | 24.22.0 | Runs the engine and the JavaScript analysis. |
Not tested
Nothing is claimed for the environments below: no test run was recorded on them.
- Ubuntu 24.04 on x86_64. The installer supports it (pinned downloads with their checksums, or pinned sources), but the tests ran on aarch64.
Generated from the recorded runs of engine build 87465c314521.
REA
A reverse-engineering tool, on a short leash
Syniray Reverse uses REA, an open-source command-line tool for reverse engineering, pinned to an exact version.
What it adds
REA inventories an artifact and suggests next steps and, for some formats, builds a richer picture: the JavaScript application graph, the WebAssembly interface, the Android package structure, the Mach-O layout.
A closed list of read-only commands
The engine may call only commands from a fixed list, checked before a process starts. None of them runs the artifact, and any other command is refused.
Converted into the same evidence
REA’s results are mapped into the same evidence format as every other tool, with the tool and its version recorded. What REA only infers stays inferred: it is never promoted to observed.
Evidence
Every statement says how sure it is
Each piece of evidence has a type — a string, an import, an endpoint, a function, a permission, a finding — and every statement in the report carries one of five confidence classes.
Observed
Read directly from the artifact: a string, a header, a manifest entry, a recorded request.
Tool result
Produced by an analysis tool — function discovery, disassembly, decompilation. Only as good as the tool.
Inferred
Reasoned from several pieces of evidence.
Hypothesis
Plausible, but not shown by the evidence.
Undetermined
The evidence does not decide it.
The report
Written for people who have to act on it
The report is built so that you can check it, not just read it.
Your question first
It opens with the answer to the question you asked, then an overview of the artifact.
Findings with their evidence
Each finding has a category — architecture, network, permissions, privacy, secrets, security, dependencies, behaviour, data or build — a confidence class, and the ids of the evidence it rests on.
Checked against the evidence
The model’s output is not trusted. Evidence ids that do not exist are dropped, and a finding cannot claim more confidence than its evidence allows: one built on a hypothesis stays a hypothesis.
What is still unknown
Components, open questions and suggested next steps are listed apart from the findings, so what was not established is as visible as what was.
The limits of the analysis
Every report says what was examined and with which tools, and that decompiled output approximates the program and that a URL, an import or a permission shows capability, not use.
Read it, download it, trace it
The report is shown on the page and can be downloaded as Markdown; the whole analysis can be downloaded as a .zip (see the code explorer). Every claim carries the evidence ids that let you trace it back, and each id can be copied from the evidence drawer.
The code explorer
Browse what the tools recovered
Besides the report, the Code tab of an analysis lets you read what the tools recovered, with the name of the tool that produced each listing and how it was obtained.
A tree you can search
Classes, protocols, methods, functions, files, symbols and strings in a tree you can search by name and filter by kind or origin. Nothing is dropped silently: when a limit applies, the tab and the archive say which.
Each view says what it is
A listing is labelled as original (text really present in the file), decompiled, pseudocode (a C-like approximation from a native decompiler), reconstructed (declarations rebuilt from metadata, such as Objective-C headers) or disassembly. One item can show several, and none of them is presented as the original source.
The tools’ own output, verbatim
The raw output of every tool, errors included, is kept and can be read or downloaded, so a result can be checked against what the tool actually printed.
One archive of the whole analysis
A .zip with the report, the evidence, the recovered listings, the raw outputs, a manifest and a checksum for every file, built in the background and downloadable in pieces if the connection drops. The original file is included only if you ask for it.
Stored encrypted, yours alone
What the explorer shows is stored encrypted in a private folder and removed 30 days after creation or when you delete the analysis; an archive is removed 7 days after it is built. Credential-like values are masked in the evidence and in anything sent to a model; in your own listings and archive they stay as found, flagged.
Syniray Code
From understanding to building, in the same place
Reverse investigates and explains; Code builds. When the report is ready you can hand the findings you choose to Syniray Code.
A brief, not an order
You choose findings and suggested tasks, the implementation target you want (the platform that was analysed, or another) and a note. Code receives a Markdown brief and a structured analysis_context.json attached to your first message, with the evidence ids and hashes kept and the limits stated. Once the session exists, an index of the recovered code and a selection of its files, within a size budget, are also written to the project’s reverse/ folder.
You send it
Nothing runs by itself: you read the proposed first message and send it. The brief says at its top that it is evidence derived from an untrusted artifact, not instructions — and Syniray Code treats it that way: in the session that reads it, deletions and anything that touches secrets, the network, installs or files outside the project wait for your approval — and with “Ask before changes”, every command does. It goes to an agent on Syniray Cloud, never to one on your computer.
Code’s own projects and sessions
The brief opens in a Code session like any other, with the environment, model and permissions you already control there. The session is linked back to the analysis.
The artifact is not run
Neither Reverse nor the brief executes the software that was analysed. The files copied into a project come from the artifact as inert text copies (.inert appended to their names), and the project is told never to run them or to run test or build discovery over their folder.
Credits
Only the report is charged, and only what it used
The analysis tools are free during the beta. What costs credits is the model that writes the report: the one you choose among those available to your plan, at that model’s usual rate. Syniray Reverse introduces no price of its own. Before you start, the page shows the most the report can cost, and the start is refused if your balance cannot cover it.
The cost is reserved before the model is called and settled once, from what the model really used. If your credits run out before the report is written, the analysis pauses with its evidence kept; add credits and resume — nothing is run or charged twice.
Safety
Built to be safe to point at unknown software
You are asking it to open things that may be hostile. Every layer assumes they are.
Nothing you upload is ever run
The analysis is static. There is no execution, debugging, emulation or instrumentation of what you give it, on any server.
Every tool runs in a sandbox
No network, one writable folder, a scrubbed environment, limits on CPU, memory, disk and time, and the whole process tree killed on a timeout. Each step — the analysis engine and every tool it starts — also runs under limits the server’s kernel enforces on memory, processes and CPU. If a server has no sandbox, or a step’s limits cannot be set, nothing runs — there is no silent fallback.
Hostile archives are refused by name
ZIP, TAR, ASAR and gzip archives are opened by Syniray’s own readers: path traversal, absolute and drive paths, symbolic links, device files, encrypted entries, lying sizes and decompression bombs are refused and listed, not extracted — checked before a byte is inflated. Other container formats are unpacked by their own tool inside the sandbox, and what it leaves behind is checked afterwards.
A web collector on a short leash
Only the domains you authorise, only public addresses (never this server’s own or a private network’s), only ports 80, 443, 8080 and 8443, only GET and HEAD. A name outside the address’s own site name and the names under it is reached only after you have proven you control its domain. It signs in nowhere, keeps no cookie or form values and follows no redirect outside your list.
Credentials are masked at the source
A key, token or password found in an artifact is masked in the evidence (its first characters, its length and a short hash) and in everything sent to a model or to Syniray Code, so the report can say it exists without exposing it. The listings you browse and download keep the value as found, flagged, and are visible to you alone.
Your analyses are yours
Titles, questions, file names, evidence, reports, the code the tools recovered and their raw output are stored encrypted and belong to your account only; the original file is kept encrypted too, in a private folder that is not reachable from the web. You can delete an analysis at any time, and every analysis is removed 30 days after it was created. The model you choose receives excerpts of the evidence and a short summary of the code index (names and counts), never the file itself and never unmasked credential-shaped values.
Limits
What it does not do
Said plainly, so you know what to expect.
No dynamic analysis
It does not run, debug, emulate or instrument software, and it does not patch it. It shows what an artifact contains, not what it does at run time.
No original source code
Decompiled and disassembled output approximates the program and is never presented as its original source. A URL, an import or a permission shows capability, not use.
No bypassing of protections
DRM, licence checks, authentication, paywalls, bot protection and anti-tamper are described when they are seen, never defeated. A question that asks for it gets a description of how the mechanism is built, not instructions.
Hard code yields less
Packed, obfuscated or encrypted code, Flutter’s compiled Dart, FairPlay-protected iOS binaries and unusual firmware formats are described as far as the tools can see, and the report says where it stops.
It runs on Syniray’s servers
In the beta the analysis runs only in Syniray’s isolated environment.
Plans and limits
Who can use it, and how much
Syniray Reverse is part of the paid plans. The limits keep access to the analysis and the models fair for everyone.
| Who can use it, and how much | Free | Pro | Max |
|---|---|---|---|
| Syniray Reverse | Not included | Included | Included |
| Largest file | Not included | 256 MB | 256 MB |
| Analyses at the same time | Not included | 2 | 2 |
| Kept for | Not included | 30 days | 30 days |
| Domains you can authorise for a website | Not included | 5 | 5 |
What it is for
Questions people ask it
Which servers does it talk to?
List the endpoints an app or a site contacts, with the evidence for each.
What does it have access to?
Permissions, entitlements, sensitive APIs and the data an app appears to handle.
Is anything hard-coded?
Keys, tokens and credentials left in a build — reported masked, never in clear.
How is it put together?
Components, dependencies, entry points and how they fit: a map you can build on.
Questions
Frequently asked questions
What can I upload?
Programs and libraries (PE, ELF, Mach-O), Android APKs, iOS IPAs, macOS app bundles, DMG and PKG installers, .NET assemblies, Electron and JavaScript apps, firmware images, WebAssembly, HAR captures, SQLite databases and ZIP, TAR or 7z archives, up to 256 MB. You can also point it at a website. The type is decided from the content, not the name.
Does it run my file?
No. The analysis is static: the file is read by tools inside a sandbox with no network. Nothing you upload is executed.
Can it give me the original source code?
No, and it never claims to. Decompiled code is an approximation. The report separates what was observed, what a tool reported, what is inferred, what is only a hypothesis and what is undetermined.
Am I allowed to analyse any software?
Only software you own or are authorised to examine, and you confirm that before each analysis. Rules about reverse engineering differ between countries and licences, and Syniray Reverse does not give legal advice. It will not help break licences, DRM or authentication.
How does the web analysis work?
You enter an address and the domains you authorise. A headless browser loads that page once, through a filter that allows only those domains and public addresses, using plain GET requests: no sign-in, no forms, no clicking. The report describes what the page loads and how it is built.
What does it cost?
Syniray Reverse adds no price of its own. The analysis tools are free during the beta; the model that writes the report uses credits at its usual rate, and the page shows an estimate before you start.
Who can see my files and reports?
Only you. Titles, questions, evidence, reports, the recovered code and the tools’ raw output are stored encrypted, the original file sits encrypted in a private folder, and everything is removed 30 days after creation or when you delete the analysis. The model you choose receives excerpts of the evidence and a short summary of the code index, never the file itself.
Can I ask follow-up questions?
Not yet. Each analysis answers one question. For another question, start a new analysis; to build on a report, continue in Syniray Code.
What if a tool is missing or fails?
The plan lists every step that could not run, and the report says what was not examined. A missing tool never silently produces an empty result.