Static and Live Whole-Machine Reverse Engineering

Analyse executables, firmware and live Windows systems. Freeze execution, inspect and disassemble live memory, patch code or data, then continue running.

VAXD – From Executable Disassembly to Live Machine Analysis

VAXD is a lightweight Windows executable analysis and patch-assistance environment for fast inspection of native PE files, .NET applications, embedded firmware, Linux ELF binaries and raw multi-CPU machine code.

It combines PE inspection, x86/x64 disassembly, .NET decompilation, IL inspection and patching, resource/form inspection, hex editing, patch planning and built-in MultiCPU disassembly in one familiar workflow.

VAXD supports analysing and patching code across multiple processor families and binary formats, including embedded firmware, Linux ELF files, raw binaries, Intel HEX files and Microchip HEX files.

Supported CPU families include:

x86 / x64
ARM32
ARM64
MIPS
PowerPC
8051
6502
Z80
68HC11 / HCS12
PIC
AVR
Motorola 680×0

VAXD is designed for users who want a fast, compact, practical analysis tool without the complexity, installation weight, or learning curve of large reverse-engineering suites.

VAXD_VM goes one step further.

Instead of analysing only an executable file on disk, VAXD_VM runs the software inside a virtual Windows computer and allows the complete machine to be frozen at any moment for analysis.

Freeze the machine. Analyse the live code and memory. Patch it. Resume execution.

“What is inside this executable?”

VAXD_VM also allows the analyst to ask:

“What does this program actually become while it is running?”

That distinction is particularly important with dynamically generated code, unpacked code, runtime-decrypted data, self-modifying programs and software whose significant state exists only after execution has begun.

Don’t just disassemble the executable.

Disassemble the computer running it.

VAXD
File → Analyse → Disassemble → Patch → Save

VAXD_VM
Run → Freeze → Analyse live machine → Patch → Resume

VAXD_VM – Live Whole-Machine Analysis

Traditional executable analysis starts with a file.

VAXD_VM starts with a running computer.

VAXD_VM provides a purpose-built virtual machine environment integrated with VAXD analysis tools. Software runs normally inside the guest Windows system until the analyst chooses to FREEZE the virtual machine.

Once frozen, VAXD_VM can examine the state of the machine from outside the guest operating system.

The workflow is:

Start Windows inside VAXD_VM.
Run the application being investigated.
Allow it to reach the interesting state.
Press FREEZE.
Inspect CPU and machine state.
Search and analyse guest memory.
Locate code, data, strings and interesting memory regions.
Disassemble live x86/x64 code using the integrated VAXD analysis environment.
Modify selected code or data when required.
Resume the virtual machine and observe the result.

The analysed application does not need to be opened in a conventional debugger or modified to cooperate with the analysis environment.

This makes VAXD_VM particularly useful when the interesting code or data exists only at runtime.

Reverse engineering a live machine

Using VAXD_VM can be compared to performing surgery on a running system.

Instead of examining an executable only as a static object, you let it run inside its complete Windows environment. At the interesting moment, freeze the entire virtual computer, inspect its memory and execution state, make controlled changes, and continue running.

The application is analysed externally from the virtual-machine layer rather than through a debugger installed inside the guest.

VAXD versus VAXD_VM

	VAXD	VAXD_VM
Analysis target	Executable / binary file	Complete running virtual computer
Analysis type	Static / file-oriented	Dynamic / live-state
x86/x64 disassembly	Yes	Yes, from live guest memory
PE analysis	Yes	VAXD tools available alongside VM analysis
.NET analysis	Yes	Via VAXD
MultiCPU firmware analysis	Yes	Via VAXD
Memory analysis	File/section oriented	Whole guest physical memory
Runtime-generated code	Limited to exported/captured data	Can be examined after generation
Runtime-decrypted data	Not normally visible in the original file	Can be located in live memory
Patch executable on disk	Yes	—
Patch live memory	—	Yes
Continue execution after patch	—	Yes
Freeze complete machine	—	Yes
Save/load VM state	—	Yes
Guest debugger required	No	No
Guest analysis agent required	No	No

Why Analyse the Whole Machine?

VAXD_VM is not intended to compete with general-purpose desktop virtualisation products.

The virtual machine is the analysis laboratory.

Its purpose is to give VAXD access to the state that exists while software is actually executing.

A program on disk and a program running in memory are not necessarily the same thing. During execution software may:

unpack compressed or protected code;
decrypt executable regions;
generate new code dynamically;
resolve APIs and addresses at runtime;
construct configuration or data structures;
modify its own instructions;
load additional DLLs or components;
produce information that never exists in the original executable file.

With VAXD_VM, the analyst can wait until these operations have occurred, freeze the entire machine, and investigate the resulting state.

One Package – Two Different Perspectives

VAXD — analyse the file

Use VAXD when you want to analyse:

EXE and DLL files
.NET assemblies
ELF binaries
embedded firmware
ROM images
raw binaries
Intel/Microchip HEX
x86/x64 and multiple embedded CPU architectures

VAXD_VM — analyse the running system

Use VAXD_VM when you need to investigate:

code after it has been loaded into memory;
code generated or transformed at runtime;
memory-resident data structures;
unpacked or decrypted regions;
suspicious runtime behaviour;
interactions between executable components;
code that is difficult to understand from static analysis alone;
the effect of controlled live-memory patches.

Static analysis tells you what the file contains.
Live machine analysis shows you what actually exists during execution.

Current VAXD_VM Platform

The initial VAXD_VM virtual-machine platform is designed around Windows 7 x86/x64 guest analysis.

The VM implements the PC hardware environment required to boot and run the guest while exposing machine state to the VAXD analysis layer.

Additional Windows guest support is under development.

Whole-Memory Analysis

VAXD_VM can inspect the memory of the entire virtual computer, rather than being restricted to the original executable image.

Analysis tools can be used to identify interesting regions of guest RAM and distinguish likely code, structured data, strings and high-entropy regions that may contain compressed, encrypted or transformed data.

Interesting regions can then be passed directly to the integrated VAXD x86/x64 analysis environment for closer investigation.

Save and Restore Analysis States

When the virtual machine is frozen, VAXD_VM can save the machine state and restore it later.

This allows particularly useful execution states to become repeatable analysis checkpoints.

For example:

Clean Windows → Start target → Reach interesting state → FREEZE → SAVE

The analyst can then experiment with memory patches or alternative analysis paths and return to the saved state when required.

Controlled Host-to-Guest File Transport

VAXD_VM provides a read-only host-folder transport mechanism for transferring files into the virtual environment.

The guest can obtain analysis targets from the selected host folder without being given unrestricted write access to the host filesystem

Screenshots

VAXD

PE Analyser and file structure view

Disassembler view

.NET resource/form inspection

C# decompiler view

Hex editor and patch comparison view

VAXD-MultiCPU showing 6502 disassembly

VAXD-MultiCPU CPU Detection – Allows to switch CPU mode on the fly for easy discovery of the binary file origin

VAXD_VM

VAXD_VM – Setup tab

VAXD_VM – Windows 7 running inside the analysis VM

VAXD_VM – FREEZE mode with live machine analysis

VAXD_VM – Whole-memory analysis / entropy / Windows discovery

Why VAXD?

VAXD is designed around a practical idea:

Reverse engineering should let the analyst move easily between files, instructions, memory and execution state.

VAXD provides the static side of that workflow: executable analysis, disassembly, decompilation, firmware inspection and patching.

VAXD_VM provides the dynamic side: run the software inside a controlled virtual computer, stop the complete machine at an interesting moment, inspect its live state, patch it and continue execution.

Together they provide two complementary approaches:

Analyse what the developer distributed.

and

Analyse what the computer is actually executing.

Licensing

Free / Evaluation — €0

Evaluate VAXD and VAXD_VM.

Intended for inspection, learning and evaluation. Some save, export and modification functions require a paid license.

VAXD Personal — €49.99 per user

Includes:

VAXD + VAXD_VM

For individual, hobby, educational and non-commercial use.

VAXD Professional — €149 per seat

Includes:

VAXD + VAXD_VM

For professional, commercial, consulting and internal company use.

Site / Lab / Classroom — from €499

Includes VAXD and VAXD_VM for the agreed number of users/seats.

No separate VAXD_VM purchase is required.

Download

Download VAXD: VAXD – 3.80.zip

Download VAXD_VM: VAXD-VM – 20260909