Detect-It-Easy

![](docs/logo_text.png)

[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=NF3FBD3KHMXDN)
[![GitHub tag (latest SemVer)](https://img.shields.io/github/tag/horsicq/DIE-engine.svg)](http://ntinfo.biz)
[![GitHub All Releases](https://img.shields.io/github/downloads/horsicq/DIE-engine/total.svg)](http://ntinfo.biz)
[![gitlocalized](https://gitlocalize.com/repo/4736/whole_project/badge.svg)](https://github.com/horsicq/XTranslation)

**Detect It Easy (DiE)** is a cross-platform tool for file identification and static inspection, used by **malware analysts**, **cybersecurity experts**, and **reverse engineers**. It combines native format parsers with an extensible DiE-JS analysis layer, supporting both compact signatures and multi-stage static analysis across **Windows, Linux, and MacOS**.

## 🚀 Getting started

-   **[💎 Download release/beta](https://github.com/horsicq/DIE-engine/releases)**
-   **[🧪 DiE API Library (for Developers)](https://github.com/horsicq/die_library)**
-   [📋 Changelog](https://github.com/horsicq/Detect-It-Easy/blob/master/changelog.txt)
-   [💬 Contribute to Translations](https://github.com/horsicq/XTranslation)

> [!WARNING]
> `detectiteasy.com` is not affiliated with the Detect It Easy project or its official website. Do not trust it as an official source or use it to download DiE. Use only the release links provided in this repository.

![Screenshot](docs/1.png)

## 💡 Why use Detect It Easy?

Detect It Easy combines format-aware parsing, signature matching, and programmable analysis for **malware analysis**, **reverse engineering**, and **digital forensics**. DiE-JS modules can use parsed structures and low-level inspection primitives to implement bounded algorithms while keeping detection policy reviewable in the database.

![Screenshot](docs/2.png)

### Key advantages:

-   **Extensible Analysis Modules**: DiE-JS supports compact signatures as well as stateful, format-aware algorithms.
-   **Cross-Platform Support**: Runs on Windows, Linux, and MacOS.
-   **Conservative Heuristics**: Independent evidence, architecture gates, bounded scans, and explicit antipatterns help control false positives.

## 🧠 Heuristic engine

### PE heuristic engine: analysis beyond a signature match

A signature can tell you what a file resembles. The [Generic Heuristic Analysis engine (`__GenericHeuristicAnalysis_By_DosX.7.sg`)](db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg) goes further: it reports concrete structural and behavioral anomalies together with the evidence behind them. The PE heuristic engine is created and maintained by [DosX](https://github.com/DosX-dev).

> [!NOTE]
> DiE-JS is the implementation language of this analysis engine, not a shorthand for a few native detector calls. The native DiE core supplies format parsing, bounded reads, address translation, searching, and disassembly primitives. The PE heuristic engine builds analysis algorithms on