Update app.py

app.py

@@ -3,30 +3,119 @@ import os
 import zipfile
 import tempfile
 import pefile
-import shutil
 import subprocess
+import binascii
 import re
-import struct
+import json
 from pathlib import Path
-from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64
 
-st.set_page_config(page_title="Advanced File Analyzer", page_icon="🔍", layout="wide")
+st.set_page_config(page_title="Executable Reverse Engineer", page_icon="🔍", layout="wide")
 
-st.title("Advanced File Analysis Tool")
+st.title("Executable Reverse Engineering Tool")
 st.markdown("""
-This tool allows you to:
-- Extract and view contents of .zip files
-- Decompile .exe files to Python-like code
-- View decompiled code from .dll files
-- Automatically analyze nested executables
+This tool performs reverse engineering on executables (.exe/.dll) to show their inner workings:
+- Disassembles machine code to view assembly instructions
+- Attempts to decompile to pseudocode
+- Shows strings, imports, and other binary artifacts
+- Works with executables from any programming language
 """)
 
+# Install necessary packages at startup
+try:
+    with st.spinner("Setting up reverse engineering environment..."):
+        # Install key analysis libraries
+        subprocess.run(["pip", "install", "pyinstxtractor"], capture_output=True)
+        subprocess.run(["pip", "install", "uncompyle6"], capture_output=True)
+        subprocess.run(["pip", "install", "capstone"], capture_output=True)
+        subprocess.run(["pip", "install", "r2pipe"], capture_output=True)
+        
+        # Import after installation
+        import r2pipe
+        from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64
+        st.success("Environment ready")
+except Exception as e:
+    st.error(f"Setup error: {str(e)}")
+    
+def extract_strings(file_path, min_length=4):
+    """Extract ASCII and Unicode strings from binary file"""
+    try:
+        with open(file_path, 'rb') as f:
+            content = f.read()
+        
+        # Extract ASCII strings
+        ascii_pattern = b'[\\x20-\\x7E]{' + str(min_length).encode() + b',}'
+        ascii_strings = re.findall(ascii_pattern, content)
+        ascii_strings = [s.decode('ascii') for s in ascii_strings]
+        
+        # Extract Unicode strings (basic approach)
+        unicode_pattern = b'(?:[\x20-\x7E]\x00){' + str(min_length).encode() + b',}'
+        unicode_strings = re.findall(unicode_pattern, content)
+        unicode_strings = [s.decode('utf-16-le', errors='ignore').rstrip('\x00') for s in unicode_strings]
+        
+        return sorted(set(ascii_strings + unicode_strings))
+    except Exception as e:
+        return [f"Error extracting strings: {str(e)}"]
+
+def analyze_with_radare2(file_path):
+    """Use radare2 through r2pipe for deep analysis"""
+    try:
+        # Open file with r2pipe
+        r2 = r2pipe.open(file_path)
+        
+        # Perform initial analysis
+        r2.cmd("aaa")  # Analyze all
+        
+        # Get basic information
+        info = json.loads(r2.cmd("ij"))
+        
+        # Get entry point
+        entry_point = r2.cmd("ie")
+        
+        # Get imports
+        imports = r2.cmd("iij")
+        imports = json.loads(imports) if imports else []
+        
+        # Get exports (for DLLs)
+        exports = r2.cmd("iEj")
+        exports = json.loads(exports) if exports else []
+        
+        # Get sections
+        sections = r2.cmd("iSj")
+        sections = json.loads(sections) if sections else []
+        
+        # Disassemble main function
+        main_disasm = r2.cmd("s main; pdf")
+        if not main_disasm or "Cannot find function" in main_disasm:
+            main_disasm = r2.cmd("s entry0; pdf")  # Try entry point instead
+        
+        # Get function list
+        functions = r2.cmd("aflj")
+        functions = json.loads(functions) if functions else []
+        
+        # Get decompiled pseudocode (if available)
+        pseudocode = r2.cmd("s main; pdc")
+        if not pseudocode or pseudocode.strip() == "":
+            pseudocode = r2.cmd("s entry0; pdc")  # Try entry point instead
+        
+        # Close r2
+        r2.quit()
+        
+        return {
+            "info": info,
+            "entry_point": entry_point,
+            "imports": imports,
+            "exports": exports,
+            "sections": sections,
+            "main_disasm": main_disasm,
+            "functions": functions,
+            "pseudocode": pseudocode
+        }
+    except Exception as e:
+        return {"error": f"Radare2 analysis failed: {str(e)}"}
+
 def try_pyinstaller_extraction(file_path, output_dir):
     """Attempt to extract Python scripts from PyInstaller executables"""
     try:
-        # Install pyinstxtractor if not already present
-        subprocess.run(["pip", "install", "pyinstxtractor"], capture_output=True)
-        
         # Run pyinstxtractor on the file
         result = subprocess.run(["python", "-m", "pyinstxtractor", file_path], 
                                cwd=output_dir, capture_output=True, text=True)
@@ -35,8 +124,6 @@ def try_pyinstaller_extraction(file_path, output_dir):
         
         if os.path.exists(extracted_dir):
             # Try to decompile the Python bytecode files
-            subprocess.run(["pip", "install", "uncompyle6"], capture_output=True)
-            
             python_files = {}
             for root, _, files in os.walk(extracted_dir):
                 for file in files:
@@ -44,6 +131,7 @@ def try_pyinstaller_extraction(file_path, output_dir):
                         pyc_path = os.path.join(root, file)
                         py_path = pyc_path + ".py"
                         try:
+                            # Try decompiling with uncompyle6
                             subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True)
                             if os.path.exists(py_path):
                                 with open(py_path, 'r', encoding='utf-8', errors='ignore') as f:
@@ -51,6 +139,35 @@ def try_pyinstaller_extraction(file_path, output_dir):
                                     python_files[rel_path] = f.read()
                         except:
                             pass
+                            
+            # Check if we found the PYZ archive (PyInstaller specific)
+            pyz_files = []
+            for root, _, files in os.walk(extracted_dir):
+                for file in files:
+                    if file.endswith('.pyz'):
+                        pyz_path = os.path.join(root, file)
+                        # Extract PYZ contents
+                        pyz_extract_dir = pyz_path + "_extracted"
+                        os.makedirs(pyz_extract_dir, exist_ok=True)
+                        try:
+                            # Extract PYZ files (these contain most of the Python modules)
+                            subprocess.run(["python", "-m", "pyinstxtractor", pyz_path], 
+                                          cwd=output_dir, capture_output=True)
+                            for pyz_root, _, pyz_files in os.walk(pyz_extract_dir):
+                                for pyz_file in pyz_files:
+                                    if pyz_file.endswith('.pyc') or pyz_file.endswith('.pyo'):
+                                        pyc_path = os.path.join(pyz_root, pyz_file)
+                                        py_path = pyc_path + ".py"
+                                        try:
+                                            subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True)
+                                            if os.path.exists(py_path):
+                                                with open(py_path, 'r', encoding='utf-8', errors='ignore') as f:
+                                                    rel_path = os.path.join("PYZ_ARCHIVE", os.path.relpath(pyc_path, pyz_extract_dir))
+                                                    python_files[rel_path] = f.read()
+                                        except:
+                                            pass
+                        except:
+                            pass
             
             return {
                 "success": True,
@@ -67,264 +184,106 @@ def try_pyinstaller_extraction(file_path, output_dir):
             "message": f"PyInstaller extraction error: {str(e)}"
         }
 
-def disassemble_binary(file_path, is_dll=False):
-    """Disassemble a binary file to approximate code"""
+def analyze_binary(file_path, is_dll=False):
+    """Comprehensive analysis of a binary file"""
     try:
-        pe = pefile.PE(file_path)
-        
-        # Determine if 32-bit or 64-bit
-        is_64bit = pe.OPTIONAL_HEADER.Magic == 0x20b
-        mode = CS_MODE_64 if is_64bit else CS_MODE_32
-        
-        # Initialize disassembler
-        md = Cs(CS_ARCH_X86, mode)
-        md.detail = True
-        
-        code_sections = []
-        
-        # Find the entry point for EXEs
-        entry_point = None
-        if not is_dll:
-            entry_rva = pe.OPTIONAL_HEADER.AddressOfEntryPoint
-            for section in pe.sections:
-                if section.contains_rva(entry_rva):
-                    entry_offset = entry_rva - section.VirtualAddress + section.PointerToRawData
-                    entry_point = entry_offset
-        
-        # Process each section
-        for section in pe.sections:
-            section_name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
-            
-            # Focus on code sections
-            if section.Characteristics & 0x20000000:  # IMAGE_SCN_CNT_CODE
-                section_data = pe.get_data(section.VirtualAddress, section.SizeOfRawData)
-                
-                # Start disassembly from entry point if in this section
-                start_offset = 0
-                if entry_point is not None and section.contains_rva(pe.OPTIONAL_HEADER.AddressOfEntryPoint):
-                    start_offset = entry_point - section.PointerToRawData
-                
-                # Limit to reasonable size for preview
-                preview_size = min(len(section_data) - start_offset, 4096)
-                
-                # Disassemble
-                disassembly = []
-                is_entry = entry_point is not None and section.contains_rva(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
-                
-                for i, (address, size, mnemonic, op_str) in enumerate(md.disasm_lite(
-                        section_data[start_offset:start_offset+preview_size], 
-                        section.VirtualAddress + start_offset)):
-                    
-                    # Mark entry point
-                    entry_marker = "ENTRY POINT -> " if is_entry and i == 0 else ""
-                    disassembly.append(f"{entry_marker}0x{address:08x}: {mnemonic} {op_str}")
-                
-                code_sections.append({
-                    "name": section_name,
-                    "disassembly": disassembly
-                })
+        results = {}
         
-        # Get exports for DLLs
-        exports = []
-        if is_dll and hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
-            for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
-                if exp.name:
-                    exports.append(exp.name.decode('utf-8', errors='ignore'))
-        
-        # Convert to pseudo-Python
-        pseudo_python = generate_pseudo_python(code_sections, exports, is_dll)
-        
-        return {
-            "success": True,
-            "code_sections": code_sections,
-            "exports": exports,
-            "pseudo_python": pseudo_python
-        }
-    except Exception as e:
-        return {
-            "success": False,
-            "message": f"Disassembly error: {str(e)}"
-        }
-
-def generate_pseudo_python(code_sections, exports, is_dll):
-    """Generate pseudo-Python code from disassembly"""
-    pseudo_code = []
-    
-    pseudo_code.append("# This is an approximation generated from binary code")
-    pseudo_code.append("# It is NOT the original source code")
-    pseudo_code.append("")
-    
-    if is_dll:
-        pseudo_code.append("# DLL Export Functions")
-        for export in exports:
-            pseudo_code.append(f"def {export}():")
-            pseudo_code.append("    # Implementation not recoverable from binary")
-            pseudo_code.append("    pass")
-            pseudo_code.append("")
-    
-    for section in code_sections:
-        pseudo_code.append(f"# Code Section: {section['name']}")
-        pseudo_code.append("def main():")
-        
-        # Very basic pattern recognition for common operations
-        in_function = False
-        current_function = None
-        
-        # Extract common patterns from assembly
-        for line in section['disassembly'][:100]:  # Limit to first 100 instructions for preview
-            # Look for call instructions to infer function calls
-            if "call" in line and "0x" in line:
-                addr = re.search(r'0x[0-9a-f]+', line)
-                if addr:
-                    pseudo_code.append(f"    call_function_{addr.group(0)}()")
-            # Look for mov instructions to infer variable assignments
-            elif "mov" in line:
-                reg_match = re.search(r'mov\s+(\w+),\s+(.+)', line)
-                if reg_match:
-                    dest, source = reg_match.groups()
-                    pseudo_code.append(f"    {dest} = {source}  # {line}")
-            # Look for common comparisons
-            elif "cmp" in line:
-                cmp_match = re.search(r'cmp\s+(\w+),\s+(.+)', line)
-                if cmp_match:
-                    a, b = cmp_match.groups()
-                    pseudo_code.append(f"    if {a} == {b}:  # {line}")
-                    pseudo_code.append("        pass")
-            else:
-                pseudo_code.append(f"    # {line}")
-                
-        pseudo_code.append("")
-        
-        pseudo_code.append("if __name__ == '__main__':")
-        pseudo_code.append("    main()")
-        pseudo_code.append("")
-    
-    return "\n".join(pseudo_code)
-
-def unpack_exe(file_path, output_dir):
-    """Extract information from an EXE file and attempt to convert to Python"""
-    try:
+        # Basic PE information using pefile
         pe = pefile.PE(file_path)
         
-        # Basic PE information
-        info = {
+        # General info
+        results["basic_info"] = {
             "Machine": hex(pe.FILE_HEADER.Machine),
             "TimeDateStamp": pe.FILE_HEADER.TimeDateStamp,
             "NumberOfSections": pe.FILE_HEADER.NumberOfSections,
-            "Sections": []
+            "SizeOfImage": pe.OPTIONAL_HEADER.SizeOfImage,
+            "EntryPoint": hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint),
+            "ImageBase": hex(pe.OPTIONAL_HEADER.ImageBase),
+            "Subsystem": pe.OPTIONAL_HEADER.Subsystem
         }
         
-        # Get section information
+        # Section information
+        results["sections"] = []
         for section in pe.sections:
             section_name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
-            info["Sections"].append({
+            results["sections"].append({
                 "Name": section_name,
                 "VirtualAddress": hex(section.VirtualAddress),
+                "VirtualSize": section.Misc_VirtualSize,
                 "SizeOfRawData": section.SizeOfRawData,
-                "Entropy": section.get_entropy()
+                "Entropy": section.get_entropy(),
+                "Characteristics": hex(section.Characteristics)
             })
         
-        # Get imports
+        # Import information
+        results["imports"] = []
         if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
-            info["Imports"] = []
             for entry in pe.DIRECTORY_ENTRY_IMPORT:
                 dll_name = entry.dll.decode('utf-8', errors='ignore')
                 imports = []
                 for imp in entry.imports:
                     if imp.name:
                         imports.append(imp.name.decode('utf-8', errors='ignore'))
-                info["Imports"].append({
+                results["imports"].append({
                     "DLL": dll_name,
                     "Functions": imports
                 })
         
-        # Extract resources if present
-        if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
-            resource_dir = os.path.join(output_dir, "resources")
-            os.makedirs(resource_dir, exist_ok=True)
-            extracted_resources = []
-            
-            for resource_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:
-                if hasattr(resource_type, 'directory'):
-                    for resource_id in resource_type.directory.entries:
-                        if hasattr(resource_id, 'directory'):
-                            for resource_lang in resource_id.directory.entries:
-                                data = pe.get_data(resource_lang.data.struct.OffsetToData, resource_lang.data.struct.Size)
-                                resource_filename = f"resource_{resource_type.id}_{resource_id.id}_{resource_lang.id}"
-                                resource_path = os.path.join(resource_dir, resource_filename)
-                                with open(resource_path, 'wb') as f:
-                                    f.write(data)
-                                extracted_resources.append(resource_filename)
-            
-            info["ExtractedResources"] = extracted_resources
-        
-        # Try to disassemble and convert to pseudo-Python
-        disassembly_result = disassemble_binary(file_path)
-        
-        # Try PyInstaller extraction for Python executables
-        pyinstaller_result = try_pyinstaller_extraction(file_path, output_dir)
-        
-        return {
-            "basic_info": info,
-            "disassembly": disassembly_result,
-            "pyinstaller": pyinstaller_result
-        }
-    except Exception as e:
-        return {"Error": str(e)}
-
-def analyze_dll(file_path):
-    """Extract information and code from a DLL file"""
-    try:
-        pe = pefile.PE(file_path)
-        
-        # Basic information
-        info = {
-            "Machine": hex(pe.FILE_HEADER.Machine),
-            "TimeDateStamp": pe.FILE_HEADER.TimeDateStamp,
-            "NumberOfSections": pe.FILE_HEADER.NumberOfSections,
-            "Characteristics": hex(pe.FILE_HEADER.Characteristics),
-            "DllCharacteristics": hex(pe.OPTIONAL_HEADER.DllCharacteristics),
-            "Sections": []
-        }
-        
-        # Get section information
-        for section in pe.sections:
-            section_name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
-            info["Sections"].append({
-                "Name": section_name,
-                "VirtualAddress": hex(section.VirtualAddress),
-                "SizeOfRawData": section.SizeOfRawData,
-                "Entropy": section.get_entropy()
-            })
-        
-        # Get exports
-        if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
-            info["Exports"] = []
+        # Export information (for DLLs)
+        results["exports"] = []
+        if is_dll and hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
             for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
                 if exp.name:
-                    info["Exports"].append(exp.name.decode('utf-8', errors='ignore'))
+                    results["exports"].append({
+                        "Name": exp.name.decode('utf-8', errors='ignore'),
+                        "Address": hex(pe.OPTIONAL_HEADER.ImageBase + exp.address),
+                        "Ordinal": exp.ordinal
+                    })
         
-        # Get imports
-        if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
-            info["Imports"] = []
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                dll_name = entry.dll.decode('utf-8', errors='ignore')
-                imports = []
-                for imp in entry.imports:
-                    if imp.name:
-                        imports.append(imp.name.decode('utf-8', errors='ignore'))
-                info["Imports"].append({
-                    "DLL": dll_name,
-                    "Functions": imports
-                })
+        # Extract strings
+        results["strings"] = extract_strings(file_path)
         
-        # Try to disassemble and convert to pseudo-Python
-        disassembly_result = disassemble_binary(file_path, is_dll=True)
+        # Use Radare2 for deeper analysis if available
+        try:
+            r2_results = analyze_with_radare2(file_path)
+            if "error" not in r2_results:
+                results["disassembly"] = r2_results["main_disasm"]
+                results["functions"] = r2_results["functions"]
+                results["pseudocode"] = r2_results["pseudocode"]
+            else:
+                # Fallback to basic disassembly with Capstone
+                from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64
+                
+                # Determine if 32-bit or 64-bit
+                is_64bit = pe.OPTIONAL_HEADER.Magic == 0x20b
+                mode = CS_MODE_64 if is_64bit else CS_MODE_32
+                
+                # Initialize disassembler
+                md = Cs(CS_ARCH_X86, mode)
+                md.detail = True
+                
+                # Find the entry point
+                entry_rva = pe.OPTIONAL_HEADER.AddressOfEntryPoint
+                for section in pe.sections:
+                    if section.contains_rva(entry_rva):
+                        # Calculate file offset of entry point
+                        entry_offset = entry_rva - section.VirtualAddress + section.PointerToRawData
+                        entry_data = pe.get_memory_mapped_image()[entry_rva:entry_rva+512]  # Get 512 bytes from entry
+                        
+                        disassembly = []
+                        for i, (address, size, mnemonic, op_str) in enumerate(md.disasm_lite(entry_data, pe.OPTIONAL_HEADER.ImageBase + entry_rva)):
+                            if i >= 100:  # Limit to 100 instructions for preview
+                                break
+                            disassembly.append(f"0x{address:08x}: {mnemonic} {op_str}")
+                        
+                        results["disassembly"] = "\n".join(disassembly)
+                        break
+        except ImportError:
+            # If r2pipe or capstone isn't available
+            results["disassembly"] = "Advanced disassembly not available. Install r2pipe or capstone."
         
-        return {
-            "basic_info": info,
-            "disassembly": disassembly_result
-        }
+        return results
     except Exception as e:
         return {"Error": str(e)}
 
@@ -350,12 +309,13 @@ def process_zip_file(file_path, temp_dir):
                         os.makedirs(exe_output_dir, exist_ok=True)
                         nested_files[rel_path] = {
                             'type': 'exe',
-                            'info': unpack_exe(full_path, exe_output_dir)
+                            'analysis': analyze_binary(full_path),
+                            'python_extraction': try_pyinstaller_extraction(full_path, exe_output_dir)
                         }
                     elif file.endswith('.dll'):
                         nested_files[rel_path] = {
                             'type': 'dll',
-                            'info': analyze_dll(full_path)
+                            'analysis': analyze_binary(full_path, is_dll=True)
                         }
             
             return {
@@ -377,133 +337,260 @@ if uploaded_file is not None:
         
         st.success(f"File uploaded: {uploaded_file.name}")
         
+        # Display file size
+        file_size = os.path.getsize(file_path)
+        st.info(f"File size: {file_size/1024:.2f} KB")
+        
         # Process based on file type
         if uploaded_file.name.lower().endswith('.zip'):
             st.subheader("ZIP File Contents")
-            output_dir = os.path.join(temp_dir, "extracted")
-            os.makedirs(output_dir, exist_ok=True)
-            
-            result = process_zip_file(file_path, output_dir)
-            
-            if 'error' in result:
-                st.error(f"Error processing ZIP file: {result['error']}")
-            else:
-                with st.expander("ZIP Contents", expanded=True):
-                    st.write(f"Total files: {len(result['file_list'])}")
-                    st.json(result['file_list'])
+            with st.spinner("Analyzing ZIP contents..."):
+                output_dir = os.path.join(temp_dir, "extracted")
+                os.makedirs(output_dir, exist_ok=True)
                 
-                if result['nested_files']:
-                    st.subheader("Detected Executable Files")
-                    for file_path, file_info in result['nested_files'].items():
-                        with st.expander(f"{file_path} ({file_info['type'].upper()})"):
-                            if file_info['type'] == 'exe':
-                                tabs = st.tabs(["Basic Info", "Python Code", "Disassembly"])
-                                with tabs[0]:
-                                    st.json(file_info['info'].get('basic_info', {}))
-                                with tabs[1]:
-                                    pyinstaller_result = file_info['info'].get('pyinstaller', {})
-                                    disassembly = file_info['info'].get('disassembly', {})
+                result = process_zip_file(file_path, output_dir)
+                
+                if 'error' in result:
+                    st.error(f"Error processing ZIP file: {result['error']}")
+                else:
+                    with st.expander("ZIP Contents", expanded=True):
+                        st.write(f"Total files: {len(result['file_list'])}")
+                        st.code("\n".join(result['file_list']))
+                    
+                    if result['nested_files']:
+                        st.subheader("Detected Executable Files")
+                        for file_path, file_info in result['nested_files'].items():
+                            with st.expander(f"{file_path} ({file_info['type'].upper()})"):
+                                if file_info['type'] == 'exe':
+                                    analysis = file_info['analysis']
+                                    python_extraction = file_info['python_extraction']
+                                    
+                                    tabs = st.tabs(["Summary", "Imports", "Strings", "Assembly", "Python Code"])
+                                    
+                                    with tabs[0]:
+                                        if "Error" in analysis:
+                                            st.error(analysis["Error"])
+                                        else:
+                                            st.json(analysis.get("basic_info", {}))
+                                            
+                                            st.subheader("Sections")
+                                            sections_df = {
+                                                "Name": [],
+                                                "VirtualSize": [],
+                                                "SizeOfRawData": [],
+                                                "Entropy": []
+                                            }
+                                            for section in analysis.get("sections", []):
+                                                sections_df["Name"].append(section["Name"])
+                                                sections_df["VirtualSize"].append(section["VirtualSize"])
+                                                sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                                                sections_df["Entropy"].append(section["Entropy"])
+                                            
+                                            st.dataframe(sections_df)
+                                    
+                                    with tabs[1]:
+                                        for imp in analysis.get("imports", []):
+                                            with st.expander(f"DLL: {imp['DLL']}"):
+                                                st.code("\n".join(imp["Functions"]))
+                                    
+                                    with tabs[2]:
+                                        st.subheader("Strings Found")
+                                        all_strings = analysis.get("strings", [])
+                                        interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
+                                        st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
+                                    
+                                    with tabs[3]:
+                                        st.subheader("Disassembly")
+                                        if "disassembly" in analysis:
+                                            st.code(analysis["disassembly"], language="asm")
+                                        else:
+                                            st.warning("Disassembly not available")
+                                        
+                                        if "pseudocode" in analysis and analysis["pseudocode"]:
+                                            st.subheader("Decompiled Pseudocode")
+                                            st.code(analysis["pseudocode"], language="c")
+                                    
+                                    with tabs[4]:
+                                        if python_extraction.get("success", False):
+                                            st.success("Python code extracted successfully!")
+                                            for filename, content in python_extraction.get("files", {}).items():
+                                                with st.expander(f"Python File: {filename}"):
+                                                    st.code(content, language="python")
+                                        else:
+                                            st.warning(python_extraction.get("message", "Not a Python executable or extraction failed."))
+                                else:  # DLL
+                                    analysis = file_info['analysis']
+                                    
+                                    tabs = st.tabs(["Summary", "Exports", "Imports", "Strings", "Assembly"])
+                                    
+                                    with tabs[0]:
+                                        if "Error" in analysis:
+                                            st.error(analysis["Error"])
+                                        else:
+                                            st.json(analysis.get("basic_info", {}))
+                                            
+                                            st.subheader("Sections")
+                                            sections_df = {
+                                                "Name": [],
+                                                "VirtualSize": [],
+                                                "SizeOfRawData": [],
+                                                "Entropy": []
+                                            }
+                                            for section in analysis.get("sections", []):
+                                                sections_df["Name"].append(section["Name"])
+                                                sections_df["VirtualSize"].append(section["VirtualSize"])
+                                                sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                                                sections_df["Entropy"].append(section["Entropy"])
+                                            
+                                            st.dataframe(sections_df)
                                     
-                                    if pyinstaller_result.get('success', False):
-                                        st.success("Python code extracted successfully!")
-                                        for filename, content in pyinstaller_result.get('files', {}).items():
-                                            with st.expander(f"Python File: {filename}"):
-                                                st.code(content, language="python")
-                                    else:
-                                        st.warning("Not a Python executable or extraction failed.")
-                                        st.subheader("Generated Python-like Code")
-                                        st.code(disassembly.get('pseudo_python', "# No code could be generated"), language="python")
-                                with tabs[2]:
-                                    disassembly = file_info['info'].get('disassembly', {})
-                                    if disassembly.get('success', False):
-                                        for section in disassembly.get('code_sections', []):
-                                            with st.expander(f"Section: {section['name']}"):
-                                                st.code("\n".join(section['disassembly']), language="asm")
-                                    else:
-                                        st.error(disassembly.get('message', "Disassembly failed"))
-                            else:  # DLL
-                                tabs = st.tabs(["Basic Info", "DLL Code", "Exports/Imports"])
-                                with tabs[0]:
-                                    st.json(file_info['info'].get('basic_info', {}))
-                                with tabs[1]:
-                                    disassembly = file_info['info'].get('disassembly', {})
-                                    st.subheader("Generated Python-like Code")
-                                    st.code(disassembly.get('pseudo_python', "# No code could be generated"), language="python")
-                                with tabs[2]:
-                                    basic_info = file_info['info'].get('basic_info', {})
-                                    if 'Exports' in basic_info:
+                                    with tabs[1]:
                                         st.subheader("Exported Functions")
-                                        st.json(basic_info['Exports'])
-                                    if 'Imports' in basic_info:
-                                        st.subheader("Imported DLLs and Functions")
-                                        st.json(basic_info['Imports'])
+                                        st.json(analysis.get("exports", []))
+                                    
+                                    with tabs[2]:
+                                        for imp in analysis.get("imports", []):
+                                            with st.expander(f"DLL: {imp['DLL']}"):
+                                                st.code("\n".join(imp["Functions"]))
+                                    
+                                    with tabs[3]:
+                                        st.subheader("Strings Found")
+                                        all_strings = analysis.get("strings", [])
+                                        interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
+                                        st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
+                                    
+                                    with tabs[4]:
+                                        st.subheader("Disassembly")
+                                        if "disassembly" in analysis:
+                                            st.code(analysis["disassembly"], language="asm")
+                                        else:
+                                            st.warning("Disassembly not available")
+                                        
+                                        if "pseudocode" in analysis and analysis["pseudocode"]:
+                                            st.subheader("Decompiled Pseudocode")
+                                            st.code(analysis["pseudocode"], language="c")
         
         elif uploaded_file.name.lower().endswith('.exe'):
-            st.subheader("EXE File Analysis and Decompilation")
-            output_dir = os.path.join(temp_dir, "exe_unpacked")
-            os.makedirs(output_dir, exist_ok=True)
-            
-            try:
-                exe_info = unpack_exe(file_path, output_dir)
+            st.subheader("EXE File Analysis")
+            with st.spinner("Reverse engineering executable..."):
+                output_dir = os.path.join(temp_dir, "exe_unpacked")
+                os.makedirs(output_dir, exist_ok=True)
+                
+                # Perform comprehensive analysis
+                analysis = analyze_binary(file_path)
+                
+                # Try Python extraction
+                python_extraction = try_pyinstaller_extraction(file_path, output_dir)
+                
+                tabs = st.tabs(["Summary", "Imports", "Strings", "Assembly", "Python Code"])
                 
-                tabs = st.tabs(["Basic Info", "Python Code", "Disassembly", "Resources"])
                 with tabs[0]:
-                    st.json(exe_info.get('basic_info', {}))
+                    if "Error" in analysis:
+                        st.error(analysis["Error"])
+                    else:
+                        st.subheader("Basic Information")
+                        st.json(analysis.get("basic_info", {}))
+                        
+                        st.subheader("Sections")
+                        sections_df = {
+                            "Name": [],
+                            "VirtualSize": [],
+                            "SizeOfRawData": [],
+                            "Entropy": []
+                        }
+                        for section in analysis.get("sections", []):
+                            sections_df["Name"].append(section["Name"])
+                            sections_df["VirtualSize"].append(section["VirtualSize"])
+                            sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                            sections_df["Entropy"].append(section["Entropy"])
+                        
+                        st.dataframe(sections_df)
+                
                 with tabs[1]:
-                    pyinstaller_result = exe_info.get('pyinstaller', {})
-                    disassembly = exe_info.get('disassembly', {})
+                    st.subheader("Imported Functions")
+                    for imp in analysis.get("imports", []):
+                        with st.expander(f"DLL: {imp['DLL']}"):
+                            st.code("\n".join(imp["Functions"]))
+                
+                with tabs[2]:
+                    st.subheader("Strings Found")
+                    all_strings = analysis.get("strings", [])
+                    interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
+                    st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
+                
+                with tabs[3]:
+                    st.subheader("Disassembly")
+                    if "disassembly" in analysis:
+                        st.code(analysis["disassembly"], language="asm")
+                    else:
+                        st.warning("Disassembly not available")
                     
-                    if pyinstaller_result.get('success', False):
+                    if "pseudocode" in analysis and analysis["pseudocode"]:
+                        st.subheader("Decompiled Pseudocode")
+                        st.code(analysis["pseudocode"], language="c")
+                
+                with tabs[4]:
+                    if python_extraction.get("success", False):
                         st.success("Python code extracted successfully!")
-                        for filename, content in pyinstaller_result.get('files', {}).items():
+                        for filename, content in python_extraction.get("files", {}).items():
                             with st.expander(f"Python File: {filename}"):
                                 st.code(content, language="python")
                     else:
-                        st.warning(pyinstaller_result.get('message', "Not a Python executable or extraction failed."))
-                        st.subheader("Generated Python-like Code")
-                        st.code(disassembly.get('pseudo_python', "# No code could be generated"), language="python")
-                with tabs[2]:
-                    disassembly = exe_info.get('disassembly', {})
-                    if disassembly.get('success', False):
-                        for section in disassembly.get('code_sections', []):
-                            with st.expander(f"Section: {section['name']}"):
-                                st.code("\n".join(section['disassembly']), language="asm")
-                    else:
-                        st.error(disassembly.get('message', "Disassembly failed"))
-                with tabs[3]:
-                    basic_info = exe_info.get('basic_info', {})
-                    if 'ExtractedResources' in basic_info:
-                        st.write(f"Found {len(basic_info['ExtractedResources'])} resources")
-                        for resource in basic_info['ExtractedResources']:
-                            st.text(f"Resource: {resource}")
-            except Exception as e:
-                st.error(f"Error analyzing EXE file: {str(e)}")
+                        st.warning(python_extraction.get("message", "Not a Python executable or extraction failed."))
         
         elif uploaded_file.name.lower().endswith('.dll'):
-            st.subheader("DLL File Analysis and Decompilation")
-            try:
-                dll_info = analyze_dll(file_path)
+            st.subheader("DLL File Analysis")
+            with st.spinner("Reverse engineering DLL..."):
+                # Perform comprehensive analysis (with is_dll=True)
+                analysis = analyze_binary(file_path, is_dll=True)
+                
+                tabs = st.tabs(["Summary", "Exports", "Imports", "Strings", "Assembly"])
                 
-                tabs = st.tabs(["Basic Info", "DLL Code", "Exports/Imports"])
                 with tabs[0]:
-                    st.json(dll_info.get('basic_info', {}))
+                    if "Error" in analysis:
+                        st.error(analysis["Error"])
+                    else:
+                        st.subheader("Basic Information")
+                        st.json(analysis.get("basic_info", {}))
+                        
+                        st.subheader("Sections")
+                        sections_df = {
+                            "Name": [],
+                            "VirtualSize": [],
+                            "SizeOfRawData": [],
+                            "Entropy": []
+                        }
+                        for section in analysis.get("sections", []):
+                            sections_df["Name"].append(section["Name"])
+                            sections_df["VirtualSize"].append(section["VirtualSize"])
+                            sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                            sections_df["Entropy"].append(section["Entropy"])
+                        
+                        st.dataframe(sections_df)
+                
                 with tabs[1]:
-                    disassembly = dll_info.get('disassembly', {})
-                    st.subheader("Generated Python-like Code")
-                    st.code(disassembly.get('pseudo_python', "# No code could be generated"), language="python")
-                    
-                    if disassembly.get('success', False):
-                        st.subheader("Assembly Code")
-                        for section in disassembly.get('code_sections', []):
-                            with st.expander(f"Section: {section['name']}"):
-                                st.code("\n".join(section['disassembly']), language="asm")
+                    st.subheader("Exported Functions")
+                    st.json(analysis.get("exports", []))
+                
                 with tabs[2]:
-                    basic_info = dll_info.get('basic_info', {})
-                    if 'Exports' in basic_info:
-                        st.subheader("Exported Functions")
-                        st.json(basic_info['Exports'])
-                    if 'Imports' in basic_info:
-                        st.subheader("Imported DLLs and Functions")
-                        st.json(basic_info['Imports'])
-            except Exception as e:
-                st.error(f"Error analyzing DLL file: {str(e)}")
+                    st.subheader("Imported Functions")
+                    for imp in analysis.get("imports", []):
+                        with st.expander(f"DLL: {imp['DLL']}"):
+                            st.code("\n".join(imp["Functions"]))
+                
+                with tabs[3]:
+                    st.subheader("Strings Found")
+                    all_strings = analysis.get("strings", [])
+                    interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
+                    st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
+                
+                with tabs[4]:
+                    st.subheader("Disassembly")
+                    if "disassembly" in analysis:
+                        st.code(analysis["disassembly"], language="asm")
+                    else:
+                        st.warning("Disassembly not available")
+                    
+                    if "pseudocode" in analysis and analysis["pseudocode"]:
+                        st.subheader("Decompiled Pseudocode")
+                        st.code(analysis["pseudocode"], language="c")