Command
Batch-lift all methods of a C++ class with shared type context, producing a single cohesive .cpp output file with struct definitions, constants, and all methods in dependency order. Uses assembly as ground truth to ensure 100% functional equivalence.
Command
AI-driven scan for memory corruption vulnerabilities: buffer overflows, integer overflow/truncation, use-after-free, double-free, and type confusion. Uses LLM agents that navigate cross-module callgraphs, read decompiled code on demand, and verify findings against assembly ground truth.
Command
Run, validate, or inspect headless batch analysis pipelines from YAML definitions. Wraps the pipelinecli.py CLI for interactive use within a Cursor session.
Command
Cross-module finding prioritization. Loads cached scan and audit results from multiple modules, normalizes them via the unified finding schema, ranks by exploitability × reachability × impact, and produces a single priority-ordered list spanning all specified modules.
Command
Reconstruct C/C++ struct and class definitions from a module's decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions. Generates compilable C++ header files with per-field confidence annotations.
Command
Analyze RPC interfaces in Windows binaries using ground-truth NtApiDotNet extraction data. Enumerates interfaces, maps the RPC attack surface, audits security properties, and traces handler call chains.
Command
Browse prior workspace runs created by multi-step workflows such as /triage, /full-report, /scan, and /batch-audit. Use this command to list the most recent runs, reopen the latest run for a module, or inspect the step summaries from a specific run without re-running the workflow.
Command
Unified vulnerability scan that orchestrates recon, AI scanner context preparation, taint analysis, assembly verification, and deduplication into a single pipeline. Produces a consolidated, severity-ranked findings report.
Command
Search across all analysis dimensions in one call -- function names, signatures, string literals, API calls, dangerous APIs, class names, and exports. Wraps unifiedsearch.py to find everything related to a search term without needing to know which dimension it belongs to.
Command
AI-driven taint analysis: trace attacker-controlled data from entry points to dangerous sinks across module boundaries. Uses LLM agents that navigate taint-enriched callgraphs with trust boundary metadata, read decompiled code on demand, and verify findings against assembly ground truth.
Command
Perform a complete triage of a DeepExtractIDA module -- identifying the binary, classifying all functions, mapping the attack surface, and producing a prioritized list of functions worth deeper analysis.
Command
Analyze WinRT server interfaces in Windows binaries using ground-truth extraction data. Enumerates server classes, maps the privilege-boundary attack surface, audits security properties, classifies entry points, and identifies privilege escalation targets.
Command
Quick cross-reference lookup for a function: show who calls it (inbound xrefs) and what it calls (outbound xrefs) in a compact table format. Lightweight alternative to /audit for when you just need to see a function's immediate neighborhood.
Skill Claude CodeCodex
AI-driven logic vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for logic bugs, detect auth bypasses, check for confused deputy, find state machine errors, hunt for logic…
Skill Claude CodeCodex
AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for memory corruption, buffer overflows, integer overflows, use-after-free, or wants AI-driven…
Skill Claude CodeCodex
AI-driven taint analysis scanner that traces attacker-controlled data through cross-module callgraphs using LLM agents with taint-specific context enrichment, trust boundary analysis, and skeptic verification. Use when the user asks to trace taint, find where attacker data reaches dangerous sinks, analyze data flow…
Skill Claude CodeCodex
Lift related groups of decompiled functions together with shared context -- C++ class methods, call chains, or entire subtrees from exports. Builds shared struct definitions, determines dependency order, and generates coordinated output. Use when the user asks to lift multiple related functions, an entire class, a…
Skill Claude CodeCodex
Trace call graphs, execution paths, and cross-module xref chains across DeepExtractIDA analysis databases. Use when the user asks to trace a function's call chain, find paths between functions, understand cross-module dependencies, show what a function calls across DLL boundaries, generate call graph diagrams, find…
Skill Claude CodeCodex
Automatically classify and triage every function in a DeepExtractIDA module by purpose (file I/O, registry, network, crypto, security, telemetry, dispatch, initialization, etc.) using API calls, string analysis, naming patterns, assembly metrics, and loop complexity. Use when the user asks to classify functions…
Skill Claude CodeCodex
Analyze COM server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about COM servers, COM attack surface, COM security, COM privilege escalation, COM entry points, DCOM, UAC bypass via COM, CLSID lookup…
Skill Claude CodeCodex
Reconstruct COM and WRL interface definitions from IDA Pro decompiled Windows PE binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations. Use when the user asks to reconstruct COM interfaces, find COM classes, decode WRL templates, map CLSIDs, generate…
Skill Claude CodeCodex
Extract function data from DeepExtractIDA analysis databases -- decompiled C++, raw x64 assembly, signatures, string literals, xrefs, vtable contexts, global variable accesses, stack frames, and loop analysis. Use when you need to locate a module's analysis database, list or search functions within it, or extract all…
Skill Claude CodeCodex
Look up, filter, and resolve functions using functionindex.json files generated by DeepExtractIDA for each extracted module. Map function names to their .cpp files, filter application code from library boilerplate (WIL/STL/WRL/CRT/ETW), list module functions with statistics, and resolve function names to absolute file…
Skill Claude CodeCodex
Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the…