Architecture
Neptune's crate structure and system design
Architecture
Neptune is a modular Rust application with distinct stages for each part of the reverse engineering pipeline.
Capabilities
| Stage | Description |
|---|---|
| Extraction | Parse ELF, PE, and Mach-O binaries with entropy analysis and section mapping |
| Disassembly | Multi-architecture disassembly for x86, x86_64, ARM, AArch64, MIPS, RISC-V, PowerPC |
| Scanning | String matching, constant detection, compiler identification |
| Fingerprinting | Match functions against a signature database |
| AI analysis | AI-powered library identification from disassembly patterns |
| Decompilation | Decompile binary functions back to readable C/C++ source |
| Devirtualization | Symbolic lifting of obfuscated x86/x64 PE binaries with automatic obfuscation detection |
| Deobfuscation | Detect and clean obfuscation patterns in decompiled source |
| Synthesis | Cross-function semantic analysis to recover globals, structs, and refined names |
| Rebuild | Export decompiled functions as a buildable C project with iterative refinement |
| Porting | Port verified rebuilt source to a different target platform |
| Firmware unpacking | Recursively extract SquashFS, JFFS2, CramFS, CPIO, UBI, Android boot images |
| SBOM generation | CycloneDX 1.6, SPDX 2.3, VEX, SARIF, HTML, JSON output |
| Vulnerability correlation | Cross-reference components against NVD and OSV |
| Malware triage | YARA scanning, capa detection, signal ranking, behavior hypothesis generation |
| Sandbox execution | Offload builds, refinement, porting, and analysis to AgentComputer cloud VMs |
| Policy engine | Rule-based gating with severity thresholds and banned components |
| License compliance | Copyleft detection, license distribution analysis |
| Attestation | In-toto/DSSE envelopes with optional cosign signing |
Data flow
Binary / Firmware Image
│
▼
Extraction
│
▼
Disassembly
│
▼
┌──────┼──────┐
│ │ │
Scan Fingerprint AI
│ │ │
└──────┼──────┘
│
Merge + Score
│
▼
SBOM + VulnerabilitiesMultiple identification sources contribute scored evidence. Results are merged with confidence-weighted deduplication before SBOM generation. Only components above the --min-confidence threshold are included.