Interactive Software Analysis

Relyze lets you reverse engineer and analyze native x86, x64 and ARM software

Download Free Trial
Windows 7+ Windows 7+

Relyze 2.5 now with multi threaded analysis!

Today we are releasing Relyze 2.5 which focuses largely on performance and usability. We have added multi threaded analysis support for the majority of the analysis pipeline which generates excellent performance gains in terms of analysis duration when you analyze large binaries. For a full list of changes in this release, see the change log.

Mutli Threaded Analysis

We have added multi threaded support for the following portions of the analysis pipeline: Processing imports, processing exports, jump table analysis, indirect call analysis, function discovery and analysis, Structured Exception Handler analysis (PE binaries only), function local analysis, program counter relative analysis, static library analysis and function propagation.

The following portions of the pipeline will remain processed in serial: Processing the models structure after parsing the binaries format, symbol loading, processing the pending basic block queue, C++ exception handler analysis (PE binaries only) and several operations we call probes, such as generic code and data type discovery.

The result of this is a sizeable performance improvement, especially on larger binaries. Using a small sample amount we can begin to see the difference multi threaded analysis support makes using the below graph. Note the Y axis for duration is logarithmic in scale and not linear in order to accommodate the large spread of results within the graph, the 64-bit build of Relyze was used and the test machine had 12 CPU's.

The built in binary diffing feature also benefits from our new multi threaded support so you will see faster diffing results also.

We are enabling multi threaded analysis support across both Relyze Standard and Relyze Professional, as well as the free trial version of Relyze!

User Interface

We have used this release to address a common concern we hear from our users, in that the pinned application tab was confusing and lead to an over complex user experience. To address this we have replaced the pinned application tab with a standard main application menu which will be both intuitive and familiar.

Update Today

As always, existing users can use the built-in update feature to get this latest release. If you want to try Relyze yourself, download the free trial!

Relyze 2.4 now with integrated assembler support

Today we are releasing Relyze 2.4 which contains several new features and a number of bug fixes. For a full list of changes or to try Relyze for yourself, visit the download page.

Integrated Assembler

The main feature addition in this release is the addition of assembler support for all our existing supported architectures (x86, x64 and ARM including Thumb and Thumb2), exposed in both the UI and plugin framework. This is a great addition for patching binaries as you work and will be valuable for anything from CTF challenges to reversing dynamic obfuscation techniques and more.

Editing an existing instruction in the UI is easy, just select the instruction you want to edit and either use the keyboard shortcut 'e' or select Block -> Edit Instruction from the right click menu. As you edit the instructions assembly you will see a live encoding of the new instruction along with any error messages. This live feedback is really useful if you are working with a syntax or architecture you are not wholly familiar with.

We have also exposed the new assembler to the plugin framework, to either assemble arbitrary input in a standalone fashion via the static method Relyze::ExecutableFileModel::Instruction.assemble, or to modify some existing instructions in a model via Relyze::ExecutableFileModel.assemble.

As instructions in an analysis model are modified, the analysis is updated to reflect the changes. This can include things like adjusting a function's control flow graph, identifying new data references and so on. A new menu option to 'Export to Raw File' when right clicking an analysis tab allows you to write the binary back to disk if you need to.

Other Changes

We have added static library packages for the newly released Visual Studio 2017. Static library analysis is our solution that allows commonly linked in static library code to be identified during analysis in order to enrich the analysis and simplify the task of reverse engineering a binary.

Our PE loader has been updated to correctly parse and display the most recent additions to the IMAGE_LOAD_CONFIG_DIRECTORY structure, specifically we now parse, display and add to the analysis the new export suppression and long jump guard tables and their entries.

Another small but useful addition when loading an ELF based kernel module is the .modinfo entries are now identified and displayed in the Overview.

Download Relyze

Head on over and download our free trial! Existing users can use the builtin update feature to receive the latest version.

Relyze 2.1 with force directed layouts, custom segments and more!

Today we are releasing Relyze 2.1 with several feature additions as well as multiple bug fixes and improvements. For a full list of the changes, see the download page.  The primary feature addition is our new parallel force directed layout algorithm, which is available in the call graph view and also via the plugin framework. The below screen capture shows it in action:

Force layout are well suited for visualizing things like call graphs and it's a great addition to our existing circular and hierarchical layouts.

This release also add the ability to add custom segments to an analysis, useful if you have to manually unpack code from a binary. You can use either the UI or plugin framework to add a new segment, it only takes a few lines of code:

We are also shipping a plugin to import and export databases containing bookmarks, comments and labels for the popular debugger x64dbg. Great to help you keep your dynamic analysis in sync with your static analysis.

Head on over and download our free trial! Existing users can use the builtin update feature to receive the latest version.

Relyze 2.0 now with ARM support, Call Graphs and more!!

Today we are excited to release Relyze 2.0! The primary feature addition in this release is support for analyzing ARM (and Thumb) based ELF or PE binaries. We have also made several user interface changes for a greatly improved experience. For a full list of changes see the download page.

We now support analyzing ARM based binaries and this includes Thumb and Thumb2 support. The analysis is on par with our x86 and x64 support and includes jump table analysis, function data type analysis, stack pointer analysis, static library analysis and binary diffing support. We support automatically detecting the processor mode for binaries that switch between ARM and Thumb but you can also specify an explicit mode if you need to.

A small yet useful addition is the inclusion of a 'Perform Initial Analysis in Background' option when analyzing a binary in the GUI. This lets you drop straight to the UI so you can begin to explore a binary while the initial analysis runs in the background. Previously we blocked the UI until the initial analysis was complete but now you can start getting stuck in straight away. We have also greatly improved the performance of parallel analysis via the plugin framework for everybody with a Professional license.

We have taken the opportunity to revamp the user interface, primarily with the removal of the large pivot menu which was used to navigate between the views. We now use a more compact left aligned viewer style menu. This reclaims quite a bit of screen real estate and looks good. We have also added menu items for the plugin editor and data type manager so you can quickly bring them up when you need them.

We have completely rewritten the graph user interface subsystem from scratch and now have a DirectX based hardware accelerated graph subsystem that is buttery smooth for large graphs and has a slew of additional features on top of our existing graph feature set. This includes the ability to find nodes in a graph containing some text, which is great for poking around a large graph for some interesting information. We also added the ability to export any graph to either SVG or DOT formats so you can easily integrate with other graph tools or content.

To take full advantage of this shiny new graph subsystem we have added a ton of features to the plugin framework for generating, manipulating and laying out custom graphs from withing the plugin framework. You can then either display these custom graphs in the GUI or export them as either SVG or DOT formats. We currently expose both a circular and hierarchical layout algorithm and will be adding more in the future.

We didn't want to stop there so we have added a new viewer in the UI for quickly generating and displaying the call graph of an analysis so you can search for paths, find nodes and jump around an analysis via its call graph. Its a great addition and works best when you enable the split view (as shown in the screen shot above).

Why not give Relyze a spin and download the latest trial! Existing users can use the builtin update feature to receive the latest version.

Relyze 1.6 with ELF binary support!

Today we are excited to release Relyze 1.6! The primary feature addition in this release is support for loading, analyzing and diffing ELF binaries. For a full list of changes see the download page.

Our shiny new ELF loader is capable of loading 32-bit and 64-bit ELF relocatable, executable and shared object binaries. Embedded STAB symbols are also fully supported. We have also added a new platform 'POSIX' in addition to the existing 'Windows' platform. This lets an analysis leverage the built in export and pre compiled header symbols that are shipped with Relyze in order to help resolve function declarations and types during analysis.

Why not give Relyze a spin and download the latest trial! Existing users can use the builtin update feature to receive the latest version.

Relyze 1.5 with static library analysis, performance improvements and more!

Today we are happy to release Relyze 1.5.0 which contains a number of new features, performance improvements and bug fixes. For the full list of the changes please see the download page.

Static Library Analysis

The main addition for this release is static library analysis, which allows for the identification of statically linked library code, such as compiler run-times, during analysis. We describe a functions structural properties via static library signatures which are then grouped together and held in static library packages. During static library analysis these packages are processed via Relyze's differential analysis engine, which is really a comparison engine based on graph isomorphisims, allowing packages to be identified which contain similar functions to that of the binary being analyzed. The signatures from these packages are then matched and subsequently applied during analysis, renaming the identified functions in the binary being analyzed with their newly discovered names and flagging them as library code (As can be seen in the before and after screenshots below).

Relyze is shipping with several static library packages for some common compiler run-times, including the MSVC, PellesC, DJGPP and MinGW based compilers. We will be adding more based on customer feedback. The ability to create and apply packages is exposed via the plugin framework, allowing you to create and manage your own packages and we will touch on this in more detail in a later blog post.

Analysis Options

This release also exposes enabling or disabling several analysis features from both the GUI as well as the plugin framework. This will let you speed up the initial analysis of a binary by disabling any features you don't require.

Try Relyze for yourself and download the latest trial! Existing users can use the builtin update feature to receive the latest version.

Relyze 1.4 available and Licensing update

Today we are releasing Relyze 1.4! This release adds support for loading AR library files, loading and analyzing COFF object files and several other smaller changes and bug fixes. The full change log can be found over on the download page.

We are also taking this opportunity to make some slight changes to how we are licensing Relyze, primarily by reworking the Personal license into a Standard license which now allows for commercial usage. You can check out the full details over on the purchase page.

To try Relyze for yourself, download the latest trial. Existing users can use the builtin update feature to receive the latest version.