Altumptic/paranoia

Why Paranoia

• Private by design. No accounts, no telemetry, no update checks. Files are analysed on your machine and never uploaded. The one optional exception is the AI assistant, which stays off until you point it at a model server (a local Ollama / LM Studio keeps everything on your computer).
• Fast. The native Rust engine analyses shell32.dll (24 449 functions, 1.47 M instructions) in about two seconds on a mid-range laptop.
• Built for hostile input. The engine parses files in its own process, every CI run feeds it 1 500 corrupted PE / ELF / Mach-O files, and a crash never takes the UI down.
• Verifiable. Releases come with signed checksums, build-provenance attestations and an SBOM (how to verify).
• Open. Apache-2.0. The same engine powers the desktop app, a CLI and a WebAssembly build that runs in the browser.

Features

Area	What you get
Formats	PE / PE32+ (.NET detection, forwarders, TLS callbacks, .pdata with chained unwind info), ELF (PIE, PLT/GOT imports, symbol versions), Mach-O (universal binaries, dyld bind opcodes, chained fixups, export trie)
Architectures	x86 and x86-64 (iced-x86), AArch64, ARM32 and Thumb-2 (yaxpeax-arm), RISC-V RV32/RV64GC, MIPS32/64 and PowerPC 32/64 (own decoders)
Auto-analysis	Recursive-descent function discovery from entry points, exports, symbols and exception tables; basic blocks; switch-table recovery; no-return awareness; import thunks
Listing	Code and data in one view: sub_ / loc_ labels, db/dw/dd/dq, strings, offset, extrn, auto names (aHelloWorld, qword_…), XREF comments, jump arrows, argument labels from API prototypes
Decompiler	x86 / x64 (Tab / F5): typed variables (HANDLE v3 = CreateFileW(a1, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, …)), expression propagation, switch, while / for / do-while with break / continue; type a variable (Y) and struct fields render as ctx->FileName, with the type flowing into the functions it is passed to, back through typed call results, and along pointer fields — so linked lists and trees stay readable (p = ctx->next; p->id)
Graph & xrefs	Control-flow graph with pan, zoom and minimap; xrefs dialog (X), call graph, stack frames
Editing	Rename (N), comments (;), bookmarks, code / data / string / undefine (C D A U), create function (P), operand display (H R B M), local C types, undo / redo — saved per file hash
Hex & patching	Hex view with data inspector, byte patching, NOP / invert / force-jump patches, save the patched file
Debug info	PDB symbols (found next to the binary, GUID-checked); PDB and DWARF struct / union / enum definitions as searchable debug-info types (for Y and the decompiler); DWARF names, globals and source lines
Signatures	FLIRT library recognition: reads IDA .sig and .pat files, writes .pat; built-in MSVC x64 runtime library
Debugger	Windows x64 / 32-bit and Linux x86-64 programs: breakpoints (F2), run (F9), step into / over (F7 / F8), run to cursor (F4), registers and stack
Scripting	Python in your own interpreter — import idc, idautils works for common calls — and JavaScript, both with the pn API; headless paranoia script batch mode
Triage	Hashes, entropy map, section map, checksec-style mitigations (ASLR, DEP, CFG, RELRO, PIE, canaries, FORTIFY)

Current limits

Stated here so nobody has to find them the hard way (full list in the roadmap):

• The decompiler covers x86 / x64 only; it does not yet do SSA-based variable recovery or struct member access.
• MIPS support is checked with decoder tests on known encodings, not yet on a full MIPS binary.
• The debugger runs local programs only (Windows x64 / 32-bit, Linux x86-64); remote targets are planned. The packaged app is built for Windows; on Linux run it from source (npm run app).
• Windows executables are not Authenticode-signed yet (see below).

Install and verify

Download from Releases:

• Paranoia-Setup-<version>.exe — Windows installer (per-user, no admin rights)
• Paranoia-<version>-portable.exe — single-file portable build
• SHA256SUMS, SHA256SUMS.sigstore.json and the CycloneDX SBOMs — checksums, their signature and the bill of materials (from v0.5.1; see VERIFY.md for what each release contains)

The executables are not Authenticode-signed yet, so Windows SmartScreen may ask for confirmation on first launch. Check the download instead:

Get-FileHash .\Paranoia-<version>-portable.exe -Algorithm SHA256   # compare with SHA256SUMS

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/Altumptic/paranoia/\.github/workflows/ci\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify Paranoia-<version>-portable.exe --repo Altumptic/paranoia

Step by step: docs/VERIFY.md.

Security and privacy

• No network by default. The app makes no connections: no telemetry, no update checks, no remote fonts or scripts. Updates are manual. Only if you configure the AI assistant does the desktop app contact the server you chose — the page itself still has no network access.
• Your data stays local. Annotations and the recent-files list live in %APPDATA%\Paranoia; nothing else is stored (data inventory).
• Hardened desktop shell. Sandboxed renderer with a CSP that forbids eval; the JavaScript console runs in an isolated worker; the engine opens only files you chose; starting the debugger or a Python script needs a native confirmation; Electron fuses lock the binary down.
• Honest scope. The debugger runs the program you analyse — use a VM for malware. Your Python scripts are ordinary programs. No independent audit has been done yet.

Details: security design and threat model · baseline status and exceptions · report a vulnerability: SECURITY.md.

Keyboard

Keys	Action	Keys	Action
Ctrl O	Open file	Space	Listing ↔ graph
Ctrl K / G	Go to address, name, string	Tab / F5	Pseudocode
Esc / Alt ←	Back	Alt →	Forward
Enter / double-click	Follow operand	X	Cross references
N	Rename	;	Comment
Y	Type variable (pseudocode)	Alt M / Ctrl M	Bookmark / list bookmarks
P	Create function	Alt M / Ctrl M	Bookmark / list bookmarks
C / D / A / U	Code / data / string / undefine	Ctrl Z / Ctrl Y	Undo / redo
H / R / B / M	Operand: hex ↔ dec / char / binary / enum	Ctrl `	Script console
Alt B / Alt T / Alt I	Search bytes / text / immediate	1–6	Overview, listing, graph, pseudocode, calls, hex
F2 / F9 / F7 / F8 / F4	Breakpoint / run / step into / step over / run to cursor	Ctrl B / Ctrl J	Toggle sidebar / inspector

Command line

paranoia info sample.exe
paranoia functions sample.exe
paranoia disasm sample.exe --at main -n 40
paranoia pseudo sample.exe main
paranoia xrefs sample.exe CreateFileW
paranoia strings --referenced sample.exe --json
paranoia script sample.exe analyse.py --at 140001000   # Python, headless
paranoia sigmake app.exe --pdb app.pdb -o app.pat       # FLAIR .pat from symbols
paranoia sigapply app.exe libc.sig                       # apply IDA .sig (or .pat) signatures
paranoia ssa app.exe main                                # a function in SSA form (phi nodes, constants, dead code)
paranoia sigapply other.exe app.pat

Build from source

Requirements: Rust 1.82+, Node.js 20+.

# engine + CLI
cargo build --release -p paranoia-engine -p paranoia-cli
cargo test --workspace

# desktop app (dev loop with hot reload)
cd apps/desktop
npm ci
npm run wasm        # engine for the browser build (rustup target add wasm32-unknown-unknown)
npm run app:dev

# Windows installer + portable exe in apps/desktop/out/
npm run dist

The browser build (npm run dev, then open http://localhost:1420) runs the same engine as WebAssembly in a Web Worker.

Windows note. Everything builds with the x86_64-pc-windows-gnu toolchain without a C compiler. If your checkout path contains spaces and you hit dlltool errors, set CARGO_TARGET_DIR to a path without spaces.

Repository layout

AI assistants: start with AGENTS.md — one page with the repo map, commands, invariants and recipes, so you never have to rediscover the project.

crates/
  paranoia-core     analysis engine: loaders, disassemblers, analysis, decompiler, debug info, signatures
  paranoia-engine   native engine process for the desktop app (JSON over stdio), workspace store, debugger
  paranoia-db       workspace store on redb (annotations, recent files)
  paranoia-wasm     the engine compiled to WebAssembly with a plain C ABI
  paranoia-cli      `paranoia` command-line tool
apps/desktop        React + TypeScript UI, Electron shell, electron-builder packaging
assets/brand        logo and app icon sources
docs/               architecture, security design, verification, baseline status, roadmap

Contributing

Issues and pull requests are welcome — see CONTRIBUTING.md. Report crashes on specific files with their SHA-256 rather than attaching malware, and report vulnerabilities privately as described in SECURITY.md.

License

Apache-2.0.