Skip to content
unveil

Architecture

How an unveil session is meant to run.

Upload, LIEF, and Capstone run in the API. Ghidra is called only when it is installed, which it is not on this host. Agents and virtual machines are specified and are not running.

  1. 01

    Intake

    A session begins when a compiled binary is accepted. The API checks the file type, records architecture and entry metadata, and stores the bytes outside the website. The file is not executed.

  2. 02

    Static pass

    LIEF extracts structure and Capstone disassembles executable sections. The same job can attach Ghidra output. Ghidra is not installed on this host, so that part of the result stays unavailable.

  3. 03

    Reading

    The workspace shows metadata, the Capstone listing, and any functions Ghidra actually recovered. It does not fill those panels when the decompiler is missing or fails.

  4. 04

    Dynamic pass

    Supported dynamic analysis is planned only after static results exist, and only inside a disposable QEMU guest on a Linux host with KVM. CPU, memory, time, filesystem, and network would be limited. This computer cannot start that guest. Firecracker is a later option on the same kind of host.