PEiD 引擎默认关闭,需要 CMake 加 -DWITH_PEID=ON 才编译相关源码;签名数据库需通过 die-update 单独下载更新,不随源码附带;只读安装时更新写入用户目录数据库,Qt 前端下次加载才优先使用

DIE-engine
horsicqMIT活跃维护一款开源的二进制文件分析引擎,能识别可执行文件类型、检测加壳与编译器特征,并支持 YARA 规则和熵值分析,常用于逆向工程与恶意软件排查。
DIE engine
cmake -DWITH_PEID=ON ...
die-update --checkREADME 未说明
Detect It Easy 的 GUI 与控制台源码,用来识别文件类型和可执行文件特征
一款开源的二进制文件分析引擎,能识别可执行文件类型、检测加壳与编译器特征,并支持 YARA 规则和熵值分析,常用于逆向工程与恶意软件排查。
核心能力
- 提供 DiE 的图形界面与控制台源码
- 可选启用 PEiD 扫描引擎,默认关闭
- 用 die-update 检查并安装签名数据库更新
- 更新前先暂存校验新 db 再替换旧库
- diec 支持 --checkupdate 与 --update 参数
容易踩的坑
- 4.0.0最新正式版2026-11-05 · 2026-11-05 05:53 UTC
Please see the file CHANGELOG for a detailed list of changes.
Asset / File Description / Host OS die_sourcecode_4.0.0.tar.gz Source code tarball Detect_It_Easy-4.0.0-x86_64.AppImage Portable version for Linux (x86_64) How to run die_4.0.0_jammy_amd64.deb Installer for Ubuntu 22.04 (x86_64) die_4.0.0_kalilinux_amd64.deb Installer for Kali Linux (x86_64) die_4.0.0_noble_amd64.deb Installer for Ubuntu 24.04 (x86_64) die_4.0.0_noble_arm64.deb Installer for Ubuntu 24.04 (ARM64) die_4.0.0_noble_ppc64el.deb Installer for Ubuntu 24.04 (PowerPC 64-bit little-endian) die_4.0.0_noble_riscv64.deb Installer for Ubuntu 24.04 (RISC-V 64-bit) die_4.0.0_noble_s390x.deb Installer for Ubuntu 24.04 (s390x) die_4.0.0_parrotos_amd64.deb Installer for Parrot OS (x86_64) detect-it-easy-4.0.0-1-x86_64.pkg.tar.zst Installer for Arch Linux (x86_64) DetectItEasy-fedora-qt5-aarch64.rpm Installer for Fedora (ARM64) DetectItEasy_4.0.0_fedora_45_amd64.rpm Installer for Fedora 45 (x86_64) DIE-engine-opensuse-qt5-aarch64.rpm Installer for openSUSE (ARM64) DIE-engine-opensuse-qt5-x86_64.rpm Installer for openSUSE (x86_64) detect-it-easy-4.0.0-nix-closure.nar.xz Package closure for Nix detect-it-easy-4.0.0.pkg Installer for FreeBSD DetectItEasy_Termux_CLI_aarch64.tar.gz Command-line version for Termux on Android (ARM64) die_4.0.0_mac_arm64_qt6.dmg Disk image for macOS (ARM64, Qt 6) die_4.0.0_mac_portable_arm64_qt6.zip Portable version for macOS (ARM64, Qt 6) die_4.0.0_mac_portable_x86_64_qt5.zip Portable version for macOS (x86_64, Qt 5) [die_4.0.0_mac_portable_x86_64_qt6.zip](https://github.com/horsicq/DIE-engine/releases/download/4.0 - Betapre-release2026-06-03 · 2026-06-03 18:23 UTC
这个版本没有写更新说明。
- 3.212026-04-21 · 2026-04-21 22:44 UTC
查看更新说明
Please see the file CHANGELOG for a detailed list of changes.
DIE library: https://github.com/horsicq/die_library Python binding: https://github.com/elastic/die-python
- 3.202026-04-21 · 2026-04-21 00:35 UTC
查看更新说明
Please see the file CHANGELOG for a detailed list of changes.
DIE library: https://github.com/horsicq/die_library Python binding: https://github.com/elastic/die-python
- 3.102024-11-03 · 2024-11-03 17:04 UTC
查看更新说明
Please see the file CHANGELOG for a detailed list of changes.
用户点评
登录用户的真实使用记录,可按版本和硬件筛选还没有人点评。第一个说出真实体验的人最有价值。
DIE-engine
GUI & console sources for Detect It Easy(DiE): https://github.com/horsicq/Detect-It-Easy/
Optional PEiD engine
The PEiD scan engine is disabled by default. Enable it for a CMake build with
-DWITH_PEID=ON; this defines USE_PEID, compiles the XPEID/peid_widget
sources, exposes the PEiD controls, and installs the peid database directory.
Packaging scripts use the matching X_WITH_PEID=ON environment switch and
forward it to CMake. With the default OFF, PEiD code, controls, help entries,
and package files are omitted.
Updating the signature database
die-update checks and installs the database published in the
current-database release. It uses the same Scan/Die/Database/Main/Path and
Scan/Die/Database/Main/UpdateUrl settings as Detect It Easy, leaves
db_custom untouched, stages and validates a new db before replacing the old
one, and writes db/die-update.ini only after the replacement succeeds.
die-update --check check only (exit 1 when an update is available)
die-update install an available update
die-update --help list paths, sources, JSON and other options
diec --checkupdate [-D path] run die-update --check and return its exit code
diec --update [-D path] run die-update and return its exit code
The GUI provides Update database beside its other main-window actions. The
operation runs in a separate process and the scan database is reloaded after a
successful update. Portable copies read die.ini beside the programs; other
copies use the native NTInfo/die settings store. Read-only installations put
updates in the per-user database folder, which the Qt frontends prefer on the
next load.
Special Thanks
