Documentation

Beginner-friendly guides to reverse engineering with ByteForge.

Getting Started

Open Launch App → Decompiler, paste a 0x contract address, choose BNB Smart Chain or Robinhood Chain, and press Decompile Contract.

No wallet connection is needed — ByteForge only reads public bytecode via eth_getCode.

How ByteForge Works

1. Validate the address. 2. Connect to the network RPC. 3. Fetch runtime bytecode. 4. Disassemble every opcode with offsets. 5. Build basic blocks and resolve static jumps. 6. Scan the dispatcher for probable selectors. 7. Track SLOAD/SSTORE and call patterns. 8. Emit Solidity-like pseudocode with uncertainty labels. 9. Ground AI explanations in that evidence.

Supported Networks

BNB Smart Chain Mainnet — chain ID 56, RPC https://bsc-dataseed.bnbchain.org, explorer https://bscscan.com.

Robinhood Chain — chain ID 4663 (Arbitrum Orbit L2, ETH gas), RPC https://rpc.mainnet.chain.robinhood.com, explorer https://robinhoodchain.blockscout.com.

RPCs are verified official endpoints. If a network becomes unreachable, the UI reports it as unavailable instead of fabricating data.

Understanding EVM Bytecode

Contracts deploy as machine-readable bytecode: a sequence of opcodes (PUSH1, MSTORE, CALLVALUE, …) executed by the Ethereum Virtual Machine.

The disassembly tab shows each instruction with its byte offset, so you can follow jumps (JUMP/JUMPI) to their JUMPDEST targets.

Using the Decompiler

Invalid addresses, EOAs (no code), RPC timeouts, and rate limits each produce a specific error — never fake results.

Progress indicators show each pipeline stage. Large contracts are bounded to keep analysis responsive.

Function Identification

ByteForge looks for PUSH4 <selector> … EQ … JUMPI dispatcher shapes and resolves handler destinations where the jump target is a constant.

Known selectors are matched against an embedded database and shown as candidates — collisions exist, so matches are never presented as guaranteed.

Storage Analysis

Every SLOAD/SSTORE is listed with its offset. Constant slots are resolved from nearby PUSH values; KECCAK256 neighbourhoods are flagged as mapping/array-like.

Slot roles (owner, pause flag) are estimates. EIP-1967 implementation-slot references are surfaced as proxy signals.

AI Explanations

Explain This Function sends the deterministic analysis (pseudocode + disassembly excerpts) to a server-side provider.

API keys live in environment variables, never in the browser. When AI is unconfigured or fails, built-in rule explanations take over and core analysis keeps working.

Limitations

Approximations, not original source: names, comments, and exact control flow cannot be fully recovered.

Dynamic jumps, optimized dispatchers, and proxy indirection may leave handlers unresolved — the UI labels these gaps.

ByteForge does not audit safety. Always verify critical behavior with on-chain reads and professional review.

Frequently Asked Questions

Do I need a wallet? No — analysis reads public data.

Is $BYTE required? No — core analysis is free; $BYTE is a planned future token (Coming Soon).

Why did my analysis fail? Common causes: EOA address, wrong network, RPC rate limit, or oversized bytecode. The error message states the specific cause.