esReverse

Why reverse engineering needs a platform

Most reverse engineering still happens one analyst at a time. Each person has a disassembler, a debugger, scripts and a notes file. That works for a single binary. It becomes harder when the target is a full system, several people need to investigate it, or similar questions return every few months.

Three problems recur:

• Findings stay with the person who made them. Annotations, scripts and conclusions stay on one laptop. When that analyst moves on, the next project starts from zero.
• Static analysis only shows part of the picture. A disassembler shows what the code could do. It does not show what actually ran, in which order or with which data, across the kernel and every process.
• Sensitive targets can't go to cloud AI. Teams can't paste customer firmware, proprietary code and malware samples into a public chatbot. This limits their use of AI where it could help most.

esReverse addresses these three problems. It provides a shared workspace and combines static analysis with a full recording of system execution. Its AI runs inside your network.

How esReverse works

An esReverse investigation follows these steps:

1. Create a project. Each investigation has its own project, with its data, tools, notes and team members. You can switch between investigations without rebuilding your environment.
2. Connect your tools. Open the target in the disassemblers and debuggers your team already uses. These tools connect to the project rather than to one person's machine.
3. Record system execution. Use Epoch, eShard's time travel debugging tool, to record the whole system while the target runs. The recording includes the kernel, drivers and every process.
4. Investigate, alone or with AI. Step backwards and forwards through the recording, follow data, and ask an AI agent to search the project's trace.
5. Keep the results. Tags, findings and scripts stay in the project and carry over to the next investigation.

What's inside

A workspace for teams

Every investigation is a project. Analysts can work on the same project at the same time, from creation to archive. Administrators use dashboards to manage shared resources, users and access centrally. Findings and workflows stay in the project, so teams retain knowledge after a project ends.

Connections to your existing tools

esReverse works with the tools analysts already use. It connects to Ghidra, IDA, Binary Ninja, GDB, Frida, BinDiff, VS Code and JupyterLab, along with Epoch and eShard's emulators. Teams can also connect in-house tools, add their own scripts and build custom workflows.

Time travel debugging with Epoch

Epoch records a system's full execution in a deterministic trace. It saves every instruction, memory change and register state. Analysts can move forwards and backwards, jump to any instruction and inspect memory at any point. They can also follow data with taint analysis. The recording never changes, so analysts can replay race conditions and kernel panics as often as needed. → Time Travel Debugging (Epoch)

Emulators and physical devices

esReverse includes eShard's emulators, so analysts can study targets in a virtual environment, including iOS and Android virtual devices. When a real device is needed, an analyst can connect a physical mobile device over SSH and work with it using tools such as Frida and ADB.

Knowledge that carries forward

Findings, scripts and workflows stay with each project, so the next investigation starts from what the team already learned. eShard also publishes expertise material for esReverse, such as advanced Intel techniques and IoT use cases.

AI agents in the project

esReverse treats AI as another project tool:

• Project AI agent. Add an AI agent to a project like any other tool. It can only access that project's data.
• Platform chatbot. Create projects, retrieve findings and ask questions across investigations through a chat interface.
• Connect your own AI. Connect an AI agent you already run locally. It uses the project's data to answer questions.
• Trace analysis with AI. Through Epoch's MCP server, an agent can search runtime strings, inspect instructions and registers, read memory and follow data accesses across billions of recorded instructions.

Private LLM: AI inside your network

For organisations that can't use cloud AI, eShard offers a private language model that runs entirely on their infrastructure. No code, trace or finding has to leave the site. Three tiers are available, with regular model updates:

AI-assisted analysis in practice

eShard has published several worked examples. Two show how AI agents use full-system traces:

• Telegram on Android. An AI agent received a 7-billion-instruction Arm64 trace of Telegram receiving and decrypting a Secret Chat message. It also received a general prompt to explain what the app was doing. In about 10 minutes, without human guidance, it identified six activities. These included the AES-256 decryption path, notification handling, database writes to the encrypted chat table and image conversion. It also reported what it could not confirm.
• Internal challenge. eShard reports that an AI agent working on an Epoch trace solved an internal reverse engineering challenge in about 6 minutes. Its best experts needed about 2 hours.

The same approach applies to mobile apps. In another example, eShard recorded a banking app's launch and login in a full-system Android environment. The recordings contained about 4.8 and 2.3 billion instructions. It then asked an AI agent to report against the OWASP MASVS checklist. eShard describes this as an experiment, not a full assessment.

Supported targets

• Architectures: Intel and Arm
• Systems: Windows, Linux, Android and IoT
• Mobile: iOS and Android targets through eShard's virtual devices or connected physical devices → iOS & Android Virtual Devices

Who uses esReverse

• Vulnerability research teams finding and confirming bugs in binaries, drivers and kernels
• Malware analysts who need to see what a sample did, including code it downloads, decrypts and runs at runtime
• Embedded and IoT teams analysing firmware before and after a product ships
• Mobile security teams reviewing apps without sending them to an outside service
• Space, defence and government organisations that must keep every target and finding on-premise
• Testing and certification labs that need repeatable, documented analysis

Typical uses

• Finding and confirming vulnerabilities in binaries and firmware
• Root-cause analysis of crashes, race conditions and kernel panics
• Malware analysis, including payloads that only appear at runtime
• Driver and kernel investigations
• Mobile app reviews, for example checks against OWASP MASVS
• Security reviews before a product release

Deployment and licensing

• Web application installed on-premise with Docker or as a virtual appliance, or hosted in your private cloud
• Works on isolated (air-gapped) networks
• Licensed per server, with no limit on the number of users in a project
• The Project Manager, which manages many projects and teams, is licensed separately

esReverse next to a standalone disassembler

esReverse connects to IDA Pro and Ghidra. The table shows what it adds to these tools.

Why get esReverse through Pertech

Pertech is eShard's partner in Israel. We help define your setup and arrange a demo or evaluation on your own targets. We also size the servers and GPUs for the Private LLM, install the platform on your network, including air-gapped sites, and support your team after deployment.

Documentation

• eShard has no public PDF for esReverse. Pertech can send the product catalogue on request.
• Try time travel debugging in your browser (eShard live demo, no install)

Questions and answers

What is esReverse?

The esReverse reverse engineering platform is an on-premise product from eShard. It combines static analysis tools, full-system time travel debugging and AI agents in a shared workspace for security teams.

What does "agentic reverse engineering" mean in esReverse?

Agentic reverse engineering in esReverse means using AI agents as investigation tools. An agent can join a project, search a recorded execution trace, inspect memory and registers, and tag findings for an analyst to verify.

Does esReverse replace IDA Pro or Ghidra?

esReverse connects to IDA Pro and Ghidra rather than replacing them. It also connects to Binary Ninja and other tools analysts already use. It adds time travel debugging, AI that queries execution traces, and shared projects.

Can esReverse use AI without sending code to the cloud?

esReverse can use AI on your own servers without sending code to the cloud. It can run a private LLM in one of three tiers or connect to an AI agent you already host. No data has to leave your network.

What hardware does the esReverse Private LLM need?

The esReverse Private LLM needs under 100 GB of GPU memory for Essential, under 800 GB for Professional, and about 1.5 TB for Frontier.

Which platforms can esReverse analyse?

esReverse analyses Intel and Arm targets running Windows, Linux, Android or IoT firmware. It also supports iOS and Android targets through eShard's virtual devices.

Can I connect a real phone to esReverse?

Yes. With esReverse, an analyst can connect a physical mobile device over SSH and work with it using tools such as Frida and ADB. eShard's iOS and Android virtual devices are an alternative when no phone is at hand.

Can several analysts work on the same investigation?

esReverse lets several analysts work on the same investigation at once. Each investigation is a shared project, and its findings, tags and scripts stay with it.

Can esReverse help with malware analysis?

esReverse helps with malware analysis by using Epoch to record everything a sample does across the whole system. This includes code it downloads or decrypts at runtime. Analysts can then replay and study the recording safely.

Can esReverse run on an air-gapped network?

esReverse can run on an air-gapped network without internet access. It installs on-premise with Docker or as a virtual appliance.

How is esReverse licensed?

esReverse is licensed per server, with no limit on the number of users in a project. The Project Manager, which oversees many projects, is licensed separately. Pertech provides quotes in Israel.

What is the difference between esReverse and Epoch?

esReverse is eShard's reverse engineering platform, while Epoch is its time travel debugging tool. Epoch runs on esReverse.

Where can I buy esReverse in Israel?

You can buy esReverse from Pertech Embedded Solutions, eShard's partner in Israel. Pertech also handles demos, installation, onboarding and local support.