Arrange the investigation around you.
Dock, split, resize and collapse panels. Each file restores its own layout, active tools and byte selection.
CURRENT PLAN / UPDATED NOVEMBER 2026
From bytes.
To understanding.
Preview 2 puts the new workspace in your hands. Preview 3 development adds PE and Mach-O explorers, large-file workflows, ZIP64 and passive multi-format previews. Next, deepen format coverage and qualify the Windows desktop experience.
AVAILABLE / PREVIEW 2
The current workbench.
See the objects behind the document.
Explore a PDF object tree, pages, streams, attachments, layers and scripts beside the original bytes.
Open the container. Follow its contents.
Browse archive members with header and payload offsets, content identification, filename mismatch indicators and resource extraction.
Look inside a Word document.
Inspect DOCX stories, tables, package relationships and embedded resources without launching Office.
Read formulas without running them.
Browse worksheets, stored formulas, cached values and supported cell references in an Excel package.
Make certificate structure readable.
Explore ASN.1 and PEM structures, certificate identity, validity dates, key metadata and supported extensions.
Explore the executable before analysis.
Inspect ELF headers, segments, sections and linked records in a dedicated dockable explorer.
Turn checks into linked evidence.
Run an explicit, cancellable Security Check and inspect coverage, archive contents and source-bound observations.
Linked evidence and explanations
Shared source/evidence contracts, Findings, graph relationships, saved queries, evidence reports and reviewed AI explanations are implemented in Preview 2.
Windows x64 preview
Per-user setup, private Node, diagnostics and guarded REA integration are packaged. Windows desktop-host qualification and optional-provider execution remain next steps.
IMPLEMENTED / PREVIEW 3 DEVELOPMENT
Built since Preview 2.
PE and Mach-O explorers
Shared executable records, supported imports/exports, sections, load commands and symbols; universal architecture filtering and exact field-to-Hex links.
Durable executable inventories
Paged ELF/PE/Mach-O records, lazy exact fields, bounded query continuation and retained per-file filters and selection. Native Codex and ChatGPT focused host checks passed.
Multi-GB editing
File-backed sources up to 16 GiB, precise offsets, saved positions, background search, streamed comparison and disk-space preflight. Provider and document limits remain separate.
Task-aware Retained workspaces
Inline results select the relevant tool; expanded mode restores the per-file workspace and brings that tool forward. Views, splits, tabs and selections stay with the investigation.
Large-scope checks
Streamed whole-file YARA capture, structural executable reads with an evicting cache, and exact streamed entropy. Owned cancellation and explicit coverage stay visible.
PryIDA identity
A prybar-and-binary mark and the “See Inside” tagline. Existing plugin IDs and investigation storage stay compatible. Updated distribution packaging follows separately.
IMPLEMENTED / PREVIEW 3 DEVELOPMENT
Readable content. Exact source.
Passive multi-format previews
Markdown, delimited tables, JSON/XML/YAML trees, additional static image codecs and supported EML/MSG inspection join the File Preview dock. Follow supported source fields directly to Hex.
Richer Office inspection
Word paragraphs and tables, stored Excel formatting hints and cached values, PowerPoint content and package image galleries. Full application rendering and formula recalculation remain future work.
ZIP64 and paged executable inventories
Explore extended archive metadata and bounded member previews/exports. ELF, PE and Mach-O inventories page large record sets while preserving field-level source links and saved selections.
NEXT / PRIORITY ORDER
Deepen the foundations.
01 / Windows desktop qualification
Verify real Windows 11 Codex and ChatGPT workflows, clipboard/shortcuts, docking and reconnect. Qualify optional providers independently before enabling them.
02 / Large documents and resources
Build range-backed ZIP64 and streamed member extraction, selected Office XML inspection and paged disk-backed PDF resources. Preserve exact encoded/decoded provenance, cancellation and decompression controls.
03 / Streamed providers and Crypto
Add file-based antivirus capture and engine-limit reporting, streamed transforms and derived sources, and paged ASN.1 values. Signature and certificate-chain verification follow independently qualified providers.
04 / Analysis power
Provider-backed analysis corrections, stronger semantic comparisons, scoped scripting and separately controlled debugging/trace import build toward a deeper reverse-engineering platform.
Priorities may change with preview feedback. Future capabilities below are direction, not a promise that every feature ships in v2.
PLANNED / LONG-TERM DIRECTION
Five pillars. One workbench.
The next-generation plan connects existing features to deeper investigation workflows. These are delivery directions, not a promise that every capability ships in v2.0.
01 / Understand
Unify sources and typed structures; deepen executable parsing, provider-qualified IR/decompilation, mainframe/payment records, document formats, storage and firmware inspection.
02 / Observe
Add separately controlled debugger adapters, recorded traces, module mappings, memory sources and execution timelines. Start with read-only imports before live launch or attach.
03 / Prove
Trace findings through an Evidence Graph, bounded queries, semantic comparisons and reviewed hypotheses. Add modeled taint and targeted symbolic paths with visible assumptions and incomplete coverage.
04 / Test
Use isolated workers for reviewed harnesses, fuzz jobs, coverage, crash deduplication and minimization. Connect minimized inputs to an explicit debugger handoff and reproducible regression recipes.
05 / Collaborate
Build on local notes and archives with versioned analysis manifests, scoped SDK/CLI recipes, evidence-linked reports and reviewed annotation workflows. Shared services follow authorization and isolation controls.
A composable interface
Evolve the source explorer, central hex/code perspectives, contextual inspector and optional lower evidence/findings tools. Keep narrow host panels usable; avoid a dashboard that hides the active investigation.
PLANNED / DEEPER ANALYSIS
Ask stronger questions of the evidence.
Build on provider capabilities and retained observations, with explicit unknowns.
IR and analysis corrections
Normalize supported instructions, blocks and def-use data; review provider-supported names, types, signatures and boundary corrections, then reanalyze affected results.
Semantic diff and patch intelligence
Compare byte, structure, function, CFG and supported IR observations. Rank security-relevant change hypotheses while retaining reviewed match decisions and confidence.
Components and executable hardening
Identify component/version candidates and inspect evidence for PE/ELF/Mach-O mitigations, permissions and signatures. A fingerprint alone will not confirm a vulnerability.
Taint and targeted symbolic analysis
Model selected sources, sinks and sanitizers; bound path/state budgets and show assumptions. A partial result is not a proof of reachability or safety.
Debugging, memory and traces
Evaluate qualified LLDB/GDB/WinDbg/Frida/QEMU integrations, recorded events and memory-dump adapters. Live execution remains an explicit, isolated workflow.
SDK, extensions and AI assistance
Develop permissioned APIs, reviewed pipelines and evidence-bound AI proposals. Ordinary search stays local; generated scripts or patches do not run automatically.
DOCUMENTS & CONTAINERS / NEXT DEPTH
Expand the parts we can explain.
Structural inspection, previews, extraction and writing are distinct support levels. Existing development explorers are listed above; these are planned follow-ups.
Office depth and legacy formats
Deepen DOCX, XLSX and PPTX semantics and supported DOCM/XLSM/PPTM inspection. XLM, compiled VBA/p-code, XLSB and full legacy DOC/XLS/PPT interpretation require separate decoders.
More documents and resources
Extend bounded text/image metadata inspection and evaluate ODT/ODS/ODP, EPUB, EML/MSG and read-only SQLite adapters. Active content remains inert.
Archive and container depth
Build on ZIP, TAR/GZIP and offline OCI subsets. Qualify larger layers, merged container filesystems, additional 7z/RAR providers and encrypted/multi-volume variants separately.
CRYPTOGRAPHY / NEXT MILESTONES
Go beyond readable metadata.
Hashing, strict encodings, ASN.1 and certificate details are implemented in development. Verification and secret-bearing operations are future milestones.
Signatures and certificate trust
Add supported signature and chain verification with explicit signed ranges, time/revocation context and unavailable evidence. A readable certificate or matching digest does not establish trust.
Supported decryption and derived sources
Qualify vetted providers and a local-sensitive input route before accepting keys/passwords. Keep plaintext in a distinct derived investigation and require explicit export.
Crypto intelligence
Correlate REA imports, constants and call sites with confidence-qualified algorithm, key/IV/nonce and randomness-risk candidates. No automatic key-recovery claim.
Payment cryptography
Plan metadata-first TR-31, ISO 9564 PIN-block structures, DUKPT, KCV, MAC and EMV inspection. Secret-dependent operations require separately qualified providers and synthetic test vectors.
Specialist containers
Evaluate supported PKCS, SSH, OpenPGP, passive TLS/JWT/COSE and disk-encryption metadata, plus post-quantum formats as vetted providers and fixtures permit.
Protected inputs
Keep secret material outside prompts, ordinary tool arguments, logs and normal reports. Disable operations where a host cannot provide a verified local-sensitive route.
PLANNED / DOMAIN ADAPTERS
Follow the file into its wider context.
Reuse common source, structure and evidence contracts rather than building disconnected tools.
Mainframe and payment records
EBCDIC/COBOL types, record framing, COPYBOOKs, profile-defined ISO 8583 and EMV, masked fields, semantic search/diff and evidence-backed schema assistance.
Devices, images and filesystems
Read-only source adapters, partitions, qualified FAT/exFAT/NTFS and later image/filesystem providers, carving and recovered-file provenance. Multi-GB file access provides a foundation; raw devices, image containers and filesystem decoding remain planned.
Firmware and memory
Inspect supported UEFI/BIOS/embedded containers, unpacked resources, configurations, certificates and components. Runtime memory and dump analysis are separately qualified source families.
PLANNED / FUTURE EDITIONS
Bring the same investigation with you.
Keep shared backend contracts while qualifying each host and deployment independently.
Standalone PryIDA
An independently launchable application with optional AI assistance, reusing the editor, sources and analysis backend. Packaging and distribution are future work.
Claude integration
Probe actual host UI and tool capabilities before choosing an embedded experience or a standalone/browser companion. No embedded support is assumed.
Shared and remote work
Evaluate controlled worker deployments and collaborative projects after project authorization, audit, retention and conflict-handling contracts exist.
Delivery proceeds in independently useful milestones: source/type/evidence foundations, deeper understanding and queries, then qualified runtime and specialist adapters. Advanced research and shared deployments follow their prerequisites. Priorities may evolve; a roadmap entry is not an available download or a fixed delivery date.
START EXPLORING
Put the current preview to work.
macOS 13.5+ on Apple Silicon · Free personal and commercial binary use.