The pipeline
One binary in. Compilable, portable source out.
Binary Rebuild
Feed Neptune any stripped binary and get back a buildable C project: disassembled, decompiled, and iteratively refined until it compiles.
Verified Remediation
Select a CVE, fix the vulnerable behavior while preserving everything else, rebuild, and emit a remediation proof bundle.
Equivalence Verification
Validate rebuilt binaries against the original with function-level matching and a differential behavioral fuzzing harness.
Cross-Platform Porting
Port verified rebuilt source to any target triple (x86, ARM, AArch64, MIPS, RISC-V, PowerPC) with AI-assisted adaptation.
The device loop
From deployed device, back to deployed device.
Extract
Neptune pulls the firmware straight off the running device: a vehicle ECU, an infusion pump, a router on a hospital network. No vendor source, no SDK, no waiting on a supplier who may not exist anymore.
Assess
Get the full component inventory and every known vulnerability, correlated to what is actually reachable. This is the SBOM and reachability evidence for the artifact as it shipped, not just what is in the repo.
Rebuild
Neptune decompiles the binary to buildable source, patches the vulnerable paths while preserving everything else, and recompiles, verified functionally equivalent to the original.
Redeploy
Neptune flashes the remediated binary back onto the same device and hands you the proof bundle for auditors. Same hardware, same behavior, minus the CVEs.
In practice
From stripped firmware to signed SBOM in one run.
$ neptune analyze router-fw.bin --rebuild unpack squashfs 4.0 · 214 binaries · 61 shared objects fingerprint openssl 1.1.1k · busybox 1.33.1 · zlib 1.2.11 · dropbear 2020.81 correlate 38 CVEs matched · 3 reachable from network input reachable CVE-2021-3712 (openssl) via TLS handshake path decompile 1,842 functions lifted to C [4m 12s] rebuild cc -O2 -fPIC -shared -o libssl.so 0 errors verify 98.4% functional equivalence · 12,480 test vectors done in 6m 41s · sbom: cyclonedx.json spdx.json vex.json
Why Neptune
Evidence you can hand to a security review.
Any architecture
Capstone-backed disassembly across six instruction sets, with ELF, PE, and Mach-O extraction plus recursive firmware unpacking.
Checked, not trusted
Every rebuild is checked against the original with shift-tolerant similarity, syscall trace comparison, and mutation fuzzing before it ships.
Evidence by default
CycloneDX, SPDX, VEX, and SARIF output with NVD and OSV correlation and call-graph reachability, generated on every run, the evidence a security or procurement review actually asks for.
Built for the gate
Policy engine, license compliance, in-toto attestation, and CI baselines that fail on new critical vulnerabilities.
Feed it a binary. Keep the source.
Bring one device you ship. Leave with buildable source, a signed SBOM, and the fix already flashed back on.