ThreatWing Decompiler · Manual 1.0
ThreatWing Decompiler manual
The Decompiler is in a hosted beta. There is no anonymous upload; access is granted by request (see the product page). Approved users can open the console, enter their existing tenant API key, and choose Load my jobs. Processing also requires an active beta approval.
1. Prepare your file
Confirm that you have the right to analyze the binary. Work from a copy and keep the original. Record where it came from, when you received it, its size, and its SHA-256 hash. Agree on storage and retention before submitting confidential material.
2. Check the accepted input
Compare the service’s file hash with your recorded SHA-256. Stop if they differ. Check the detected format and architecture. Ask support about file-size limits, archives, packed files, or companion symbols before submitting them; unsupported inputs cannot produce a reliable result.
3. Choose an analysis profile
In New analysis, select your file, choose Decompiler workflow (or another supported profile), read Before you upload, confirm authorization and processing terms, and select Submit processing job. A profile fixes the analyzer version and settings, including time limits. Keep its name and version with the report. Hosted requests do not accept arbitrary shell commands or analyzer arguments.
4. Read the results
Start with the file classification, then inspect strings, imports, sections, control flow, and pseudocode together. Pseudocode approximates a compiled program; it does not recover the original source exactly. Optimization, packing, and missing runtime context can change what you can conclude.
5. Check warnings and incomplete runs
Read any timeout, unsupported-instruction, skipped-stage, or worker-error notice. Treat the affected result as incomplete. Keep the diagnostic message with the report, and do not fill missing information with guesses.
6. Verify a report
Check the input hash, run identifier, analyzer profile and version, timestamps, and warnings. Verify that each exported file is listed with its output hash. A copied report needs the same checks as the original. Remove confidential details before sharing a public summary.
7. Retain or delete
Before you submit a binary, the processing notice explains where it is stored, who can access it, and how long it is kept. Request deletion through the support channel in your beta agreement; this console does not provide a self-service deletion button. Deleting the hosted report cannot recall copies you or another recipient exported.
8. When to stop
Stop for a mismatched file hash, unexplained profile change, missing warnings, or missing processing notice. Ask for help through the channel provided with beta access. Have a qualified reviewer check conclusions used for legal, production, or security decisions.