Stage Reference

Stage Reference

Every analysis stage in RE-Toolkit, what it produces, and how to control it.

A stage is a single file under stages/static/ defining a single function. The dispatcher decides which stages run for a given target based on its detected type; a stage never decides that for itself. Stage numbers reflect output-directory ordering rather than execution order, which is explained in Architecture and Design.

There are 46 stages.

Contents

• Universal triage
• Portable Executable
• .NET
• Decompilation and deep analysis
• Disassembly perspectives
• Platform formats
• Packing
• Android
• Cross-cutting analysis
• Synthesis and comparison
• Presentation
• Dynamic analysis
• Skip control index

Reading this page

Field	Meaning
Function	The stage function the file defines
Output	Subdirectories created under the target's output directory
Disable with	The command-line flag that skips this stage
Tools	Tool labels recorded in the run ledger

A stage that finds its tool unavailable skips cleanly and records the reason, so a missing optional tool degrades coverage rather than failing the run.

Universal triage

00-triage.sh

Universal triage: identity, hashes, entropy, signatures, and carving.

Runs for every target regardless of type, and produces the identity information every later stage and the report depend on: file classification, size and timestamps, cryptographic hashes, metadata, entropy profile, packer and compiler fingerprints, signature matches, and carved embedded content. Because triage output feeds type detection and the summary, it is the one stage that is never skipped wholesale.

Function	stage_triage()
Output	00-triage/, 90-logs/
Disable with	--no-clamav, --no-signsrch, --no-yara
Tools	binwalk-arch, binwalk-entropy, binwalk-extract, binwalk-opcodes, binwalk-signature, clamscan, clamscan-verbose, diec-detect, diec-json, diec-text, exiftool, signsrch, yara

Portable Executable

10-pe.sh

PE-specific analysis shared by native and .NET Portable Executables.

Parses Portable Executable structure: headers, sections, imports, exports, resources, and the section-level size profile. Runs for both native and .NET PE files, since a managed binary is still a PE and every structural question about it remains valid. Also probes for Go and Rust runtimes, which compose with the PE type rather than replacing it.

Function	stage_pe()
Output	10-pe/, 55-go/, 57-rust/
Disable with	--no-bloaty, --no-go-detect, --no-rust-detect
Tools	bloaty-sections, floss, readpe, redress-info, redress-moduledata, redress-packages, redress-source, redress-types

12-lief.sh

LIEF exhaustive format-agnostic binary parsing.

Parses PE, ELF, and Mach-O through a single unified API and dumps every structural element exposed. Valuable precisely because it is format-agnostic: it gives a consistent structural view across target types, and supplies the signature count and TLS callback count the summary cross-checks against the Authenticode result.

Function	stage_lief()
Output	12-lief/
Disable with	None
Tools	Inline analysis, no external tool

14-pev.sh

pev suite analysis (readpe, pedis, pehash, pescan, pesec, pestr).

Function	stage_pev()
Output	14-pev/
Disable with	None
Tools	Inline analysis, no external tool

16-manalyze.sh

Manalyze static PE analyzer with plugin-based scoring.

Function	stage_manalyze()
Output	16-manalyze/
Disable with	--no-manalyze
Tools	manalyze-json, manalyze-raw

17-peframe.sh

peframe PE behavioral static analyzer.

Function	stage_peframe()
Output	17-peframe/
Disable with	--no-peframe
Tools	peframe-json, peframe-short, peframe-strings

18-bulk.sh

bulk_extractor raw PII and IOC scanner, applicable to any binary.

Function	stage_bulk()
Output	18-bulk/
Disable with	--no-bulk
Tools	bulk_extractor

.NET

20-dotnet.sh

.NET-specific analysis: disassembly, decompilation, and deobfuscation.

The deepest stage set for managed code. Disassembles IL, decompiles to C# through more than one independent decompiler so their output can be compared, and runs deobfuscation. Specialized deobfuscators are selected automatically from the detection pass rather than guessed: the general deobfuscator reports which obfuscator it recognized, and the matching specialist runs on that basis.

Function	stage_dotnet()
Output	20-dotnet/, 22-de4dot/, 24-deob/, 26-dnspyex/
Disable with	--no-de4dot, --no-dnspy-ex, --no-dotnet, --no-eazfixer, --no-oldrod, --use-nofuserex
Tools	de4dot, dnspyex, dnspyex-deobf, eazfixer, ikdasm, ilspycmd, ilspycmd-deobf, monodis, nofuserex, oldrod

Decompilation and deep analysis

26-retdec.sh

RetDec decompiler pass (opt-in, installed via --with-retdec).

Function	stage_retdec()
Output	26-retdec/
Disable with	SKIP_RETDEC (environment variable only)
Tools	Inline analysis, no external tool

30-ghidra.sh

Ghidra headless analysis driving the GhidraDump.py postscript.

Runs Ghidra headless with the GhidraDump.py postscript, producing the structured multi-section dump that downstream stages parse for function inventory, decompilation, cross-references, and structural characterization. This is typically the slowest stage in a run, and the first one to disable when triaging quickly.

Function	stage_ghidra()
Output	30-ghidra/
Disable with	--no-ghidra
Tools	Inline analysis, no external tool

34-cwe.sh

cwe_checker static CWE detection over binary intermediate representation.

Function	stage_cwe()
Output	34-cwe/
Disable with	--enable-cwe-checker
Tools	cwe-checker-json, cwe-checker-text

Disassembly perspectives

40-alternative.sh

Alternative-perspective dispatcher for objdump, radare2, rizin, and LLVM.

Function	stage_alternative()
Output	Writes into existing subtrees
Disable with	None
Tools	Inline analysis, no external tool

40-objdump.sh

GNU objdump deep invocation: headers, disassembly, and DWARF.

Function	stage_objdump_deep()
Output	40-r2/
Disable with	None
Tools	objdump-disasm, objdump-dwarf, objdump-headers

40-r2.sh

radare2 deep analysis and string-to-function mapping.

Function	stage_r2_deep(), _r2_string_to_function()
Output	40-r2/
Disable with	--no-r2
Tools	Inline analysis, no external tool

42-rizin.sh

rizin deep analysis providing an independent second opinion to radare2.

Function	stage_rizin_deep()
Output	42-rizin/
Disable with	--no-r2
Tools	rz-bin-all, rz-bin-json

44-llvm.sh

llvm-objdump disassembly complementing the GNU objdump perspective.

Function	stage_llvm_objdump()
Output	44-llvm/
Disable with	None
Tools	llvm-objdump

46-rop-gadgets.sh

ROP gadget enumeration via pwntools.

Function	stage_rop_gadgets()
Output	46-rop-gadgets/
Disable with	SKIP_ROP_GADGETS (environment variable only)
Tools	Inline analysis, no external tool

Platform formats

50-elf.sh

ELF-specific analysis: sections, symbols, hardening posture, and DWARF.

Function	stage_elf()
Output	50-elf/, 55-go/, 57-rust/
Disable with	--no-bloaty, --no-checksec, --no-dumpelf, --no-go-detect, --no-nm-demangled, --no-pahole, --no-rust-detect, --no-scanelf
Tools	bloaty-debug, bloaty-sections, bloaty-symbols, checksec, checksec-pwn, dumpelf, nm, nm-demangled, pahole, readelf, redress-info, redress-moduledata, redress-packages, redress-source, redress-types, scanelf

52-macho.sh

Mach-O structural analysis via the LLVM object tooling.

Function	stage_macho()
Output	52-macho/
Disable with	--no-macho
Tools	llvm-objdump-macho-disasm, llvm-objdump-macho-dylibs, llvm-objdump-macho-headers, llvm-objdump-macho-sections, llvm-objdump-macho-symbols

54-wasm.sh

WebAssembly module validation, disassembly, and decompilation.

Function	stage_wasm()
Output	54-wasm/
Disable with	--no-wasm
Tools	wasm-decompile, wasm-objdump, wasm-objdump-disasm, wasm-validate, wasm2wat

56-pyc.sh

Python bytecode analysis and multi-decompiler recovery.

Function	stage_pyc()
Output	56-pyc/
Disable with	--no-pyc
Tools	decompyle3, pycdas, pycdc, python-dis, uncompyle6

58-jar.sh

Java JAR, WAR, and EAR archive analysis and decompilation.

Function	stage_jar()
Output	58-jar/
Disable with	--no-jar
Tools	cfr, procyon, unzip-listing

60-config.sh

Configuration and XML inspection for adjacent application metadata.

Function	stage_config()
Output	60-config/
Disable with	None
Tools	Inline analysis, no external tool

62-pdf.sh

PDF document structural and active-content analysis.

Function	stage_pdf()
Output	62-pdf/
Disable with	--no-pdf
Tools	mutool-info, mutool-show-trailer, pdf-parser-js, pdf-parser-openaction, pdf-parser-stats, pdfid, peepdf, qpdf-check

64-ole.sh

OLE and OOXML Office document analysis including macro extraction.

Function	stage_ole()
Output	64-ole/
Disable with	--no-ole
Tools	7z-listing, mraptor, msodde, oledump, oleid, oleobj, olevba, olevba-json

Packing

70-upx.sh

UPX detection, unpacking, and re-analysis of the unpacked image.

Function	stage_upx()
Output	70-upx-unpacked/
Disable with	--no-ghidra-dotnet
Tools	Inline analysis, no external tool

Android

72-apk.sh

APK container extraction and resource decoding.

Function	stage_apk()
Output	72-apk/, 72-apk-extracted/
Disable with	--no-apk
Tools	apk-listing, apktool-decode

74-dex.sh

DEX decompilation through jadx, dex2jar, and baksmali.

Function	stage_dex()
Output	74-dex/
Disable with	--no-dex
Tools	baksmali-disassemble, cfr-from-dex2jar, dex2jar, jadx-decompile

76-axml.sh

AndroidManifest.xml binary-XML decode and permission analysis.

Function	stage_axml()
Output	76-axml/
Disable with	--no-axml
Tools	aapt-xmltree, aapt2-xmltree

78-apksig.sh

APK signature scheme verification and certificate extraction.

Function	stage_apksig()
Output	78-apksig/
Disable with	--no-apksig
Tools	apksigner-verify, openssl-pkcs7-cert

Cross-cutting analysis

80-iocs.sh

IOC extraction and three-way classification over prior stage output.

A post-processor rather than a tool wrapper: it reads output other stages already produced and extracts indicators, then classifies each one three ways. Indicators are kept as behavioral, tagged as infrastructure, or dropped as noise. The distinction matters because tool self-reports, version strings misread as addresses, and code identifiers misread as domains would otherwise flood the indicator set and bury the findings that describe the target's actual behavior.

Function	stage_iocs(), main()
Output	80-iocs/
Disable with	None
Tools	Inline analysis, no external tool

81-fuzzyhash.sh

Fuzzy hashing via ssdeep and sdhash for similarity clustering.

Function	stage_fuzzyhash()
Output	81-fuzzyhash/
Disable with	--no-fuzzyhash
Tools	sdhash, ssdeep

82-cryptokeys.sh

Cryptographic key and embedded secret extraction.

Function	stage_cryptokeys()
Output	00-triage/, 82-cryptokeys/
Disable with	--no-cryptokeys
Tools	findaes

83-authenticode.sh

Authenticode signature chain validation for PE targets.

Function	stage_authenticode()
Output	83-authenticode/
Disable with	--no-authenticode
Tools	osslsigncode-verify, osslsigncode-verify-CAfile

Synthesis and comparison

85-summary.sh

Per-binary summary synthesis producing the authoritative _summary.json.

Consumes every upstream stage result and produces _summary.json, the authoritative artifact for the target, along with a one-line verdict. Severity is computed from weighted signals, each carrying a name, a weight, and the evidence supporting it, so a verdict can be traced back to the observation that produced it. Related signals describing one underlying observation are suppressed so a single concept cannot inflate a score by being counted several ways.

Function	stage_summary()
Output	Writes into existing subtrees
Disable with	None
Tools	Inline analysis, no external tool

86-angr.sh

angr CFGFast control-flow graph recovery (opt-in).

Function	stage_angr()
Output	86-angr/
Disable with	--enable-angr
Tools	Inline analysis, no external tool

87-radiff2.sh

radiff2 comparative binary diffing against a reference target.

Function	stage_radiff2()
Output	87-radiff2/
Disable with	None
Tools	radiff2-count, radiff2-functions, radiff2-imports, radiff2-similarity, radiff2-strings

88-yargen.sh

yarGen YARA rule generation from target strings (opt-in).

Function	stage_yargen()
Output	88-yargen/
Disable with	--enable-yargen
Tools	Inline analysis, no external tool

Presentation

89-viz.sh

Visualization rendering: treemaps, heatmaps, charts, and graphs.

Renders visualizations as self-contained inline SVG: no external CDN reference, no JavaScript library, and no network fetch at view time. Each visualization is independently viewable and is also embedded into the report. Missing inputs degrade to an empty visualization with explanatory text rather than failing the stage.

Function	stage_viz()
Output	12-lief/, 50-elf/, 52-macho/, 89-viz/
Disable with	--no-viz
Tools	Inline analysis, no external tool

90-report.sh

Per-binary HTML report generation from _summary.json.

Renders _summary.json into a self-contained tabbed HTML report. The report is a presentation of the JSON and never an independent source of truth, so any discrepancy between them is a report bug.

Function	stage_report()
Output	Writes into existing subtrees
Disable with	--no-viz
Tools	Inline analysis, no external tool

91-binary-diff.sh

Byte-level binary diffing via bsdiff and vbindiff.

Function	stage_binary_diff()
Output	91-binary-diff/
Disable with	SKIP_BINARY_DIFF (environment variable only)
Tools	bsdiff

Dynamic analysis

92-dynamic-qiling.sh

Dynamic analysis Tier 1: qiling emulation over the Unicorn engine.

Function	stage_dynamic_qiling()
Output	92-dynamic-qiling/
Disable with	--dynamic-mode, --no-dynamic-qiling
Tools	Inline analysis, no external tool

94-dynamic-firejail.sh

Dynamic analysis Tier 2: firejail namespace-sandboxed execution.

Function	stage_dynamic_firejail()
Output	94-dynamic-firejail/
Disable with	--dynamic-mode, --no-dynamic-firejail
Tools	Inline analysis, no external tool

96-dynamic-docker.sh

Dynamic analysis Tier 3: Docker container-isolated execution.

Function	stage_dynamic_docker()
Output	96-dynamic-docker/
Disable with	--dynamic-mode, --no-dynamic-docker
Tools	Inline analysis, no external tool

97-dynamic-cuckoo.sh

Dynamic analysis Tier 4: cuckoo sandbox detonation.

Function	stage_dynamic_cuckoo()
Output	97-dynamic-cuckoo/
Disable with	--dynamic-mode, --no-dynamic-cuckoo
Tools	Inline analysis, no external tool

98-dynamic-trace.sh

Dynamic trace aggregation across all executed dynamic tiers.

Function	stage_dynamic_trace()
Output	92-dynamic-qiling/, 94-dynamic-firejail/, 96-dynamic-docker/, 97-dynamic-cuckoo/, 98-dynamic-trace/
Disable with	--no-dynamic-trace
Tools	Inline analysis, no external tool

Skip control index

Every skip control, the flag that sets it, and the stages it affects.

Environment variable	Flag	Affects
DYNAMIC_MODE	--dynamic-mode	92-dynamic-qiling.sh, 94-dynamic-firejail.sh, 96-dynamic-docker.sh, 97-dynamic-cuckoo.sh
ENABLE_ANGR	--enable-angr	86-angr.sh
ENABLE_CWE_CHECKER	--enable-cwe-checker	34-cwe.sh
ENABLE_YARGEN	--enable-yargen	88-yargen.sh
SKIP_APK	--no-apk	72-apk.sh
SKIP_APKSIG	--no-apksig	78-apksig.sh
SKIP_AUTHENTICODE	--no-authenticode	83-authenticode.sh
SKIP_AXML	--no-axml	76-axml.sh
SKIP_BINARY_DIFF	No flag, environment only	91-binary-diff.sh
SKIP_BLOATY	--no-bloaty	10-pe.sh, 50-elf.sh
SKIP_BULK	--no-bulk	18-bulk.sh
SKIP_CHECKSEC	--no-checksec	50-elf.sh
SKIP_CLAMAV	--no-clamav	00-triage.sh
SKIP_CRYPTOKEYS	--no-cryptokeys	82-cryptokeys.sh
SKIP_DE4DOT	--no-de4dot	20-dotnet.sh
SKIP_DEX	--no-dex	74-dex.sh
SKIP_DNSPY_EX	--no-dnspy-ex	20-dotnet.sh
SKIP_DOTNET	--no-dotnet	20-dotnet.sh
SKIP_DUMPELF	--no-dumpelf	50-elf.sh
SKIP_DYNAMIC_CUCKOO	--no-dynamic-cuckoo	97-dynamic-cuckoo.sh
SKIP_DYNAMIC_DOCKER	--no-dynamic-docker	96-dynamic-docker.sh
SKIP_DYNAMIC_FIREJAIL	--no-dynamic-firejail	94-dynamic-firejail.sh
SKIP_DYNAMIC_QILING	--no-dynamic-qiling	92-dynamic-qiling.sh
SKIP_DYNAMIC_TRACE	--no-dynamic-trace	98-dynamic-trace.sh
SKIP_EAZFIXER	--no-eazfixer	20-dotnet.sh
SKIP_FUZZYHASH	--no-fuzzyhash	81-fuzzyhash.sh
SKIP_GHIDRA	--no-ghidra	30-ghidra.sh
SKIP_GHIDRA_DOTNET	--no-ghidra-dotnet	70-upx.sh
SKIP_GO_DETECT	--no-go-detect	10-pe.sh, 50-elf.sh
SKIP_JAR	--no-jar	58-jar.sh
SKIP_MACHO	--no-macho	52-macho.sh
SKIP_MANALYZE	--no-manalyze	16-manalyze.sh
SKIP_NM_DEMANGLED	--no-nm-demangled	50-elf.sh
SKIP_OLDROD	--no-oldrod	20-dotnet.sh
SKIP_OLE	--no-ole	64-ole.sh
SKIP_PAHOLE	--no-pahole	50-elf.sh
SKIP_PDF	--no-pdf	62-pdf.sh
SKIP_PEFRAME	--no-peframe	17-peframe.sh
SKIP_PYC	--no-pyc	56-pyc.sh
SKIP_R2	--no-r2	40-r2.sh, 42-rizin.sh
SKIP_RETDEC	No flag, environment only	26-retdec.sh
SKIP_ROP_GADGETS	No flag, environment only	46-rop-gadgets.sh
SKIP_RUST_DETECT	--no-rust-detect	10-pe.sh, 50-elf.sh
SKIP_SCANELF	--no-scanelf	50-elf.sh
SKIP_SIGNSRCH	--no-signsrch	00-triage.sh
SKIP_VIZ	--no-viz	89-viz.sh, 90-report.sh
SKIP_WASM	--no-wasm	54-wasm.sh
SKIP_YARA	--no-yara	00-triage.sh
USE_NOFUSEREX	--use-nofuserex	20-dotnet.sh

Skip controls can also be set as environment variables, which is the practical way to make a preference persistent. See Configuration.