This browser opens the full macOS kernel and driver database read-only. Use the analysis-layer selector to choose a binary and its decompiler or reference evidence.

Follow the evidence

Function ownership uses exact ranges, including detached tails. An address in a gap is not treated as part of a function. Call counts distinguish repeated sites; unresolved targets open an address view.

Keep layers separate

A function address can have different identities in different analysis layers. Switching layers looks for the current address in the selected layer without merging their facts.

Freshness and artifacts

After imports, derived call graphs and statistics need rebuilding. A stale banner means the graph needs refresh. Artifact producer, configuration and context hashes remain visible so different outputs are not mistaken for the same result.

Search and scale

Name and content search work even before the FTS index is populated. Lists and disassembly are paginated. All 64-bit addresses remain hexadecimal strings.

Read-only API documentation ↗