The recovery pipeline is a native lifting chain. It begins at core/loader, which parses PE, ELF, and Mach-O into a normalized BinaryImage. core/memory then owns mapped regions, permissions, rebasing, and symbol lookup, establishing the virtual address space. core/disasm decodes instructions through the architecture layer (Capstone is a listed dependency) and attaches architecture metadata.

core/cfg recovers program structure: functions, basic blocks, successors, loops, switch edges, cross-references, and call relationships. From there the code lifts into IR (core/ir), transforms into SSA (core/ssa), and runs analysis and type recovery (core/analysis, core/type). Finally core/decompiler emits structured C-like output, and core/debugger integrates runtime execution control with the static picture. Results persist through core/database to SQLite.

Each stage consumes the previous stage’s output, which is what makes the pipeline composable across surfaces. The internal algorithms inside function discovery, type recovery, and decompiler structuring are Additional validation required: the stage boundaries and ordering are documented, but the heuristics themselves are not published in the reviewed docs. Likewise the full set of supported architectures beyond the documented layer is Additional validation required.