marcosd4h

marcosd4h/DeepExtractRuntime

Instructions file

Instructions for marcosd4h/DeepExtractRuntime, covering deepextractida agent analysis runtime, quick rules, workflow principles, getting started and architecture.

marcosd4h/DeepExtractRuntime

Agent

Dedicated function and class lifting with maintained context across methods. Rewrites IDA Pro decompiled C/C++ functions into clean, readable, 100% functionally equivalent code while maintaining shared struct definitions, naming conventions, accumulated constants, and already-lifted code across all methods in a batch.

marcosd4h/DeepExtractRuntime

Agent

AI-driven logic vulnerability scanner that navigates cross-module callgraphs, uses adversarial prompting with type-specific specialists, and produces findings verified against assembly ground truth.

marcosd4h/DeepExtractRuntime

Agent

AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs, uses adversarial prompting with type-specific specialists, and produces findings verified against assembly ground truth.

marcosd4h/DeepExtractRuntime

Agent

General reverse engineering analyst for IDA Pro decompiled binaries. Understands IDA output conventions, Hex-Rays decompiler artifacts, Windows internals, and DeepExtractIDA data. Use for explaining functions, understanding modules, tracing call chains, classifying code, or any "what does this do" question about…

marcosd4h/DeepExtractRuntime

Agent

Dedicated security assessment agent for vulnerability scanning, exploitability analysis, and finding verification across DeepExtractIDA modules.

marcosd4h/DeepExtractRuntime

Agent

AI-driven taint analysis agent that traces attacker-controlled data through cross-module callgraphs, identifies where tainted inputs reach dangerous sinks without adequate validation, and maps trust boundary crossings.

marcosd4h/DeepExtractRuntime

Agent

Orchestrates multi-skill analysis workflows for comprehensive DeepExtractIDA module analysis. Given a high-level goal (triage, security audit, function understanding, type reconstruction, or full analysis), produces and executes a structured analysis plan by running skill scripts, collecting results, and synthesizing…

marcosd4h/DeepExtractRuntime

Agent

Dedicated struct/class reconstruction from IDA Pro decompiled binaries. Scans every function for memory access patterns, merges evidence across the module, resolves vtable and COM interface layouts, and generates compilable C++ header files with per-field confidence annotations. Use for full-module or single-class…

marcosd4h/DeepExtractRuntime

Command

AI-driven scan for logic vulnerabilities: authentication/authorization bypass, state machine errors, confused deputy, privilege escalation, missing impersonation revert, and sensitive API parameter injection.

marcosd4h/DeepExtractRuntime

Command

Perform a focused security audit of a specific function -- building a comprehensive security dossier, tracing attack reachability, and reporting findings with risk assessment and recommendations.

marcosd4h/DeepExtractRuntime

Command

Security audit multiple functions in parallel, targeting the top-ranked attack surface entry points, module-scoped privilege-boundary handlers (RPC/COM/WinRT), or a user-specified list. Produces a consolidated security report with per-function audit summaries and cross-function patterns.

marcosd4h/DeepExtractRuntime

Command

View statistics, clear, or refresh cached analysis results stored in .claude/cache/. Caching significantly speeds up commands like /triage, /full-report, and /audit by avoiding redundant expensive computations.

marcosd4h/DeepExtractRuntime

Command

Build, query, and visualize call graphs for a module or function. Shows topology statistics, strongly connected components, hub functions, root/leaf nodes, and generates Mermaid diagrams.

marcosd4h/DeepExtractRuntime

Command

Analyze COM server interfaces in Windows binaries using ground-truth extraction data. Enumerates COM servers by module or CLSID, maps the privilege-boundary attack surface, audits security properties (permissions, elevation, marshalling, DCOM), classifies entry points, and identifies privilege escalation and UAC…

marcosd4h/DeepExtractRuntime

Command

Cross-module analysis of two or more DeepExtractIDA-analyzed modules -- comparing dependency relationships, import/export overlap, function classification distributions, and cross-module call chains.

marcosd4h/DeepExtractRuntime

Command

Compare findings across AI vulnerability scan reports for the same module. Identifies recurring findings, new findings, missed regressions, severity changes, and verdict conflicts between scans.

marcosd4h/DeepExtractRuntime

Command

Compare two versions of the same module to identify changed functions, new attack surface, and fixed vulnerabilities. Use when a binary has been updated (patched, new version) and you want to understand what changed from a security perspective.

marcosd4h/DeepExtractRuntime

Command

Get a quick, structured explanation of what a decompiled function does -- its purpose, parameters, key API calls, data flow, and call context -- without running a full audit or trace pipeline.

marcosd4h/DeepExtractRuntime

Command

End-to-end analysis of a DeepExtractIDA module combining multiple analysis passes: binary identity, function classification, attack surface mapping, call graph topology, and specialized analysis (COM, global state). This is the most thorough single-command analysis.

marcosd4h/DeepExtractRuntime

Command

Pre-flight validation of the DeepExtractIDA workspace. Checks that extraction data, analysis databases, skill/agent/command registries, and configuration are present and consistent.

marcosd4h/DeepExtractRuntime

Command

Automatically execute a vulnerability research plan produced by /hunt-plan. Runs the investigation commands for each hypothesis, collects evidence, scores confidence, and produces a consolidated findings report.

marcosd4h/DeepExtractRuntime

Command

Hypothesis-driven vulnerability research planning and strategic campaign design. Generates testable attack hypotheses, matches observations to known Windows attack patterns, plans variant analysis, validates suspected findings, and maps trust boundaries -- all mapped to concrete workspace commands. Also covers…

marcosd4h/DeepExtractRuntime

Command

Query PE import/export relationships across modules: who exports a function, who imports it, inter-module dependency graphs, and DLL forwarder chain resolution.