Altumptic
Contact

ALT-11 · Release · Reverse engineering platform

Paranoia

An open, local-first reverse engineering platform: disassembly, control-flow graphs, pseudocode and cross references for PE, ELF and Mach-O, on a Rust engine. No accounts, no telemetry, no network access — binaries never leave your machine.

Download v0.1.1 Source on GitHubALT-12 · Everything is reversible now
Status
Early · v0.1.1
Released
15 Oct 2026
Runs on
Windows (installer, portable) · any modern browser (WebAssembly) · command line
Built with
Rust · React · TypeScript · Electron
License
Apache-2.0
Formats
PE / PE32+ · ELF · Mach-O, including universal binaries
Architectures
x86 · x86-64 · AArch64
Privacy
No accounts, no telemetry, no network access

Architecture

Untrusted input
Your machine — nothing uploaded

1BinaryPE · ELF · Mach-O

Every file is treated as hostile. Loaders never trust sizes or offsets, analysis has hard limits, and the parsers are fuzzed with mutated real binaries so a corrupted file cannot make them panic.

Fig. 1 A hostile file in, analysis out — and nothing leaves the machine. Select a component for details.

Problem and approach

Problem

The standard reverse engineering tools are expensive and closed, and many newer ones want your binaries in their cloud. For a malware sample, a client binary or unreleased firmware, uploading the file is often the one thing you cannot do.

Approach

A pure-Rust engine that treats every file as hostile, runs in its own process and has no network access — the same engine behind the desktop app, a command-line tool and a WebAssembly build that runs entirely in the browser.

What it does

Formats
PE and PE32+ with .NET detection, forwarders and TLS callbacks; ELF with PLT/GOT imports; Mach-O with universal binaries and chained fixups.
Auto-analysis
Recursive-descent function discovery seeded by entry points, exports, symbols and exception tables, with basic blocks and no-return awareness.
Listing & graph
IDA-style labels, jump arrows and clickable operands; a control-flow graph with true, false and unconditional edges.
Pseudocode
An x86/x64 lifter with calling-convention arguments, folded conditions, if and do-while structuring and stack variables.
Search & patch
Byte patterns with wildcards, text and immediates; a hex view with in-place patching and “save patched file”.
Triage
MD5, SHA-1, SHA-256 and imphash, an entropy map, and checksec-style mitigations: ASLR, DEP, CFG, RELRO, PIE, canaries.
Interop
MSVC, Itanium and Rust demangling; names and comments saved per file hash; export to an IDA IDC script.

From the command line

The same engine is a scriptable CLI — handy in CI or when triaging many files at once.

paranoia info sample.exe
paranoia functions sample.exe
paranoia disasm sample.exe --at main -n 40
paranoia pseudo sample.exe main
paranoia xrefs sample.exe CreateFileW
paranoia strings --referenced sample.exe --json

What comes next

  1. Data definitions — undefine, make data and strings, switch tables, typed globals.
  2. Decompiler v2 — SSA-based expression propagation, variable recovery, for / switch structuring.
  3. Signatures and debug info — FLIRT-style library matching, PDB and DWARF symbols.
  4. Scripting — embedded Python and JS against the engine API.
  5. An optional AI assistant that runs locally (Ollama, LM Studio) or with your own key. Nothing leaves the machine unless you opt in.

From the public roadmap, in its order. Why a local-first tool matters now is the subject of ALT-12.

Known limits

  • No debugger, scripting, type libraries or FLIRT-style signatures yet — all tracked in the public roadmap.
  • Pseudocode is an x86/x64 lifter with if and do-while structuring, not yet a full decompiler.
  • Switch and jump tables are not recovered yet; an indirect jump ends a block.
  • Windows builds are not code-signed yet, so SmartScreen may ask for confirmation on first launch.

Official channels

Anything not listed here, or on this site, does not speak for Paranoia.