4ensics Leviathan · www.4ensics.net
A complete binary analysis, reverse-engineering and digital-forensics workbench — running inside an ordinary browser tab, with your artefacts kept on your machine.
Leviathan is a single-page workbench for anyone who spends their day staring at unknown bytes. It gathers the utilities you normally scatter across a dozen windows — hex editor, signature scanner, string extractor, disassembler, structure parser, diff tool, certificate inspector, PDF surgeon, steganography kit — into one interface with shared bookmarks, a shared evidence log and a one-click case export.
The moment you drop a file onto the page, analysis begins. No installation, no command line, no temporary files scattered across a disk you would rather keep clean.
Leviathan is built with a bias towards a small number of things that really work, over a long catalogue of things that half do.
Built-in analysis runs locally, in a dedicated worker inside your own browser. Raw artefacts are not uploaded to be examined. Work on an air-gapped machine if you need to.
Every panel is published as solid, partial or heuristic — and says so in the panel itself. When a tool is guessing, you are told before you build a conclusion on it.
Bookmarks, evidence, patches, hashes and diffs are shared across every panel and bundled into a single case file you can hand to a colleague.
Open a multi-hundred-megabyte firmware image and the editor still scrolls smoothly. Only what is on screen is rendered; the engine streams the rest in chunks.
Every panel shares the same hex view, the same bookmarks and the same evidence log. Click any result anywhere and the editor jumps to that offset.
The editor
Virtualised rendering, configurable row width and encoding, reversible in-place patching, and a data inspector that reads the byte under your cursor as every common type at once.
Structures & templates
Auto-detects and lays out PNG, JPEG, GIF, BMP, ZIP, gzip, tar, ELF, PE, Mach-O, RIFF, SQLite, TIFF, pcap, OLE/CFB and ASN.1 — every field clickable and cross-linked to its byte range.
Embedded files
Two scanners over the same bytes, merged into one offset-ordered list: 111 signatures that name an object, and 25 structural validators that establish exactly where it ends — no invented boundaries.
Disassembly
A from-scratch x86 / x86-64 Intel-syntax decoder validated byte-for-byte against objdump, plus clearly-labelled heuristic decoders for ARM32, Thumb, AArch64 and MIPS32.
Certificates & keys
Scans for PEM and DER X.509 certificates and renders every common attribute; sweeps for private keys, key stores and OpenSSH material embedded where they should never have been.
Documents & media
Enumerate every PDF object, walk full filter chains and surface JavaScript, embedded files, launch and submit actions. Then go hunting in images, audio and video for what was hidden there.
Indicators & triage
Strings across ASCII and UTF-16, fifteen categories of indicator extraction, timestamp hunting, and PE triage that sketches an unfamiliar Windows binary's behaviour before you commit to reversing it.
Transforms & ciphers
Chain hex, Base64, XOR and inflate into a pipeline where each step feeds the next. Then a full classical-cryptanalysis section with shared input, ranked candidates and repeatable pipelines.
AI marks & content credentials
Invisible-character carriers found at exact byte offsets and decoded back into the text or file they were hiding, provenance metadata read across every common container, and clean removal with a reviewable ledger first.
Filesystems
Read-only SquashFS 4.x and FAT12/16/32 readers walk the directory tree and extract individual files — including deleted FAT entries, recovered best-effort with bounds and cycle guards.
Evidence
Every significant action lands in an append-only log. Seal it into a SHA-256 hash chain, sign the root with Ed25519, and verification pinpoints the first altered entry rather than shrugging.
Reach & extensibility
Passive domain discovery across seventeen sources with per-source outcomes reported honestly. A phone-shaped workbench below 720px. Installable as an app. And an ES-module plugin API for your own formats.
OSINT Discovery is the only part of Leviathan that uses the network, and it has to: a browser cannot perform raw DNS and the sources do not permit direct access from a page. The engine runs on the server, so scans are attributed to the server rather than to you — the panel says so before it says anything else. Nothing is retained there; your runs live in your own browser. Only scan what you are authorised to assess.
No command line. No separate tools. No temporary files left on the analysis machine.
Drag the .bin onto the page. Deep scan reports a U-Image header at 0x0, gzip at 0x40 and SquashFS at 0x200000, with confidence and sizes.
Click the SquashFS hit, open the filesystem panel and the full directory tree appears. Pull out the files you actually care about.
Keys & Secrets surfaces two embedded RSA private keys in the kernel region. Bookmark both; they appear in the editor and on the minimap.
Add a note to the evidence log, seal the chain, and export the whole case as one ZIP for the colleague who picks it up next.
01Malware analysts triaging a sample that arrived an hour ago.
02Forensic examiners pulling artefacts out of a disk or memory dump.
03Firmware engineers unpacking an IoT image nobody documented.
04Incident responders on a machine with no installation rights.
05CTF players who would rather have one tool than twenty.
06Teachers and students learning formats, crypto and reverse engineering.
Published for every panel, and repeated inside the panel itself. Read it before you trust a single verdict — most tools would rather you did not.
| Capability | Status | What that means |
|---|---|---|
| Editor, search, hashes, strings | Solid | Streams over chunks, carries matches across boundaries, handles very large inputs without loading everything into memory. |
| Structures & templates | Solid | Sixteen formats auto-detected and cross-linked, plus a full expression language for describing your own. |
| Embedded files | Solid | Signatures name the object; validators bound it. Formats without a derivable length surface an offset and class rather than a fabricated size. |
| Disassembly (x86 / x86-64) | Solid | Instruction lengths and operands validated byte-for-byte against objdump; RIP-relative targets resolved. |
| Disassembly (other ISAs) | Heuristic | ARM32, Thumb, AArch64 and MIPS32 cover common instructions. Unsupported encodings fall back with an uncertainty marker instead of a guess. |
| Timestamps | Heuristic | Plausible values in five common formats, filtered to a sane range. False positives are possible and expected. |
| Cipher cracking | Heuristic | Direct transforms are exact. Candidate ranking is scored, so short or non-language input can produce persuasive rubbish. It does not claim to break modern cryptography. |
| Rules engine | Partial | YARA-like patterns, modifiers and conditions. Not full YARA, and it says so. |
| C2PA trust | Partial | Signature maths verified; membership of the known-certificate list is not. Leviathan never re-signs, so an edited manifest is reported invalid by design. |
| Statistical AI watermarks | Out of scope | Reading a token-sampling or pixel watermark needs the vendor's secret key. Leviathan says so on every scan rather than implying it looked. |
Raw artefacts are not uploaded by built-in analysis, which runs locally in a dedicated worker. The hosted application still uses the network to sign you in and load its assets, and full-trust plugins can make network requests — so load only plugin code you have reviewed. OSINT Discovery is network-based by necessity and labelled as such.
Leviathan is designed for hundreds of megabytes. The editor renders only what is on screen and the engine streams through the file in chunks, so scrolling stays smooth while an analysis runs.
Only partly, and it is candid about which part. It finds invisible characters inserted into text, decodes anything hidden in them, and reports provenance metadata that declares machine generation. It cannot read a watermark woven into the wording during generation or hidden in an image's pixels — those depend on a secret key the vendor keeps. A clean result is not proof of human authorship, and Leviathan tells you that rather than letting you assume otherwise.
Yes. Once the page is loaded, built-in analysis needs no network access at all. It also installs as an app, and the workbench takes a thumb-friendly shape on a phone.
Yes. Plugins are ES modules loaded at runtime that can register a new side panel and talk to the same bridge as built-in code — a bespoke decoder for your organisation's internal format, without forking anything. They run with full page privileges, so review before you load.
Leviathan is proprietary software. Get in touch and we will talk terms for your team or organisation.
Independent products, built because they should exist.
Blackwall
OAuth 2.1 and OpenID Connect with passkeys only, an integrity-chained audit log and signed project licences — in a single binary.
See BlackwallFury
Hybrid lattice key agreement, identities that cannot be written unprotected, and files that stay private long after today's cryptography stops being enough.
See FuryAsk about licensing, a demonstration for your team, or whether Leviathan will make sense of the artefact currently sitting on your desk.
[email protected]