Rerius is a static (and, for two architectures, dynamic) binary analysis toolkit: a disassembler, control-flow/call-graph builder, a pseudo-C decompiler, a concrete emulator, and a set of heuristic passes for spotting packing, obfuscation, and anti-analysis tricks. It ships as a standalone CLI, a C library, and a Node.js addon.
It is a research and reverse-engineering aid, not a fully automated malware classifier or a guaranteed decompiler: heuristic passes (entropy, obfuscation signals, function detection on stripped binaries) report a confidence score rather than a certainty, and should be read as leads to investigate, not verdicts.
Most binary analysis tooling is either a heavyweight GUI application or a collection of loosely related scripts. Rerius is built as one coherent, zero-dependency C99 core that the CLI, the C API, and the JS/npm package all share, so a capability added once is available everywhere, and the same analysis logic runs whether you're at a terminal, scripting in Node, or linking the library directly.
| License | Apache 2.0 |
| Language | C99 core · JavaScript (N-API addon, REST server, web UI) |
| Architectures | x86-64, AArch64, RISC-V (RV64GC) |
| Formats | ELF64 (all archs), ELF32 (RV32 only), PE64+, Mach-O 64 + FAT |
| Dependencies | None for the C core |
| Current version | 1.0.0 |
Rerius is built and maintained by ECLS Studio, in the open, under Apache 2.0. There is no separate commercial product or paid tier layered on top of the open-source project: the CLI, library, and npm package are the whole thing.
General contact: hub@rerius.sbs
Bugs and features: GitHub Issues
Questions: GitHub Discussions
Security reports: see the Security Policy: please don't file vulnerabilities as public issues.