Loupe
PE inspection and an experimental emulation environment
Before execution,
an address has to mean something.
imageInfo.EntryPointVA = imageInfo.ImageBase + uint64(imageInfo.EntryPointRVA)Loupe is an investigation into how a Windows executable is structured, loaded, and eventually observed. Its long-term aim is emulation-based deobfuscation and unpacking.
The current implementation starts with a Portable Executable parser and a Unicorn-based execution harness. It is also a practical study of the boundary between file bytes, virtual memory, and program behavior.
The browser Lab exposes one complete part of that work: static inspection. It uses Loupe’s shared image model to read a file’s structure without running it. No emulation, malware verdicts, or recovered payloads are implied by those results.
Architecture
Experimental execution
Static inspection
Architecture of the shared inspection boundary.
Inspect
Read PE headers, preferred image addresses, and section descriptors. The shared Go core powers the native loader and the browser Lab.
Map
The native CLI maps headers and selected sections into Unicorn memory. This is experimental loader code, not a complete Windows environment.
Instrument
The native harness contains architecture-aware IAT patching and instruction, memory, and API hooks. These are development scaffolding; the Lab does not run them.
Static inspection is available in the browser. Native emulation remains experimental, with incomplete Windows API and process-environment behavior.
Test the native loader and API stubs against controlled fixtures before exposing execution results. Reliable unpacked-output recovery is a future goal.