Code Archaeologist

Legacy software often outlives its source code, documentation, and original development team. When an organization must maintain or replace an executable that still performs important work, engineers may have only the compiled binary. Traditional source-code analysis cannot help, while reverse-engineering tools can expose thousands of functions, strings, references, and decompiled fragments that still require substantial expert interpretation. Code Archaeologist turns that low-level evidence into a traceable engineering investigation for legacy modernization. The system provides a complete web experience backed by a static-analysis API. From the frontend, a user uploads a Windows PE executable and can follow the real analysis phases as they progress. The interface shows the active phase, completion states, and final status without inventing progress percentages. When analysis finishes, the user can inspect the full generated report directly in the application and download both the human-readable HTML report and the canonical JSON result. On the backend, the uploaded binary is never executed. Code Archaeologist identifies PE structure and metadata, extracts ASCII and UTF-16LE strings, and uses Ghidra Headless Analyzer to discover functions, API references, string references, call relationships, and selected decompiled pseudocode. These findings are normalized into evidence and processed by deterministic inference and reconstruction stages. Instead of claiming to recover original source code, the system separates observed evidence, inferred behavior, and unknowns. It identifies candidate responsibilities only when supporting signals can be correlated, assigns confidence levels, and links conclusions back to evidence IDs. Weak signals remain weak: a URL alone, for example, is not treated as proof of network communication. The generated report presents binary identification, tool coverage, reconstructed capabilities, candidate responsibilities, external interactions, interesting functions, actionable unknowns, modernization recommendations, limitations, and a detailed evidence index. The report supports light and dark presentation while preserving the same underlying analysis. The target users are software engineers, maintainers, modernization teams, and technical investigators working with undocumented or source-unavailable applications. What makes Code Archaeologist distinctive is the layer it adds above traditional binary analysis. Ghidra can reveal what exists inside an executable; Code Archaeologist correlates that evidence and asks what it may mean for engineers who must understand or replace the system. Its deterministic, evidence-first approach makes conclusions inspectable and reproducible while turning uncertainty into an actionable investigation plan.