// Portable Executable (PE) Header Forensics, IAT Risk Auditor & .NET CIL Decompiler
Inspect Windows DLL, EXE, and SYS binaries directly inside browser memory. Audit Address Space Layout Randomization (ASLR), DEP, Control Flow Guard, Import Address Tables (IAT) for process injection vectors, compute Shannon entropy per section, extract IOC strings, and interactively decompile .NET CIL bytecodes with zero server uploads.
Zero bytes leave your computer. 100% in-browser parsing of PE headers, Export/Import tables (IAT), Shannon entropy, strings, and .NET CIL bytecode.
The OverlayCheck DLL Decompiler & PE Forensic Analyzer inspects Windows PE32/PE32+ binaries (DLL, EXE, SYS) in client browser memory, auditing exploit mitigations (ASLR, DEP, CFG), mapping Import Address Tables (IAT) for suspicious APIs, computing Shannon entropy per section, and decompiling .NET CIL bytecode without server uploads.
Yes. Unlike cloud malware sandboxes or online decompilers that upload your binary to remote servers for scanning, OverlayCheck executes all parsing logic inside your local browser memory using JavaScript TypedArrays and DataViews. Zero bytes are uploaded to remote servers, preserving perfect chain of custody and confidentiality.
The tool supports all standard Portable Executable (PE) formats, including 32-bit (PE32) and 64-bit (PE32+) Dynamic Link Libraries (.dll), Executables (.exe), Kernel Drivers (.sys), and ActiveX controls (.ocx). It handles both native C/C++ machine binaries and managed .NET assemblies.
OverlayCheck calculates the Shannon Entropy (H) for each individual section (.text, .rdata, .data) and across the entire binary. Entropy values exceeding 7.2 out of 8.0 indicate high information density typical of encrypted payloads or packers such as UPX, Themida, ASPack, or Enigma.
When a .NET CLR header (COM_DESCRIPTOR) is detected, OverlayCheck parses the BSJB metadata root, class tables, and method definitions. It disassembles the Common Intermediate Language (CIL) bytecodes into human-readable opcodes (e.g., ldarg, callvirt, ret) alongside string literals and method signatures.