detect-it-easy

No entries match these filters. Clear filters

1. docs update Oct 11, 2026 · issue 102
   • New detection TinyCC ELF signature
   • Updated detection TinyCC signature reference (second reference added)
   • New detection ELF signatures references
   • Updated detection GS60 protector checks
2. docs update Oct 10, 2026 · issue 101
   • Updated detection GS60 protector detection
   • Updated detection theArk signature x64 support
   • New detection DNGuard detection via HVMRun64.dll
   • Updated detection Packer64 signature checks
   • Updated detection TriProt cryptor detection
   • Updated detection PolyEngine signature detection
   • Updated detection Qihoo sandbox module name matching
   • Updated detection Comodo sandbox module name matching
   • Updated detection Sandboxie module name recognition without extension
   • Updated detection Anti-ILSpy marker scoping to managed strings
   • Updated detection Anti-dnSpy marker scoping to managed strings
   • New detection Embedded Portable PDB debug record detection
   • New detection CodeView PDB path classification
   • Updated detection Relative PDB path vs embedding distinction
   • Updated detection Rewritten instruction operand detection near EP
3. docs update Oct 10, 2026 · issue 101
   • Updated detection GS60 protector checks expanded
   • Updated detection theArk signature gains x64 check
   • New detection DNGuard detection via HVMRun64.dll
   • Updated detection Packer64 signature checks expanded
   • Updated detection TriProt cryptor detection improved
4. docs update Oct 10, 2026 · issue 101

   Detect It Easy documents its PEPEPortable Executable, Microsoft's binary file format for Windows executables and libraries; cyber tools target it because nearly all Windows malware and system code lives in this structure. heuristic engine with malware family coverage, structural triage verdicts, and --heuristicscan --verbose CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds --heuristicscan together with --verbose to expose the fullest heuristic report, with evidence separated into [HEUR/Any], [HEUR/.NET], and [HEUR/EMU] categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the Generic Heuristic Analysis engine (__GenericHeuristicAnalysis_By_DosX.7.sg) for PE files, reporting structural and behavioral anomalies beyond signature matching.
   • Supports three-tier corrupted-data verdicts — Uncritical, Degraded, and Critical — describing the structural impact of image damage rather than only flagging a file as broken.
   • Detects hidden payloads via a built-in known-plaintext attack (KPA) pass that derives repeating XOR/XNOR, ADD/SUB, or reverse-subtraction keys up to 20 bytes from invariant PE-header fields, then validates the decoded image structurally.
   • Recognizes PE modules with specialized extensions such as .bpl (Borland Package), .xll (Microsoft Excel Add-In), .arx (AutoCAD ObjectARX Module), and .wcx (Total Commander Packer Plug-In) instead of issuing blanket warnings.

   +5 more show less

   • Heuristic findings are always marked with (Heur) and kept separate from signature matches, including cases where the engine replaces a misleading signature result with a more precise heuristic conclusion.
   • Covers RAT families including NjRAT, AsyncRAT, NanoCore, Orcus, Gh0st RAT, DarkComet, NetWire, Remcos, and BitRAT via static heuristic checks.
   • Covers stealers including Mars Stealer, Echelon Stealer, StormKitty, and MAX Spyware via static heuristic scoring.
   • Covers ransomware and destructive malware including WannaCry, UX-Locker, Liberium WinLocker, Amp WinLocker, and Olympic Destroyer.
   • Covers file-infecting viruses including Ramnit, Neshta, Slugin, Win9X.CIH, Win9X.Dupator, Parite, and Polip via dedicated static infection checks.

   10 details in Everything

5. docs update Oct 10, 2026 · issue 100
   • New detection Detect HVMRun64.dll as DNGuard
   • Updated detection Add more checks to Packer64 signature
   • Updated detection Improve TriProt cryptor detection
   • Updated detection Improve PolyEngine signature detection
6. docs update Oct 6, 2026 · issue 096
   • Retired detection Obsolete PE packer detection rules removed
7. docs update Oct 5, 2026 · issue 095
   • New detection PE64shell packer signature
   • Updated detection packer_longwasu signature update
   • Updated detection Entropy check bounds improvement
   • Updated detection packer_Origami signature update
   • Updated detection __GenericHeuristicAnalysis_By_DosX signature update
   • New detection Ahri packer signature
8. docs update Oct 4, 2026 · issue 094
   • New detection Ahri packer signature
   • New detection toxicmouse7 signature
   • Updated detection Generic heuristic analysis signature update
   • Updated detection Origami packer signature update
   • Updated detection Longwasu packer signature update
9. docs update Oct 4, 2026 · issue 094
   • New detection toxicmouse7 signature
   • New detection NetPacker signature
   • Updated detection NetPacker signature moved to db
   • New detection Origami .NET packer signature
   • Updated detection longwasu signature restored
10. docs update Sep 15, 2026 · issue 075

    Detect It Easy adds a PEPEPortable Executable, Microsoft's binary file format for Windows executables and libraries; cyber tools target it because nearly all Windows malware and system code lives in this structure. heuristic engine with --heuristicscan and --verbose flags for deep structural and behavioral static analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ TRY IT
    Run the full PE heuristic engine on a suspicious sample to get a verbose evidence map separated by analysis layer — useful for triage when a file evades ordinary signature matching.
    copy

    $ diec --heuristicscan --verbose suspicious.exe

    • Adds --heuristicscan together with --verbose CLI flags to enable the PE heuristic engine and surface its fullest evidence report, with findings separated as [HEUR/Any], [HEUR/.NET], and [HEUR/EMU].⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the Generic Heuristic Analysis engine (__GenericHeuristicAnalysis_By_DosX.7.sg) for PE files, going beyond signature matching to report structural and behavioral anomalies with visible evidence.
    • Supports operand-aware MSILMSILMicrosoft Intermediate Language, the CPU-agnostic bytecode that .NET compilers produce before the JIT compiler translates it to native code, giving cyber tools a stable target for .NET binary analysis and instrumentation. bytecode pattern analysis for managed PE files, covering indirect calls, control-flow transformations, arithmetic mutations, and invalid instruction sequences without requiring a CLR emulator.
    • Adds architecture-aware startup-code analysis for x86/x64 and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. covering PEB access, Trap Flag tricks, direct syscalls, hash-based API resolution, Call/Pop/FPU position recovery, self-modifying stubs, and polymorphic control flow.
    • Adds PE structural integrity checks covering overlapping sections, data-directory mappings, AMD64 unwind records, Guard CF metadata, chained WIN_CERTIFICATE entries, and Authenticode placement.

    +3 more show less

    • Adds PE-aware file-extension classification, naming roles such as .bpl (Borland Package), .xll (Microsoft Excel Add-In), .arx (AutoCAD ObjectARX Module), and .wcx (Total Commander Packer Plug-In) instead of issuing blanket warnings.
    • Extends heuristic coverage to DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. initialization code, closing a blind spot when protected or suspicious behavior starts inside a library rather than an application entry point.
    • Correlates version-resource identity, Authenticode state, Rich build metadata, runtime model, and detected protection to expose masquerading, fake system files, and suspicious builds.

    8 details in Everything

11. docs update Aug 31, 2026 · issue 060

    Detect-It-Easy adds false-signature countermeasures to reduce misidentification.

12. docs update Aug 31, 2026 · issue 060

    Detect-It-Easy adds a documented Generic Heuristic Analysis engine for PEPEPortable Executable, Microsoft's binary file format for Windows executables and libraries; cyber tools target it because nearly all Windows malware and system code lives in this structure. files with surface-level EP emulation, MSILMSILMicrosoft Intermediate Language, the CPU-agnostic bytecode that .NET compilers produce before the JIT compiler translates it to native code, giving cyber tools a stable target for .NET binary analysis and instrumentation. opcode modeling, and cross-layer evidence joining.

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Run the fullest heuristic analysis on a suspicious PE to get cross-layer evidence including packer, protector, .NET obfuscation, and malware-pattern findings.
    copy

    $ diec --heuristicscan --verbose suspicious.exe

    • Adds a Generic Heuristic Analysis engine for PE files that performs multiple specialized passes over native and managed PE images without executing the file, covering headers, data directories, sections, imports, exports, resources, .NET metadata, bytecode, overlays, debug records, and entry-point code.
    • Adds operand-aware MSIL opcode modeling for managed assemblies to detect indirect calls, control-flow transformations, arithmetic mutations, invalid instruction sequences, and other .NET obfuscation patterns.
    • Heuristic results are marked with (Heur) and kept visibly separate from exact signature matches; the engine can also reject misleading signature-database results and replace them with more precise heuristic conclusions (e.g. detecting Rust where a compiler signature would report C/C++).
    • Supports --heuristicscan together with --verbose to produce the fullest heuristic report on the command line.
    • Adds static detection of malware-related patterns including RAT families (NjRAT, AsyncRAT, NanoCore, Orcus, Gh0st RAT, DarkComet, NetWire, Remcos, BitRAT), stealers (Mars Stealer, Echelon Stealer, StormKitty), ransomware (WannaCry, UX-Locker, Olympic Destroyer), file-infecting viruses (Ramnit, Neshta, Slugin, Win9X.CIH, Win9X.Dupator, Parite, Polip), and APT tooling markers (Slingshot APT, Equation Group).

    +2 more show less

    • Adds PE-aware filename-extension classification that names known roles (e.g. .bpl as Borland Package, .xll as Microsoft Excel Add-In, .arx as AutoCAD ObjectARX Module, .wcx as Total Commander Packer Plug-In) and separately reports missing, custom, misleading, or mismatched extensions.
    • Adds a file-extension heuristic providing a broad fallback catalogue of formats and programming languages, cross-checking the extension against whether the file is textual or binary.

    7 details in Everything

13. docs update Aug 31, 2026 · issue 060
    ⤢
    └──▷ TRY IT
    Run a full heuristic triage of a suspicious PE to see every inferred conclusion alongside exact signature matches.
    copy

    $ diec --heuristicscan --verbose <target>

    • Adds --heuristicscan together with --verbose CLI flags to enable and fully expose the Generic Heuristic Analysis engine, which performs multi-pass static analysis of PE files across headers, sections, imports, exports, resources, .NET metadata, bytecode, overlays, debug records, and entry-point code.
    • New operand-aware MSILMSILMicrosoft Intermediate Language, the CPU-agnostic bytecode that .NET compilers produce before the JIT compiler translates it to native code, giving cyber tools a stable target for .NET binary analysis and instrumentation. opcode model for managed (.NET) PE images detects indirect calls, control-flow transformations, arithmetic mutations, encrypted strings, anti-tamper markers, fake metadata, and virtualization-like code.
    • Heuristic engine includes a built-in known-plaintext attack (KPA) pass that derives repeating XOR/XNOR, ADD/SUB, or reverse-subtraction keys up to 20 bytes from invariant PE-header fields, then validates decoded payloads structurally.
    • All heuristic results are labeled with (Heur) and kept visually separate from exact signature matches, with the engine able to override misleading signature results (e.g. promoting a C++ compiler signature to Rust when structural evidence is stronger).
    • New heuristic coverage for .NET obfuscation, native anomalies, packers/protectors, licensing/DRM, format integrity, debug leftovers, malware-related patterns (RATs, stealers, ransomware, file infectors, APT markers), toolchain/platform fingerprinting, and PE-aware filename anomaly classification.

    +2 more show less

    • Adds a file-extension heuristic that cross-checks the file extension against whether the file is textual or binary, providing a broad fallback format catalogue.
    • PE heuristic engine maps unusual file extensions to known roles — for example .bpl as Borland Package, .xll as Microsoft Excel Add-In, .arx as AutoCAD ObjectARX Module, .wcx as Total Commander Packer Plug-In — while separately flagging misleading or missing extensions.
14. docs update Aug 31, 2026 · issue 060

    Detect-It-Easy gains a documented Generic Heuristic Analysis engine for PE files with multi-pass anomaly detection and --heuristicscan --verbose support.

    ⤢
    └──▷ TRY IT
    Run the full heuristic engine on a suspicious PE to see every anomaly pass, tagged separately from signature matches.
    copy

    $ diec --heuristicscan --verbose suspicious.exe

    Write a custom DiE-JS rule that fires when a specific section name is present and reports a compiler with version and compression option.
    📍// Detect It Easy: detection rule file meta( "compiler" "Example Compiler" ); function detect() { if (isSectionNamePresent(".lz-algo")) { sVersion = 1.0; sOptions = LZMA; bDetected = true; } sLang = C/C++; return result(); }
    • Adds --heuristicscan flag (use with --verbose for the fullest report) to invoke the Generic Heuristic Analysis engine, which runs independent passes over PE images without executing the file.
    • New PE heuristic engine performs surface-level emulation of native instructions around the entry point to expose proxy jumps, stack tricks, NOP padding, hidden TLS entry points, and packer stubs.
    • Built-in known-plaintext attack (KPA) pass derives repeating XOR/XNOR, ADD/SUB, or reverse-subtraction keys up to 20 bytes from invariant PE-header fields to detect hidden payloads encoded in resources, sections, or overlays.
    • Heuristic results are always tagged with (Heur) in output and kept separate from exact signature matches; the engine can also override misleading signature-database results with more precise heuristic conclusions.
    • Adds JavaScript heuristic module that distinguishes text from bytecode and detects minified or compiled-looking code.

    +5 more show less

    • Adds file-extension heuristic module that cross-checks file extensions against whether content is actually textual or binary.
    • Adds Batch-script heuristic module that catches UTF-16LE obfuscation and non-textual content hidden inside BAT and CMD files.
    • Ships built-in basic and enhanced YARA-side heuristics for lightweight cross-checking of suspicious PE traits alongside the main DiE engine.
    • Documents DiE-JS rule authoring: result variables bDetected, sName, sVersion, sOptions, sLang, and sType supplied by the engine, with meta() declaring the detection category and name.
    • Integrates Nauz File Detector (NFD) and PEiDPEiDA free Windows utility that detects packers, cryptors, and compilers used on PE executables, helping analysts identify obfuscation before reversing a binary. (with bundled userdb database) as additional independent engines accessible from the same GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

    10 details in Everything

15. docs update Aug 24, 2026 · issue 055

    Detect-It-Easy adds bundles for Fedora, openSUSE, AppImage, S390X, RISC-V, PPC64, Nix, FreeBSD, Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., Parrot OS, Kali Linux, and Termux (CLI)

16. docs update Aug 17, 2026 · issue 048

    Detect-It-Easy adds distribution bundles for Fedora, openSuse, AppImage, S390X, RISC-V, PPC64, Nix, and FreeBSD.

17. 3.20 Apr 20, 2026 · release notes

    detect-it-easy 3.20 adds Microsoft Store port, PEiDPEiDA free Windows utility that detects packers, cryptors, and compilers used on PE executables, helping analysts identify obfuscation before reversing a binary. scanning method, configurable BufferSize, and tray monitoring.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.20 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.20

    • Adds Microsoft Store distribution channel for easy installation
    • Adds BufferSize configuration option to control scan buffer size
    • Introduces PEiD scanning method with improved heuristic module for PE files

    3 details in Everything

18. 3.10 Nov 3, 2024 · release notes

    Detect-It-Easy 3.10 adds APK/DEX/NPM/Amiga analysis support and an extra detection database.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.10 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.10

    • Adds [+] APK/DEX/NPM/Amiga support extending the tool's analysis capabilities to these specific file formats.
    • Adds [+] New "extra" database for not basic detections to detect more obscure or advanced artifacts.

    2 details in Everything

19. 3.09 Dec 28, 2023 · release notes

    Detect-It-Easy 3.09 adds YARA widget, new Heuristic module, and Linux bundles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.09 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.09

    • Adds a Yara widget to the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for custom rule matching
    • Adds a new Heuristic detection module
    • Adds pre-built binary bundles for Ubuntu 23.10, Kali Linux, and Parrot Linux

    3 details in Everything

20. 3.08 Jul 22, 2023 · release notes

    Adds an Ubuntu 23.04 bundle, visualization, new widgets, and new detections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.08 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.08

21. 3.07 Jan 3, 2023 · release notes

    Detect-It-Easy 3.07 adds Ubuntu 22.10 bundle, new UI style/widgets, and updated detection signatures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.07 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.07

    • Adds a pre-built bundle for Ubuntu 22.10
    • Introduces a new visual style
    • Adds new UI widgets to the interface

    3 details in Everything

22. 3.05 Jun 16, 2022 · release notes

    Adds MACHOFAT support, Ubuntu 22.04 and Apple M1 bundles, colored console output, and new detections in Detect-It-Easy 3.05.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.05 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.05

    • Adds MACHOFAT detection support
    • Provides bundles for Ubuntu 22.04 and Apple M1 processors.
    • Enables colored output in the console interface

    3 details in Everything

23. 3.04 Feb 2, 2022 · release notes

    Detect-It-Easy 3.04 adds recursive scan, All types mode, Qt6 compatibility and a new file info module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.04 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.04

    • Adds --recursive (or recursive UI mode) to scan directories and subdirectories
    • Adds All types detection mode to identify any supported filetype without filtering
    • Introduces the new File Info module with expanded metadata extraction capabilities
    • Updates underlying framework to Qt6 for improved stability on modern platforms

    4 details in Everything

24. 3.03 Nov 14, 2021 · release notes

    Detect-It-Easy 3.03 adds lite/console modes, CSV/TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. export via --csv and --tsv, folder scanning, and new detection plugins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.03 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.03

    • Adds Lite version with reduced detection engine

    1 detail in Everything

25. 3.02 Jun 5, 2021 · release notes

    Detect-It-Easy 3.02 introduces a new MachO widget for macOS binaries, Linux AppImage support, and Autotools build system.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.02 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.02

    • New MachO widget added to the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

    1 detail in Everything

26. 3.01 Nov 16, 2020 · release notes

    Detect-It-Easy 3.01 adds x64 Windows support, new HEX editor, disassembler engines, MIME and APK/DEX detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.01 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 3.01

    • Adds an x64 version for Windows.
    • Integrates a new HEX editor directly in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for low-level file inspection
    • Adds a built-in Disassembler engine supporting x86, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware., PPC, and M68K architectures
    • New capability: MIME detection to identify file types via content analysis
    • New capability: APK/DEX detection for analyzing Android application packages and classes

    5 details in Everything

27. 2.05 Oct 6, 2019 · release notes

    Adds JSON output support to the console version of detect-it-easy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.05 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 2.05

    └──▷ TRY IT
    Extract file metadata in a structured format for automation.
    copy

    $ die_console.exe --json <target_file>

28. 2.01 Nov 27, 2018 · release notes

    Detect-It-Easy 2.01 adds UI column resizing and script API functions for checking exports, TLS, imports, and resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.01 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 2.01

    └──▷ TRY IT
    Automate analysis by checking if a binary contains TLS resources using the new script API.
    copy

    $ if (isTLSPresent()) {
      print("Has TLS");
    }

    Adjust column widths in the UI to fit content during interactive scanning.
    📍In the main window, enable the Set column size to contents option in the scan settings.
    • Adds Set column size to contents scan option to the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
    • Adds isExportPresent(), isTLSPresent(), isImportPresent(), isResourcePresent(), isExportFunctionPresent(QString), and isExportFunctionPresentExp(QString) script functions

    2 details in Everything

29. 2.00 Aug 3, 2018 · release notes

    Detect-It-Easy 2.00 adds 500+ detects and a new experimental scanning method

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.00 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 2.00

    • Adds more than 500 new file type and packer detection signatures to the engine.

    1 detail in Everything

30. 0.63 Feb 22, 2007 · release notes

    detect-it-easy 0.63 adds external signing auto-scan, PE validity checks, and per-section disassembly.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.63 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.63

    • Adds the Auto scan with External Sign function to automate verification against external signatures
    • Adds additional static checks for PE file validity during analysis
    • Adds the Disassemble function allowing manual disassembly of individual file sections

    3 details in Everything

31. 0.60 Dec 27, 2006 · release notes

    Adds quick scan from database, Check function for compressed sections, and Delphi 2005/2006 detection support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.60 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.60

    └──▷ HOW TO FIND IT
    Identify compressed sections using the new Check function in the Sections tab.
    📍Look for X indicators in the “?” column of the Sections tab to denote compressed sections.
    • Added a quick scan feature from the database
    • Added a Check function—identifies compressed sections (Sections tab, “?” column; X indicates a compressed section)
    • Added support for Delphi 2005 and 2006

    3 details in Everything

32. 0.59 Aug 30, 2006 · release notes

    Adds Goto button and navigation to DisAsm tab

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.59 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.59

33. 0.57 May 26, 2006 · release notes

    detect-it-easy 0.57 adds Delphi detection, hex viewer controls and auto-save

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.57 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.57

    └──▷ HOW TO FIND IT
    Jump to a specific offset while inspecting binary data.
    📍Use the new Goto button in the Hex Viewer UI
    Ensure plugin configurations persist across restarts without manual export.
    📍Modify a setting; verify it remains after closing and reopening the tool.
    • Adds Delphi version detection to the binary identification capabilities.
    • Adds a Goto button in the Hex Viewer UI for navigation.
    • Enables automatic saving of application settings on change.
    • Adds data copying capability from the Hex Viewer.

    4 details in Everything

34. 0.51 Apr 16, 2006 · release notes

    Detect-It-Easy 0.51 adds double-click Hex Viewer access.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.51 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.51

    • Enables double-clicking to open the Hex Viewer.

    1 detail in Everything

35. 0.52 Apr 16, 2006 · release notes

    Adds a plugin system for loading PEiDPEiDA free Windows utility that detects packers, cryptors, and compilers used on PE executables, helping analysts identify obfuscation before reversing a binary. databases

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.52 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.52

    • Adds support for PEiD database plugins via the PDK interface.
    • Slightly modified PDK to enable plugin functionality.

    2 details in Everything

36. 0.5 Apr 15, 2006 · release notes

    v0.5 adds Hex Viewer, plugin support (C++), section analysis, and new pack detections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5 https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.5

    • [+] Added Hex Viewer
    • [+] Added support for plugins written in C++
    • [+] Added Extra tab
    • [+] Added section analysis (Sections tab)
    • [+] All values ​​are copied using double copy

    +2 more show less

    • [+] Added Obsidium detection
    • [+] Added Molebox detection

    7 details in Everything

37. 0.4b Mar 26, 2006 · release notes

    Adds MD5/CRC-32 hash calculation, Deep Scan and Tray Icon settings, and new packer detections (Armadillo, EXECryptor, UPX).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4b https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.4b

    • Adds Message Digest 5 and CRC-32 (Digest Base 16 and 64) calculation.
    • Adds a Deep Scan setting for more flexible scanning.
    • Adds EXECryptor detection.

    3 details in Everything

38. 0.3b Mar 7, 2006 · release notes

    detect-it-easy v0.3b adds cautious VC++ detection and improved FSG/Delphi analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3b https://github.com/horsicq/Detect-It-Easy.git
    # already have the repo? check out this version:
    $ git checkout 0.3b

    • Adds cautious detection mode for identifying binaries compiled with Microsoft Visual C++
    • Improves detection accuracy for files packed by FSG
    • Improves detection accuracy for Borland Delphi binaries

    3 details in Everything