VAXD is a lightweight Windows executable analysis and patch-assistance environment for fast inspection of native PE files, .NET applications, embedded firmware, Linux ELF binaries and raw multi-CPU machine code.
It combines PE inspection, x86/x64 disassembly, .NET decompilation, IL inspection and patching, resource/form inspection, hex editing, patch planning and built-in MultiCPU disassembly in one familiar workflow.
VAXD supports analysing and patching code across multiple processor families and binary formats, including embedded firmware, Linux ELF files, raw binaries, Intel HEX files and Microchip HEX files.
Supported CPU families include:
- x86 / x64
- ARM32
- ARM64
- MIPS
- PowerPC
- 8051
- 6502
- Z80
- 68HC11 / HCS12
- PIC
- AVR
- Motorola 680×0
VAXD is designed for users who want a fast, compact, practical analysis tool without the complexity, installation weight, or learning curve of large reverse-engineering suites.
VAXD is not intended to replace large professional reverse-engineering suites.
It is intended as a fast, approachable and patch-oriented companion tool for quick inspection, learning, firmware browsing, controlled binary editing and authorised software analysis.
Screenshots
PE Analyser and file structure view
Disassembler view
.NET resource/form inspection
C# decompiler view
Hex editor and patch comparison view
VAXD-MultiCPU showing 6502 disassembly
VAXD-MultiCPU CPU Detection – Allows to switch CPU mode on the fly for easy discovery of the binary file origin
Why VAXD?
VAXD is built for speed, simplicity, and practical results.
It is intended for users who want to quickly inspect executable code, understand program behaviour, locate strings and references, plan patches, and perform controlled binary edits without spending unnecessary time configuring complex tools.
Typical users include:
- Hobby reverse engineers
- Embedded developers
- Software developers
- Security researchers
- Malware analysts working in controlled environments
- Students learning assembly and executable structure
- Technicians analysing legacy binaries or firmware
- Developers inspecting their own software
Main Features
PE File Analysis
VAXD opens and analyses native Windows PE executable files, including EXE and DLL files.
Main PE analysis features include:
- Native Windows PE EXE/DLL inspection
- Automatic PE architecture detection
- x86 and x64 disassembly
- Function/subroutine listing
- DLL export detection
- File structure view
- String extraction
- Fast navigation between code, strings, calls, jumps, and patches
Multi-CPU Disassembly
VAXD has built-in support for non-x86 targets and embedded binaries.
Multi-CPU analysis features include:
- ARM32 and ARM64 disassembly
- MIPS disassembly
- PowerPC disassembly
- 8051 disassembly
- 6502 disassembly
- Z80 disassembly
- 68HC11 / HCS12 disassembly
- PIC and AVR inspection workflows
- Motorola 680×0 support
- Raw binary loading
- Linux ELF loading
- Intel HEX / Microchip HEX loading
- Code/data separation where available
- Memory-region mapping
- String extraction
- Cross-reference navigation
- Function navigation
- Patch planning and patched-file output
Architecture Support Overview
| Target | Disassembly | Strings | References | Instruction Editing | Branch Helpers | Patch Export |
|---|---|---|---|---|---|---|
| x86 / x64 PE | Yes | Yes | Yes | Yes | Yes | Yes |
| .NET | C# / IL | Yes | Method navigation | IL patching | Not applicable | Yes |
| ARM32 | Yes | Yes | Where available | Yes | Where supported | Yes |
| ARM64 | Yes | Yes | Where available | Yes | Where supported | Yes |
| MIPS | Yes | Yes | Where available | Limited | Where supported | Yes |
| PowerPC | Yes | Yes | Where available | Limited | Where supported | Yes |
| 8051 | Yes | Yes | Where available | Yes | Where supported | Yes |
| 6502 | Yes | Yes | Where available | Yes | Where supported | Yes |
| Z80 | Yes | Yes | Where available | Yes | Where supported | Yes |
| 68HC11 / HCS12 | Yes | Yes | Where available | Yes | Where supported | Yes |
| PIC / AVR | Yes | Yes | Where available | Limited | Limited | Yes |
| Motorola 680×0 | Yes | Yes | Where available | Limited | Where supported | Yes |
Support depth varies by architecture and file format. The table describes available workflows,
but some patch helpers are architecture-dependent and may be limited by instruction size, addressing mode or binary format.
Disassembly View
The main disassembly view shows decoded instructions in a readable, navigable format.
Each line displays the instruction address, opcode bytes, decoded instruction, operands, and related analysis information.
Disassembly features include:
- Function-based disassembly
- Address and instruction display
- HEX opcode column
- Syntax highlighting
- Jump and call recognition
- Patched instruction highlighting
- User comments
- String reference comments
- Multi-line selection
- Copy selected disassembly lines to the clipboard
- Fast navigation to jump, call, and string destinations
Instruction Editing and Patch Assistance
VAXD includes helper functions for common binary patching operations.
The goal is to make simple patching tasks faster, clearer, and less error-prone by calculating instruction bytes automatically where possible.
Patch features include:
- NOP selected instruction
- NOP multiple selected lines
- Invert conditional jumps where supported
- Change branch/jump destination where supported
- Force conditional jump to unconditional jump where supported
- Automatic relative offset calculation where applicable
- CPU-aware instruction editing
- HEX byte editing
- Patch manager
- Patch navigation
- Patched instruction highlighting
- Save patched executable or binary when licensed
- Export patcher executable where supported
For MultiCPU targets, available patch operations depend on the selected CPU family and instruction encoding rules.
HEX Editor and Patch Comparison
VAXD includes an integrated HEX editor and patch comparison workflow.
The HEX tools are useful for:
- Inspecting original bytes
- Editing raw bytes
- Comparing original and patched data
- Reviewing opcode-level changes
- Verifying patch results
- Understanding how an instruction maps to machine code
The patch manager can show comparative original-versus-patched byte views, helping the user verify exactly what changed before exporting a patched file.
.NET Analysis and Patching
VAXD also includes managed .NET inspection tools.
.NET features include:
- .NET assembly inspection
- C# decompilation
- VB read-only decompilation view
- C# / VB / IL cross-navigation
- IL viewing
- IL patching
- Method navigation
- C# text search
- Resource inspection
- Windows Forms inspection
- Form/resource patching
- Patch manager integration
This makes VAXD useful for both native and managed Windows executable analysis.
Pseudo-Code Generation
VAXD includes pseudo-code generation for selected functions.
The pseudo-code view provides a simplified, readable approximation of the selected routine. It is intended as an analysis aid, helping the user quickly understand the general structure and logic of a function.
Pseudo-code generation can help identify:
- Function structure
- Conditional branches
- Calls
- Return points
- Loops
- Basic control flow
- Common logical patterns
The generated pseudo-code is not intended to be a perfect decompilation. It is a practical helper for faster manual analysis.
Strings, References and Navigation
VAXD includes string inspection and navigation tools for locating important text and understanding where it is used.
String and navigation features include:
- Extracted string listing
- String search
- Optional string filtering
- Column sorting
- String reference navigation where available
- View surrounding strings in memory order
- Copy selected strings
- Jump target navigation
- Call target navigation
- Patch list navigation
- Back and forward navigation
- Search inside the current disassembly
- Search for byte sequences
- Double-click navigation from lists to code
Project Save and Load
Licensed versions of VAXD can save and reload analysis projects.
A saved project can preserve:
- Loaded file information
- Disassembly state
- Function list
- Strings
- User comments
- Patch list
- Navigation and analysis data
This allows longer analysis sessions to continue across multiple launches.
Typical Use Cases
VAXD is intended for legitimate software analysis and inspection tasks, including:
- Analysing native Windows executables
- Inspecting DLL files
- Analysing .NET applications
- Inspecting embedded firmware
- Inspecting Linux ELF binaries
- Analysing raw binary files
- Inspecting Intel HEX and Microchip HEX files
- Understanding program control flow
- Studying jump and call behaviour
- Locating string references
- Inspecting binary patches
- Learning assembly
- Educational reverse-engineering exercises
- Malware triage in controlled environments
- Debugging and interoperability research
- Analysing software you own or are authorized to inspect
Download
Download here: VAXD – 3.51.zip
License
Free / Evaluation
Price: 0 Euro.
Intended for viewing, inspection and evaluation.
Save/export operations are disabled unless a valid paid license is installed.
VAXD Personal
Price: 49.99 Euro per user.
Intended for individual, hobby, learning and non-commercial use.
Includes project save/load, patched EXE/DLL export and patcher generation for personal use.
VAXD Professional
Price: 149 Euro per seat.
Intended for professional, commercial, consulting and company use.
Includes all Personal features and permission to use VAXD for commercial/internal work.
VAXD Site / Lab / Classroom License
Price: from 499 Euro.
Intended for small companies, laboratories, training rooms, schools and internal technical teams.
Contact VMA/Norcam for the exact number of seats and usage terms.
*** Introductory launch offer ***
Early users may request a VAXD Personal license for 29.99 Euro
during the introductory launch period.
This offer may be changed or withdrawn at any time.
Custom, reseller and bulk licensing
Available on request.
Payment and license requests
PayPal/contact email: vma@norcam.pt
Intended Use Notice
VAXD is intended for legitimate software analysis, education, debugging, interoperability research, malware triage, and inspection of software you own or are authorized to analyse.
VAXD is not intended to promote unauthorized software modification, circumvention, cracking, piracy, or misuse of third-party software.
The user is responsible for ensuring that any analysis or modification performed with VAXD complies with applicable laws, license agreements, and authorization boundaries.
Third-Party Components
VAXD uses third-party components under permissive open-source licenses.
Iced
Used for x86/x64 instruction decoding and disassembly.
License: MIT License.
Project: https://github.com/icedland/iced
dnlib
Used for .NET assembly reading, writing and IL patching.
License: MIT License.
Project: https://github.com/0xd4d/dnlib
ICSharpCode.Decompiler / ILSpy engine
Used for .NET C# decompilation.
License: MIT License.
Project: https://github.com/icsharpcode/ILSpy
Microsoft .NET support libraries
Includes System.Buffers, System.Collections.Immutable, System.Memory, System.Numerics.Vectors, System.Reflection.Metadata and System.Runtime.CompilerServices.Unsafe.
License: MIT License.
Third-party license texts are included in the licenses folder.
VirusTotal Report
VAXD is distributed as a protected Windows executable. Some antivirus engines may flag protected or obfuscated binaries heuristically, even when no malicious behaviour is present. Users are encouraged to scan the downloaded archive themselves and compare results over time.
Here is the current Virus Total report. Users are encouraged to submit the downloaded VAXD archive to https://www.virustotal.com/gui/home/upload