Agent Claude Code needs its repo
Dedicated function and class lifting with maintained context across methods. Rewrites IDA Pro decompiled C/C++ functions into clean, readable, 100% functionally equivalent code while maintaining shared struct definitions, naming conventions, accumulated constants, and already-lifted code across all methods in a batch.
Agent Claude Code needs its repo
AI-driven logic vulnerability scanner that navigates cross-module callgraphs, uses adversarial prompting with type-specific specialists, and produces findings verified against assembly ground truth.
Agent Claude Code needs its repo
AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs, uses adversarial prompting with type-specific specialists, and produces findings verified against assembly ground truth.
Agent Claude Code needs its repo
General reverse engineering analyst for IDA Pro decompiled binaries. Understands IDA output conventions, Hex-Rays decompiler artifacts, Windows internals, and DeepExtractIDA data. Use for explaining functions, understanding modules, tracing call chains, classifying code, or any "what does this do" question about…
Agent Claude Code
Dedicated security assessment agent for vulnerability scanning, exploitability analysis, and finding verification across DeepExtractIDA modules.
Agent Claude Code needs its repo
AI-driven taint analysis agent that traces attacker-controlled data through cross-module callgraphs, identifies where tainted inputs reach dangerous sinks without adequate validation, and maps trust boundary crossings.
Agent Claude Code needs its repo
Orchestrates multi-skill analysis workflows for comprehensive DeepExtractIDA module analysis. Given a high-level goal (triage, security audit, function understanding, type reconstruction, or full analysis), produces and executes a structured analysis plan by running skill scripts, collecting results, and synthesizing…
Agent Claude Code needs its repo
Dedicated struct/class reconstruction from IDA Pro decompiled binaries. Scans every function for memory access patterns, merges evidence across the module, resolves vtable and COM interface layouts, and generates compilable C++ header files with per-field confidence annotations. Use for full-module or single-class…
Command Claude Code needs its repo
AI-driven scan for logic vulnerabilities: authentication/authorization bypass, state machine errors, confused deputy, privilege escalation, missing impersonation revert, and sensitive API parameter injection.
Command Claude Code needs its repo
Perform a focused security audit of a specific function -- building a comprehensive security dossier, tracing attack reachability, and reporting findings with risk assessment and recommendations.
Command Claude Code needs its repo
Security audit multiple functions in parallel, targeting the top-ranked attack surface entry points, module-scoped privilege-boundary handlers (RPC/COM/WinRT), or a user-specified list. Produces a consolidated security report with per-function audit summaries and cross-function patterns.
Command Claude Code
View statistics, clear, or refresh cached analysis results stored in .claude/cache/. Caching significantly speeds up commands like /triage, /full-report, and /audit by avoiding redundant expensive computations.
Command Claude Code needs its repo
Build, query, and visualize call graphs for a module or function. Shows topology statistics, strongly connected components, hub functions, root/leaf nodes, and generates Mermaid diagrams.
Command Claude Code needs its repo
Analyze COM server interfaces in Windows binaries using ground-truth extraction data. Enumerates COM servers by module or CLSID, maps the privilege-boundary attack surface, audits security properties (permissions, elevation, marshalling, DCOM), classifies entry points, and identifies privilege escalation and UAC…
Command Claude Code
Cross-module analysis of two or more DeepExtractIDA-analyzed modules -- comparing dependency relationships, import/export overlap, function classification distributions, and cross-module call chains.
Command Claude Code
Compare findings across AI vulnerability scan reports for the same module. Identifies recurring findings, new findings, missed regressions, severity changes, and verdict conflicts between scans.
Command Claude Code needs its repo
Compare two versions of the same module to identify changed functions, new attack surface, and fixed vulnerabilities. Use when a binary has been updated (patched, new version) and you want to understand what changed from a security perspective.
Command Claude Code needs its repo
Get a quick, structured explanation of what a decompiled function does -- its purpose, parameters, key API calls, data flow, and call context -- without running a full audit or trace pipeline.
Command Claude Code needs its repo
End-to-end analysis of a DeepExtractIDA module combining multiple analysis passes: binary identity, function classification, attack surface mapping, call graph topology, and specialized analysis (COM, global state). This is the most thorough single-command analysis.
Command Claude Code needs its repo
Pre-flight validation of the DeepExtractIDA workspace. Checks that extraction data, analysis databases, skill/agent/command registries, and configuration are present and consistent.
Command Claude Code
Automatically execute a vulnerability research plan produced by /hunt-plan. Runs the investigation commands for each hypothesis, collects evidence, scores confidence, and produces a consolidated findings report.
Command Claude Code
Hypothesis-driven vulnerability research planning and strategic campaign design. Generates testable attack hypotheses, matches observations to known Windows attack patterns, plans variant analysis, validates suspected findings, and maps trust boundaries -- all mapped to concrete workspace commands. Also covers…
Command Claude Code needs its repo
Query PE import/export relationships across modules: who exports a function, who imports it, inter-module dependency graphs, and DLL forwarder chain resolution.
Command Claude Code needs its repo
Batch-lift all methods of a C++ class with shared type context, producing a single cohesive .cpp output file with struct definitions, constants, and all methods in dependency order. Uses assembly as ground truth to ensure 100% functional equivalence.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: