Eleven

Take apart , read every , and ask what it does.

Select a highlighted word to see another option.

The Eleven home screen asking What should we take apart, with a prompt box and example questionsThe Eleven home screen asking What should we take apart, with a prompt box and example questions

Works with the agent you already use.

Each agent gets the same tools inside Eleven: open a function, rename it, leave a note, suggest a patch. You watch every step next to the code.

Point at the exact function.

Type @ to search every function, string, bookmark and note in the file. The agent gets the name and the address with your question.

The @ picker open in the chat box, listing onCreate methods from an Android app with their addressesThe @ picker open in the chat box, listing onCreate methods from an Android app with their addresses

Android apps open as Java.

Eleven decompiles an app's dex code with jadx: every method as readable Java or Kotlin, the Dalvik bytecode beside it, and who calls what. A 61 MB debug build opens with 73,471 methods, and opens again in about a second.

An Android app open in Eleven, showing MainActivity.onCreate decompiled to JavaAn Android app open in Eleven, showing MainActivity.onCreate decompiled to Java

Everything an app ships.

Mach-O

Mac and iOS apps and frameworks. Universal binaries open on your Mac's slice.

ELF

Linux programs and the native libraries inside Android apps.

PE

Windows executables and DLLs.

.apk .dex

Android apps, decompiled to Java with jadx.

.metallib .air .spv

GPU shaders, linked to the code that loads them.

.gguf .safetensors .onnx .pt

ML models and Core ML bundles, read without running them.

Everything you and your agent need to read a binary.

Four views of every function

Pseudocode, assembly, a control-flow graph and hex, from Ghidra or Rizin.

References

Callers, callees and cross-references, one click away.

Safe patching

Byte patches go to a copy in Downloads, never over the original.

Compare builds

See which functions were added, removed or changed between two versions.

Debugger

Run it under lldb with breakpoints, the call stack and locals.

GPU profiles

Instruments recordings next to the shader source.

History

Every rename, note and patch is logged with who made it, and can be undone.

You approve changes

Agent edits arrive as suggestions you accept or decline.

Read it next to the agent.

Drop an app on the window or ask about one by name. Eleven opens it as a project, and the code, the agent and your notes stay side by side.

The Eleven workbench showing Ghidra pseudocode for BlurFilter encodeToCommandBuffer, the function list grouped by class, and a chat with the agentThe Eleven workbench showing Ghidra pseudocode for BlurFilter encodeToCommandBuffer, the function list grouped by class, and a chat with the agent

PhotoFilter.app open on BlurFilter::encodeToCommandBuffer at 0x100000c78

FAQ

Anyone who needs to know what a program really does: security researchers, developers checking a dependency, and people curious how an app works.

No. Eleven brings its own fast engine, so the first file opens right away. Java and Ghidra download in the background on first launch. The only step is signing in to your agent.

Any agent that speaks the Agent Client Protocol, including Claude, Codex, Gemini, Cursor, OpenCode and Aster. Eleven finds the ones already on your Mac.

Yes. Eleven uses the agent you sign in to, on your own plan. Everything else, from reading code to patching, works without one.

Mac, iOS, Linux and Windows programs, Android apps, GPU shaders and ML models. Drop the app on the window, or ask about one by name.

No. Renames, notes and code types live in the project, and byte patches are written to a new copy in Downloads.

Yes. Every rename, note, type change and patch is logged with who made it, and ⌘Z takes it back. Turn on review and agent edits wait for you to accept them.

For the deepest pseudocode, yes, and Eleven sets it up for you. Rizin opens files in under a second without Java, and Android apps use jadx.

Yes. If Hopper or IDA is on your Mac, pick it in Settings, Analysis, and Eleven reads through it.

Yes. A project saves as one .eleven file with the binary, your notes and patches, and the chats. Send it to someone with Eleven and it opens as you left it.

Eleven itself runs locally. What your agent reads goes to that agent's provider, the same as using the agent anywhere else.

Reading, renaming, patching and debugging do, once the first launch has finished its downloads. Asking the agent needs a connection to its provider.

macOS for now. A Linux build is planned.

Install Eleven

Download the app, unzip it and move it to Applications. The first run walks you through connecting an agent.

Download for Apple siliconAll releases

Version 0.1.0 for Macs with Apple silicon.