Under the Hood
A plain-language explainer app for non-engineers — security buyers, journalists, lawyers, curious students — that takes any executable, APK, or script and walks them through what it actually does at the CPU level, in English they can verify.
Security-conscious non-engineers (journalists, lawyers, IT buyers, students) who need to trust what software does
- Drag a .exe, .apk, or .js bundle and get an annotated walkthrough of syscalls, network calls, and memory access
- Side-by-side 'what the AI code-generator told you vs. what runs on the CPU' comparison
- Red-flag detector highlighting unexpected network endpoints, file writes, or obfuscation
- Plain-English glossary of low-level concepts (vtables, SEH, thunks) the Art of 64-bit book exposes
The book makes a sharp point: AI explanations of low-level behavior are routinely wrong, and the gap between plausible-sounding answers and real machine behavior is widening — there is no trustworthy consumer tool filling that gap today.
Established B2B market (Any.Run, VirusTotal, Hybrid Analysis, OPSWAT) shows security teams pay for binary analysis, but no evidence of meaningful consumer/journalist/lawyer demand — adjacent verification workflows exist for newsrooms but target text claims, not executable behavior.ANY.RUN vs Hybrid-Analysis: Features, Integrations, Reviews (2026) ↗Top 10 Hybrid Analysis Alternatives & Competitors in 2026 | G2 ↗
Existing tools (VirusTotal, Any.Run, MetaDefender, Ghidra, AI APK analyzers) target security pros with dashboards full of IoCs, MITRE IDs, and YARA hits — none deliver a plain-English 'here is what it does, you can verify' walkthrough for non-engineers. AI code explainers (Musely, Denigma, toolpix) only handle source code snippets, not compiled binaries/APKs.AI Code Explainer — Understand Any Code in Plain English ↗
Any.Run and VirusTotal prove enterprises pay for sandboxed malware analysis (subscription/credit pricing), but targeting individual journalists, lawyers, and students with a consumer SKU is unproven — likely needs B2B sales to newsrooms and law firms, or heavy freemium, capping near-average monetization.ANY.RUN vs. Hybrid Analysis vs. VirusTotal Comparison ↗Verification Workflows for Newsrooms and Indie Reviewers ↗
Software-trust need is durable and growing, but the pitch's own thesis (AI explanations are routinely wrong) cuts both ways: as foundation models get better at grounded code reasoning, a specialized wrapper has a shrinking moat. Legal/newsroom verification standards are strengthening, supporting longevity, but the core 'CPU-level walkthrough' niche is narrow.From 'trust but verify' to 'do not trust until verified': How the legal profession is redefining AI accountability ↗The Art of 64-Bit Assembly Language ↗
Very hard to build correctly — the entire premise is that LLMs hallucinate low-level behavior, so you must bolt a deterministic disassembler (Ghidra/Binary Ninja/bnil) + APK unpacker + script tracer under the LLM and force-ground every claim, which is months of engineering and ongoing maintenance across architectures, obfuscation, and packers.Android Application Package (APK) Analysis - opswat.com ↗