Static and Live Whole-Machine Reverse Engineering

Analyse executables, firmware and live Windows systems. Freeze execution, inspect and disassemble live memory, patch code or data, then continue running.

Download the VAXD/VAXD-VM Leaflet

VAXD – From Executable Disassembly to Live Machine Analysis

VAXD is a lightweight Windows executable analysis and patch-assistance environment for fast inspection of native PE files, .NET applications, embedded firmware, Linux ELF binaries and raw multi-CPU machine code.

It combines PE inspection, x86/x64 disassembly, .NET decompilation, IL inspection and patching, resource/form inspection, hex editing, patch planning and built-in MultiCPU disassembly in one familiar workflow.

VAXD supports analysing and patching code across multiple processor families and binary formats, including embedded firmware, Linux ELF files, raw binaries, Intel HEX files and Microchip HEX files.

Supported CPU families include:

x86 / x64
ARM32
ARM64
MIPS
PowerPC
8051
6502
Z80
68HC11 / HCS12
PIC
AVR
Motorola 680×0

VAXD is designed for users who want a fast, compact, practical analysis tool without the complexity, installation weight, or learning curve of large reverse-engineering suites.

VAXD_VM goes one step further.

Instead of analysing only an executable file on disk, VAXD_VM runs the software inside a virtual Windows computer and allows the complete machine to be frozen at any moment for analysis.

Freeze the machine. Analyse the live code and memory. Patch it. Resume execution.

“What is inside this executable?”

VAXD_VM also allows the analyst to ask:

“What does this program actually become while it is running?”

That distinction is particularly important with dynamically generated code, unpacked code, runtime-decrypted data, self-modifying programs and software whose significant state exists only after execution has begun.

Don’t just disassemble the executable.

Disassemble the computer running it.

VAXD
File → Analyse → Disassemble → Patch → Save

VAXD_VM
Run → Freeze → Analyse live machine → Patch → Resume

VAXD_VM – Live Whole-Machine & Multi-VM Analysis

Run up to eight Windows/Linux virtual machines, observe them together, freeze the environment, inspect live memory and code, analyse their network traffic, patch execution state and continue running.

Traditional executable analysis starts with a file.

VAXD_VM starts with a running computer.

VAXD_VM provides a purpose-built virtual machine environment integrated with VAXD analysis tools. Software runs normally inside the guest Windows system until the analyst chooses to FREEZE the virtual machine.

Once frozen, VAXD_VM can examine the state of the machine from outside the guest operating system.

The workflow is:

Start Windows inside VAXD_VM.
Run the application being investigated.
Allow it to reach the interesting state.
Press FREEZE.
Inspect CPU and machine state.
Search and analyse guest memory.
Locate code, data, strings and interesting memory regions.
Disassemble live x86/x64 code using the integrated VAXD analysis environment.
Modify selected code or data when required.
Resume the virtual machine and observe the result.

The analysed application does not need to be opened in a conventional debugger or modified to cooperate with the analysis environment.

This makes VAXD_VM particularly useful when the interesting code or data exists only at runtime.

Reverse engineering a live machine

Using VAXD_VM can be compared to performing surgery on a running system.

Instead of examining an executable only as a static object, you let it run inside its complete Windows environment. At the interesting moment, freeze the entire virtual computer, inspect its memory and execution state, make controlled changes, and continue running.

The application is analysed externally from the virtual-machine layer rather than through a debugger installed inside the guest.

VAXD versus VAXD_VM

Analysis capability	VAXD	VAXD_VM
Analysis target	Executable / firmware / binary	Complete running virtual machine
Static executable analysis	Yes	Via integrated VAXD workflow
Live x86/x64 disassembly	—	Yes
Whole physical RAM	—	Yes
Runtime-generated/decrypted code	Limited	Yes
Live memory patching	—	Yes
Continue after patch	—	Yes
Freeze complete machine	—	Yes
Execution breakpoints	—	Yes
Instruction STEP	—	Yes
Machine State history	—	Yes
Windows guest analysis	—	Windows 7 / Windows 10
Linux guests	—	Yes
Multi-vCPU	—	Up to 8
Concurrent VMs	—	Up to 8
Multi-VM overview	—	Yes
Cross-VM process view	—	Yes
Integrated virtual switch	—	Yes
Switch packet analysis	—	Yes
PCAP export	—	Yes
Guest debugger required	No	No
Guest analysis agent required	No	No

Why Analyse the Whole Machine?

VAXD_VM is not intended to compete with general-purpose desktop virtualisation products.

The virtual machine is the analysis laboratory.

Its purpose is to give VAXD access to the state that exists while software is actually executing.

A program on disk and a program running in memory are not necessarily the same thing. During execution software may:

unpack compressed or protected code;
decrypt executable regions;
generate new code dynamically;
resolve APIs and addresses at runtime;
construct configuration or data structures;
modify its own instructions;
load additional DLLs or components;
produce information that never exists in the original executable file.

With VAXD_VM, the analyst can wait until these operations have occurred, freeze the entire machine, and investigate the resulting state.

One Package – Two Different Perspectives

VAXD — analyse the file

Use VAXD when you want to analyse:

EXE and DLL files
.NET assemblies
ELF binaries
embedded firmware
ROM images
raw binaries
Intel/Microchip HEX
x86/x64 and multiple embedded CPU architectures

VAXD_VM — analyse the running system

Use VAXD_VM when you need to investigate:

code after it has been loaded into memory;
code generated or transformed at runtime;
memory-resident data structures;
unpacked or decrypted regions;
suspicious runtime behaviour;
interactions between executable components;
code that is difficult to understand from static analysis alone;
the effect of controlled live-memory patches.

Static analysis tells you what the file contains.
Live machine analysis shows you what actually exists during execution.

Current VAXD_VM Platform

VAXD_VM has evolved from a single-machine analysis VM into a complete multi-machine analysis environment.

The current version supports:

Windows 7 x86/x64 guests
Windows 10 x64 guests
Linux x86/x64 guests
Up to 8 virtual CPUs
Up to 8 concurrent virtual machines
Independent configuration for each VM
Live multi-VM overview
Cross-VM process monitoring
Integrated virtual Ethernet switch
Isolated VM networks or bridging to the physical LAN
Built-in DHCP for isolated VM networks
Switch-level packet capture and protocol analysis
Whole-machine Freeze / Resume
Live RAM inspection, disassembly and patching
Execution breakpoints and instruction STEP
Machine State recording and rewind
HDD, CD/DVD, network, audio, USB and serial-device support

VAXD_VM remains portable and requires no installation of a conventional virtual-machine platform.

The VM layer exists primarily as an analysis instrument: it gives the analyst control over CPU execution, memory, devices and network traffic from outside the guest operating system.

Multi-VM Analysis Laboratory

VAXD_VM can run up to eight virtual machines concurrently.

Each VM remains an independent computer, with its own:

operating system;
RAM and virtual CPUs;
HDD and ISO media;
network interface;
guest display;
analysis context;
Freeze / Resume state;
process and memory information.

This makes it possible to analyse not only one program or one machine, but an entire small virtual environment.

For example:

Client VM → Server VM → Database VM

OVERVIEW — See the Whole Virtual Lab

The OVERVIEW tab provides a live read-only view of all running virtual machines at the same time.

Each VM display is shown in its own panel.

Clicking a machine immediately opens its individual VM tab.

Ctrl+F11 provides a particularly fast workflow: from any VM, press Ctrl+F11 to release the mouse and return directly to OVERVIEW.

This makes moving between several simultaneously running machines almost instantaneous.

When a guest has shut down, its OVERVIEW panel changes to a black OFF display rather than continuing to show the last framebuffer image.

VAXD_VM can also FREEZE ALL or RESUME ALL machines, allowing the state of an entire virtual environment to be stopped for inspection.

I would use exactly the screenshot with Windows 7, Windows 10, Ubuntu and Linux Mint visible. It communicates far more than a paragraph can.

LIVE — Processes Across All Virtual Machines

The LIVE tab provides a single operational view of the processes currently detected across the running virtual machines.

Instead of opening Task Manager or ps separately inside every guest, VAXD_VM observes the machines externally and combines the information into one table.

The LIVE view includes:

VM number
Guest operating system
PID
Process name
CR3/address-space information where available
HDD activity
CD/DVD activity
Network RX/TX activity

The list can be filtered by virtual machine or searched by process, operating system, PID or address-space information.

Windows and Linux guests can therefore be viewed together from the host.

Process monitoring is deliberately lightweight. Sampling is staggered and performed outside the normal virtual-CPU execution path, and the process list is collected only while LIVE monitoring is active.

Virtual Switch and Network Analysis

Multiple VAXD_VM guests can be connected through the integrated virtual Ethernet switch.

The switch can operate in two modes:

Isolated virtual network

The VMs communicate only with each other. An optional built-in DHCP server can automatically provide addresses on the isolated virtual network.

LAN bridge

The virtual switch is bridged through the selected physical host adapter, allowing the VMs to communicate with the external LAN.

Unlike a conventional virtual switch that merely forwards Ethernet frames, the VAXD_VM switch is also an analysis point.

Traffic can be inspected directly inside VAXD_VM.

The SWITCH tab displays:

source and destination VM;
source and destination MAC address;
source and destination IP address;
Ethernet type;
protocol;
frame size;
broadcast, multicast and unicast traffic;
raw packet bytes in hexadecimal/ASCII;
decoded packet details.

Captured traffic can be exported as standard PCAP for further analysis in tools such as Wireshark.

Packet logging can also be disabled when it is not required, reducing monitoring overhead while leaving the virtual network itself operational.

Whole-Machine Analysis

The distinguishing feature of VAXD_VM is not simply that it can run a virtual machine.

It is that the virtual machine itself is instrumented for analysis.

At any point the analyst can freeze a guest and inspect its state from outside the operating system.

Analysis facilities include:

live x86/x64 disassembly from guest memory;
register and CPU-state inspection;
physical and virtual memory browsing;
whole-RAM hex editing;
RAM string searching;
string-to-code XREF correlation;
memory occupancy and entropy maps;
live RAM write-activity heatmaps;
process and address-space discovery;
execution breakpoints;
instruction-by-instruction STEP;
live code/data patching;
.NET assembly recovery from RAM;
network capture and packet inspection;
SAVE / LOAD;
Machine State recording and rewind.

This makes VAXD_VM useful when the interesting state cannot be understood from the executable file alone.

Control an Entire Virtual Environment

Multi-VM controls include:

FREEZE ALL — stop the running virtual machines for inspection;
RESUME ALL — continue execution;
Shutdown All — send an ACPI power-button request to all running guests so Windows/Linux can shut down normally;
Ctrl+F11 — return immediately to OVERVIEW and release mouse capture;
Ctrl+F12 — release captured mouse input.

A guest shutting itself down is detected by VAXD_VM without forcing the user back to SETUP.

Machine State Recording and Time Navigation

VAXD_VM can do considerably more than save a conventional VM snapshot.

Machine State recording creates a complete initial checkpoint and then records changed RAM pages, video memory, CPU/device state and disk changes over time.

The analyst can move backward and forward through the recorded history, inspect an earlier state and then resume execution from that point.

Resuming from an earlier state creates a new execution branch.

This is particularly useful for experiments such as:

Run → observe behaviour → rewind → patch code → run again → compare

Machine State recording is intended for analysis and experimentation rather than deterministic instruction replay. For instruction-level investigation, VAXD_VM provides execution breakpoints and STEP.

Controlled Host-to-Guest File Transport

VAXD_VM provides a read-only host-folder transport mechanism for transferring files into the virtual environment.

The guest can obtain analysis targets from the selected host folder without being given unrestricted write access to the host filesystem

Screenshots

VAXD

PE Analyser and file structure view

Disassembler view

.NET resource/form inspection

C# decompiler view

Hex editor and patch comparison view

VAXD-MultiCPU showing 6502 disassembly

VAXD-MultiCPU CPU Detection – Allows to switch CPU mode on the fly for easy discovery of the binary file origin

VAXD_VM

VAXD_VM – Setup tab

VAXD_VM – Windows 7 running inside the analysis VM

VAXD_VM – FREEZE mode with live machine analysis

VAXD_VM – Whole-memory analysis / entropy / Windows discovery

VAXD Firmware Tools – Open, Inspect and Extract Firmware Images

Firmware analysis often starts before there is an executable to disassemble.

A firmware update may contain raw flash data, filesystem images, bootloaders, compressed sections, executable files, configuration data and several different binary formats combined into a single package.

VAXD Firmware Tools is designed to bridge that gap.

It provides a compact Windows environment for converting, inspecting, comparing, modifying and exploring firmware and disk-image files without requiring a separate Linux system or a collection of unrelated command-line utilities.

From firmware package to the file you actually need

VAXD Firmware Tools can work with common firmware and binary representations including:

Raw binary images
Intel HEX
Motorola S-Record
TI-TXT
UF2
ELF
Firmware and flash images
Disk and filesystem images

Files can be converted between supported representations while preserving address information where applicable.

The integrated Hex Editor allows firmware data to be inspected and modified directly, while comparison, checksum and patching functions help identify changes between firmware revisions or prepare modified images.

Look inside the image

A firmware file is often a container rather than the final analysis target.

The Image Explorer is intended to identify supported disk and flash structures and make their contents directly browsable.

This includes support for several types of filesystem and disk-image formats used in PCs, embedded systems and legacy computers, allowing individual files to be extracted for further analysis.

Instead of:

Firmware image → external extraction tools → copied file → disassembler

the workflow becomes:

Firmware image → Image Explorer → Extract file → Analyse with VAXD

This is particularly useful when an update package contains an embedded operating-system image and the interesting target is an executable, library, configuration file or other object stored somewhere inside it.

Built for practical firmware work

Typical uses include:

Inspecting firmware update packages
Extracting files from embedded filesystem images
Comparing two firmware revisions
Locating changed binary regions
Converting HEX, S-Record, UF2 and binary formats
Examining sparse address ranges
Inspecting raw flash dumps
Editing firmware data at byte level
Calculating and checking checksums
Preparing binary patches
Extracting executables for subsequent reverse engineering

The objective is not to replace specialised forensic tools for every filesystem ever created.

It is to solve a very common reverse-engineering problem:

You have a firmware image. You need to find out what is inside it and get to the code.

VAXD Network Test

Freeware tool for complete and in-depth network testing.

Why VAXD?

VAXD is designed around a practical idea:

Reverse engineering should let the analyst move easily between files, instructions, memory and execution state.

VAXD provides the static side of that workflow: executable analysis, disassembly, decompilation, firmware inspection and patching.

VAXD_VM provides the dynamic side: run the software inside a controlled virtual computer, stop the complete machine at an interesting moment, inspect its live state, patch it and continue execution.

VAXD Firmware Tools: provides a handy tool to inspect and extract the files of interest with a simple workflow Firmware image → Explore → Extract → Convert → Compare → Patch

Together they provide two complementary approaches:

Analyse what the developer distributed.

and

Analyse what the computer is actually executing.

Licensing

Free / Portable VM — €0

VAXD_VM can be used without a license as a portable single-VM host.

No installation of VAXD_VM itself is required. Keep the program and VM files in a folder and run it when required.

The free mode is useful for:

testing unknown executables in a disposable VM;
running a Windows or Linux VM without installing a conventional VM platform;
compatibility testing;
demonstrations and training;
portable troubleshooting environments;
occasional VM use.

The unlicensed edition is limited to one running virtual machine.

Multi-VM operation, the virtual SWITCH, LIVE multi-machine monitoring and the advanced VAXD_VM analysis capabilities require a valid VAXD license.

VAXD Personal — €49.99 per user

Includes VAXD + VAXD_VM.

For individual, hobby, educational and non-commercial use.

Unlocks the complete licensed analysis environment, including multi-VM operation and analysis functions.

VAXD Professional — €149 per seat

Includes VAXD + VAXD_VM.

For professional, commercial, consulting and internal company use.

Provides the complete VAXD and VAXD_VM environment for professional use.

Site / Lab / Classroom — from €499

Includes VAXD + VAXD_VM for the agreed number of users/seats.

Designed for companies, laboratories, training centres, classrooms and other multi-user environments.

Download

Download VAXD: VAXD – 4.40.zip

Download VAXD_VM: VAXD-VM – 20261001

Download VAXD Firmware Tools: VAXD_Firmware_Tools – v2.42

Download VAXD Network Test: VAXD_Network_Test_20261001

VAXD_VM requires Windows Hypervisor Platform on the host.
Npcap is optional and is required when bridging the virtual switch to a physical LAN.