HELIX // STATIC ANALYSIS WORKBENCH

Every artefact. One project. Full static analysis.

Analyse binaries, packets, HTTP, network snapshots, mobile apps, and wireless captures side by side. Disassemble, decompile, and lift binaries to editable source as one capability among many.

Get Helix See what Helix opens

0x14000168cff 83 01 d1sub sp, sp, #0x60

0x140001690fd 7b 05 a9stp x29, x30, [sp, #0x50]

0x140001694f4 4f 04 a9stp x20, x19, [sp, #0x40]

0x140001698fd 43 01 91add x29, sp, #0x50

0x14000169cf3 03 00 aamov x19, x0

0x1400016a060 06 40 f9ldr x0, [x19, #0x8]

0x1400016a408 01 40 b9ldr w8, [x0]

0x1400016a81f 09 00 71cmp w8, #2

0x1400016ac21 01 00 54b.ne 0x1400016d0

0x1400016b020 00 80 d2mov x0, #0x1

0x1400016b4e1 03 13 aamov x1, x19

0x1400016b810 00 40 f9ldr x16, [x0]

0x1400016bc00 02 3f d6blr x16   ; objc_msgSend$retain

0x1400016c0f4 03 00 aamov x20, x0

0x1400016c468 0e 40 b9ldr w8, [x19, #0xc]

0x1400016c81f 05 00 71cmp w8, #1

0x1400016cc41 04 00 54b.ne 0x140001754

0x1400016d008 00 00 90adrp x8, 0x1400a4000

0x1400016d400 01 40 f9ldr x0, [x8, #0x8]  ; _kLicenseKey

0x1400016d8e2 03 14 aamov x2, x20

0x1400016dc00 00 00 94bl validateLicense

0x1400016e0e8 03 00 2amov w8, w0

0x1400016e41f 01 00 71cmp w8, #0

0x1400016e841 04 00 54b.eq 0x140001770  ; license valid

0x1400016ece0 03 08 2amov w0, w8

0x1400016f0fd 7b 45 a9ldp x29, x30, [sp, #0x50]

0x1400016f4f4 4f 44 a9ldp x20, x19, [sp, #0x40]

0x1400016f8ff 83 01 91add sp, sp, #0x60

0x1400016fcc0 03 5f d6ret

// Helix - decompiled: objc_msgSend$retain  (0x14000168c)

// Binary: LicenseManager.dylib · arch: arm64

int objc_msgSend_retain_validateLicense(id self, SEL cmd) {

    LicenseState state = self->licenseState;

    if (state.version != 2) {

        return -1;   // unsupported schema

}

    id retained = objc_msgSend(self, cmd);

    if (state.flags & 0x1) {

        NSString *licenseKey = _kLicenseKey;

        BOOL valid = validateLicense(licenseKey, retained);

        if (!valid) {

            NSLog("License check failed - key=%@", licenseKey);

            return 0;

}

        // renamed symbol: _gActivationState -> activationRecord

        activationRecord->expiryTs = _decryptTimestamp(licenseKey);

        activationRecord->isActive = 1;

}

    return (int)retained;

}

// ─────────────────────────────────────────────────────────

static BOOL validateLicense(NSString *key, id ctx) {

    if (key == nil) return NO;

    uint8_t digest[32];

    CC_SHA256(key.UTF8String, (CC_LONG)(key.length * 1), digest);

    uint32_t expected = _computeChecksum(digest, 32);

    return (expected == ctx->checksum) ? YES : NO;

}

Binary Analysis

Disassemble, decompile, and lift. Then edit and reassemble.

Binary analysis is one of the deepest domains in Helix. Disassemble a function and read the decompiled output as C. Right-click any token to Rename or Reset name - the change is symbol-aware and persists project-wide. Alter goes further: it lifts the binary to editable source, you edit the intermediate representation, and Helix reassembles a runnable child binary.

01.NET IL: ildasm to edit to ilasm round-trip
02Android DEX / smali: baksmali, edit, re-splice, re-sign
03JVM .class text editing via OW2 ASM
04Mach-O repackage and resign in-project
05Renames, types, comments, equates, signatures persisted

// Helix - decompiled: objc_msgSend$retain  (0x14000168c)

// Binary: LicenseManager.dylib · arch: arm64

int objc_msgSend_retain_validateLicense(id self, SEL cmd) {

    LicenseState state = self->licenseState;

    if (state.version != 2) {

        return -1;   // unsupported schema

}

    id retained = objc_msgSend(self, cmd);

    if (state.flags & 0x1) {

        NSString *licenseKey = _kLicenseKey;

        BOOL valid = validateLicense(licenseKey, retained);

        if (!valid) {

            NSLog("License check failed - key=%@", licenseKey);

            return 0;

}

        // renamed symbol: _gActivationState -> activationRecord

        activationRecord->expiryTs = _decryptTimestamp(licenseKey);

        activationRecord->isActive = 1;

}

    return (int)retained;

}

// ─────────────────────────────────────────────────────────

static BOOL validateLicense(NSString *key, id ctx) {

    if (key == nil) return NO;

    uint8_t digest[32];

    CC_SHA256(key.UTF8String, (CC_LONG)(key.length * 1), digest);

    uint32_t expected = _computeChecksum(digest, 32);

    return (expected == ctx->checksum) ? YES : NO;

}

Binary analysis pipeline

Twelve stages. Run and re-run per binary.

When a binary artefact is imported, Helix runs it through a structured pipeline. Each stage is independent: its own Run, Re-run, and Cancel controls, a status pill, a tool-used label, and paginated searchable results. Core analysis requires zero external tools. This pipeline sits inside the same project as your packets, HTTP, and wireless data.

Format & Headers

Imports

Exports

Symbols

Strings

Entropy & Packing

Hashes & Signatures

Function Discovery

Classes / Structures

Embedded Files

Control Flow Graph

Cross-References

Strings

Flags interesting values with offset, encoding (ascii / utf-16le), and length.

Hashes & Signatures

md5, sha1, sha256, ssdeep, tlsh, and code-signing status and team ID.

Embedded Files

Carves container entries, then Import as binary, View as XML, or Extract to Explorer.

One project

Static analysis across every artefact domain. One project file.

Helix is not a binary-only tool. A single project holds binaries, captured packets, HTTP traffic, network snapshots, BLE and Bluetooth data, NFC and RFID records, barcodes, and Flipper Zero captures - each with its own Activity Bar entry, sidebar view, and editor tabs. The Timeline view puts all of them on a single newest-first chronology. Analyse a binary and the traffic it generates without leaving the project.

Binaries

ELF, PE, Mach-O, DEX, APK, IPA, JAR

Packets

pcap, pcapng, Wireshark JSON, ByteSniffer

HTTP Requests

Burp XML, HAR, TunnelSight, raw HTTP

BLE

Devices, GATT, Beacons, Identities

NFC / RFID

NFC Tags, APDU, LF 125kHz, Sub-GHz

Flipper Zero

NFC, Sub-GHz, iButton, IR file import

Network

Snapshots, payload sends

Barcode / QR

Scan via Helper, decode on desktop

Timeline

Unified newest-first across all domains

What Helix opens.
Every format, shipping today.

What the workbench accepts in the private beta running now. No asterisks, no fine print.

Binary

Format: ELF, Mach-O (thin + fat/universal), PE
Arch: x86, x86_64, ARM, ARM64
Sym: Symbol tables, prologue scan, CFG, xrefs
Lift: Disassembly, decompile, editable pseudo-C

Mobile

iOS: IPA extraction and resign
Android: APK, APK splits, AAB, APKM, XAPK; DEX decompile
Parse: Manifest and resource decode
Cert: Resign and repackage
Field: BLE / NFC / RFID / Barcode / Network via Helix Helper or the host's Bluetooth radio; desktop decodes and vendor-enriches
Correlate: Cross-domain timeline; device fingerprinting across rotating UUIDs

Network

Import: pcap, pcapng, Wireshark JSON, ByteSniffer JSON
HTTP: Burp XML, HAR, TunnelSight JSON, raw HTTP; replay
TLS: Decrypted at the proxy, Burp and TunnelSight
Proto: Ethernet, IP, TCP, UDP, DNS, WireGuard

Runtime

MCP: 200+ tools, live, any compatible model
Companion: Helix Helper iOS/iPadOS; on-device stores, Bonjour PIN pairing, chunked offload
Flipper: Flipper Zero detection; NFC/Sub-GHz/LF-RFID/iButton/IR file import

Pricing

Helix

£150

One-time license, covering two major versions

Pay once for the current major version and the next, with every update to both. No subscription.

Get Helix

What you get

Static analysis across binaries, packets, HTTP, network, and wireless artefacts

Disassembly and decompiler output, plus editable pseudo-C lift

Symbol-aware renames, types, comments, labels and equates, persisted per project

Byte-level patching, .NET / DEX / JVM reassembly, and Mach-O resign

Packet dissection, HTTP capture and replay, BLE / NFC / RFID / Flipper Zero

MCP server with 200+ tools for AI-assisted analysis

Two major versions: this release and the next, plus the free Helix Helper iOS companion

Get started