DIE-engine

horsicqMIT活跃维护

一款开源的二进制文件分析引擎,能识别可执行文件类型、检测加壳与编译器特征,并支持 YARA 规则和熵值分析,常用于逆向工程与恶意软件排查。

DIE engine

4.0.0发布于 2026-11-05 05:53 UTC3,350star +5 / 7 天414fork同步于 2026-11-10 17:42 UTC

怎么上手

由 README 提炼,执行前请确认
cmake -DWITH_PEID=ON ...
die-update --check
硬件要求按 README 说明

README 未说明

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

由 README 自动翻译提炼

Detect It Easy 的 GUI 与控制台源码,用来识别文件类型和可执行文件特征

一款开源的二进制文件分析引擎,能识别可执行文件类型、检测加壳与编译器特征,并支持 YARA 规则和熵值分析,常用于逆向工程与恶意软件排查。

核心能力

  • 提供 DiE 的图形界面与控制台源码
  • 可选启用 PEiD 扫描引擎,默认关闭
  • 用 die-update 检查并安装签名数据库更新
  • 更新前先暂存校验新 db 再替换旧库
  • diec 支持 --checkupdate 与 --update 参数

容易踩的坑

PEiD 引擎默认关闭,需要 CMake 加 -DWITH_PEID=ON 才编译相关源码;签名数据库需通过 die-update 单独下载更新,不随源码附带;只读安装时更新写入用户目录数据库,Qt 前端下次加载才优先使用

内容由模型根据 README 生成,可能不完整或不准确,以官方文档为准。看原文 README

最近发版

5 个版本4.0.0
  1. 4.0.0最新正式版2026-11-05 · 2026-11-05 05:53 UTC

    Please see the file CHANGELOG for a detailed list of changes.

    Asset / FileDescription / Host OS
    die_sourcecode_4.0.0.tar.gzSource code tarball
    Detect_It_Easy-4.0.0-x86_64.AppImagePortable version for Linux (x86_64) How to run
    die_4.0.0_jammy_amd64.debInstaller for Ubuntu 22.04 (x86_64)
    die_4.0.0_kalilinux_amd64.debInstaller for Kali Linux (x86_64)
    die_4.0.0_noble_amd64.debInstaller for Ubuntu 24.04 (x86_64)
    die_4.0.0_noble_arm64.debInstaller for Ubuntu 24.04 (ARM64)
    die_4.0.0_noble_ppc64el.debInstaller for Ubuntu 24.04 (PowerPC 64-bit little-endian)
    die_4.0.0_noble_riscv64.debInstaller for Ubuntu 24.04 (RISC-V 64-bit)
    die_4.0.0_noble_s390x.debInstaller for Ubuntu 24.04 (s390x)
    die_4.0.0_parrotos_amd64.debInstaller for Parrot OS (x86_64)
    detect-it-easy-4.0.0-1-x86_64.pkg.tar.zstInstaller for Arch Linux (x86_64)
    DetectItEasy-fedora-qt5-aarch64.rpmInstaller for Fedora (ARM64)
    DetectItEasy_4.0.0_fedora_45_amd64.rpmInstaller for Fedora 45 (x86_64)
    DIE-engine-opensuse-qt5-aarch64.rpmInstaller for openSUSE (ARM64)
    DIE-engine-opensuse-qt5-x86_64.rpmInstaller for openSUSE (x86_64)
    detect-it-easy-4.0.0-nix-closure.nar.xzPackage closure for Nix
    detect-it-easy-4.0.0.pkgInstaller for FreeBSD
    DetectItEasy_Termux_CLI_aarch64.tar.gzCommand-line version for Termux on Android (ARM64)
    die_4.0.0_mac_arm64_qt6.dmgDisk image for macOS (ARM64, Qt 6)
    die_4.0.0_mac_portable_arm64_qt6.zipPortable version for macOS (ARM64, Qt 6)
    die_4.0.0_mac_portable_x86_64_qt5.zipPortable version for macOS (x86_64, Qt 5)
    [die_4.0.0_mac_portable_x86_64_qt6.zip](https://github.com/horsicq/DIE-engine/releases/download/4.0
  2. Betapre-release2026-06-03 · 2026-06-03 18:23 UTC

    这个版本没有写更新说明。

  3. 3.212026-04-21 · 2026-04-21 22:44 UTC
    查看更新说明

    Please see the file CHANGELOG for a detailed list of changes.

    Asset / FileDescription / Host OS
    die_sourcecode_3.21.tar.gzSource code tarball
    Detect_It_Easy-3.21-x86_64.AppImagePortable version for Linux How to run
    die_3.21_Debian_10_amd64.debInstaller for Debian 10
    die_3.21_Debian_11_amd64.debInstaller for Debian 11
    die_3.21_Debian_12_amd64.debInstaller for Debian 12
    die_3.21_Debian_13_amd64.debInstaller for Debian 13
    die_3.21_Kali_2026.1_amd64.debInstaller for Kali 2026.1
    die_3.21_Ubuntu_16.04_amd64.debInstaller for Ubuntu 16.04
    die_3.21_Ubuntu_20.04_amd64.debInstaller for Ubuntu 20.04
    die_3.21_Ubuntu_22.04_amd64.debInstaller for Ubuntu 22.04
    die_3.21_Ubuntu_24.04_amd64.debInstaller for Ubuntu 24.04
    die_3.21_Ubuntu_26.04_amd64.debInstaller for Ubuntu 26.04
    die_3.21_portable_Ubuntu_20.04_amd64.tar.gzPortable version for Ubuntu 20.04
    detect-it-easy-3.21-1-x86_64.pkg.tar.zstInstaller for Arch Linux
    die_mac_3.21_x86_64.pkgInstaller for macOS
    die_mac_qt6_3.21_arm64.pkgInstaller for macOS Qt6 Apple Silicon (arm64)
    die_mac_portable_3.21_x86_64.zipPortable version for macOS
    die_win32_portable_3.21_x86.zipPortable version for x86 Win32 (Win7-Win11)
    die_win64_portable_3.21_x64.zipPortable version for x64 Win64 (Win7-Win11)
    die_winxp_portable_3.21_x86.zipPortable version for Windows XP (WinXP-Win11)

    DIE library: https://github.com/horsicq/die_library Python binding: https://github.com/elastic/die-python

  4. 3.202026-04-21 · 2026-04-21 00:35 UTC
    查看更新说明

    Please see the file CHANGELOG for a detailed list of changes.

    Asset / FileDescription / Host OS
    die_sourcecode_3.20.tar.gzSource code tarball
    Detect_It_Easy-3.20-x86_64.AppImagePortable version for Linux How to run
    die_3.20_Debian_10_amd64.debInstaller for Debian 10
    die_3.20_Debian_11_amd64.debInstaller for Debian 11
    die_3.20_Debian_12_amd64.debInstaller for Debian 12
    die_3.20_Debian_13_amd64.debInstaller for Debian 13
    die_3.20_Ubuntu_16.04_amd64.debInstaller for Ubuntu 16.04
    die_3.20_Ubuntu_20.04_amd64.debInstaller for Ubuntu 20.04
    die_3.20_Ubuntu_22.04_amd64.debInstaller for Ubuntu 22.04
    die_3.20_Ubuntu_24.04_amd64.debInstaller for Ubuntu 24.04
    die_3.20_Ubuntu_26.04_amd64.debInstaller for Ubuntu 26.04
    die_3.20_portable_Ubuntu_20.04_amd64.tar.gzPortable version for Ubuntu 20.04
    detect-it-easy-3.20-1-x86_64.pkg.tar.zstInstaller for Arch Linux
    die_mac_3.20_x86_64.pkgInstaller for macOS
    die_mac_qt6_3.20_arm64.pkgInstaller for macOS Qt6 Apple Silicon (arm64)
    die_mac_portable_3.20_x86_64.zipPortable version for macOS
    die_win32_portable_3.20_x86.zipPortable version for x86 Win32 (Win7-Win11)
    die_win64_portable_3.20_x64.zipPortable version for x64 Win64 (Win7-Win11)
    die_winxp_portable_3.20_x86.zipPortable version for Windows XP (WinXP-Win11)

    DIE library: https://github.com/horsicq/die_library Python binding: https://github.com/elastic/die-python

  5. 3.102024-11-03 · 2024-11-03 17:04 UTC
    查看更新说明

    Please see the file CHANGELOG for a detailed list of changes.

    Asset / FileDescription / Host OS
    die_sourcecode_3.10.tar.gzSource code tarball
    Detect_It_Easy-3.10-x86_64.AppImagePortable version for Linux How to run
    die_3.10_Debian_10_amd64.debInstaller for Debian 10
    die_3.10_Debian_11_amd64.debInstaller for Debian 11
    die_3.10_Debian_12_amd64.debInstaller for Debian 12
    die_3.10_Ubuntu_14.04_amd64.debInstaller for Ubuntu 14.04
    die_3.10_Ubuntu_16.04_amd64.debInstaller for Ubuntu 16.04
    die_3.10_Ubuntu_18.04_amd64.debInstaller for Ubuntu 18.04
    die_3.10_Ubuntu_20.04_amd64.debInstaller for Ubuntu 20.04
    die_3.10_Ubuntu_22.04_amd64.debInstaller for Ubuntu 22.04
    die_3.10_Ubuntu_22.10_amd64.debInstaller for Ubuntu 22.10
    die_3.10_Ubuntu_23.04_amd64.debInstaller for Ubuntu 23.04
    die_3.10_Ubuntu_23.10_amd64.debInstaller for Ubuntu 23.10
    die_3.10_Ubuntu_24.04_amd64.debInstaller for Ubuntu 24.04
    die_3.10_Ubuntu_24.10_amd64.debInstaller for Ubuntu 24.10
    die_3.10_Kali_2024.3_amd64.debInstaller for Kali 2024.3
    die_3.10_Parrot_5.3_amd64.debInstaller for Parrot 5.3
    die_3.10_portable_Ubuntu_20.04_amd64.tar.gzPortable version for Ubuntu 20.04
    detect-it-easy-3.10-1-x86_64.pkg.tar.zstInstaller for Arch Linux
    die_mac_3.10_x86_64.pkgInstaller for macOS
    die_mac_qt6_3.10_arm64.pkgInstaller for macOS Qt6 M1 processor
    die_mac_portable_3.10_x86_64.zipPortable version for macOS
    die_win32_portable_3.10_x86.zipPortable version for x86 Win32 (W

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    Donate GitHub tag (latest SemVer) GitHub All Releases gitlocalized

    DIE-engine

    GUI & console sources for Detect It Easy(DiE): https://github.com/horsicq/Detect-It-Easy/

    Optional PEiD engine

    The PEiD scan engine is disabled by default. Enable it for a CMake build with -DWITH_PEID=ON; this defines USE_PEID, compiles the XPEID/peid_widget sources, exposes the PEiD controls, and installs the peid database directory. Packaging scripts use the matching X_WITH_PEID=ON environment switch and forward it to CMake. With the default OFF, PEiD code, controls, help entries, and package files are omitted.

    Updating the signature database

    die-update checks and installs the database published in the current-database release. It uses the same Scan/Die/Database/Main/Path and Scan/Die/Database/Main/UpdateUrl settings as Detect It Easy, leaves db_custom untouched, stages and validates a new db before replacing the old one, and writes db/die-update.ini only after the replacement succeeds.

    die-update --check             check only (exit 1 when an update is available)
    die-update                     install an available update
    die-update --help              list paths, sources, JSON and other options
    diec --checkupdate [-D path]   run die-update --check and return its exit code
    diec --update [-D path]        run die-update and return its exit code
    

    The GUI provides Update database beside its other main-window actions. The operation runs in a separate process and the scan database is reloaded after a successful update. Portable copies read die.ini beside the programs; other copies use the native NTInfo/die settings store. Read-only installations put updates in the per-user database folder, which the Qt frontends prefer on the next load.

    Special Thanks

    alt text

    Thanks to all the people who already contributed!