AI-driven agent runtime for Windows PE binary analysis. Turns IDA Pro decompiled code and SQLite databases produced by DeepExtractIDA into structured intelligence through specialized agents, analysis skills, and slash commands
This repository also configures its own agents. See what DeepExtractRuntime tells them →
Command Claude Code needs its repo
AI-driven scan for logic vulnerabilities: authentication/authorization bypass, state machine errors, confused deputy, privilege escalation, missing impersonation revert, and sensitive API parameter injection.
Command Claude Code needs its repo
Perform a focused security audit of a specific function -- building a comprehensive security dossier, tracing attack reachability, and reporting findings with risk assessment and recommendations.
Command Claude Code needs its repo
Security audit multiple functions in parallel, targeting the top-ranked attack surface entry points, module-scoped privilege-boundary handlers (RPC/COM/WinRT), or a user-specified list. Produces a consolidated security report with per-function audit summaries and cross-function patterns.
Command Claude Code
View statistics, clear, or refresh cached analysis results stored in .claude/cache/. Caching significantly speeds up commands like /triage, /full-report, and /audit by avoiding redundant expensive computations.
Command Claude Code needs its repo
Build, query, and visualize call graphs for a module or function. Shows topology statistics, strongly connected components, hub functions, root/leaf nodes, and generates Mermaid diagrams.
Command Claude Code needs its repo
Analyze COM server interfaces in Windows binaries using ground-truth extraction data. Enumerates COM servers by module or CLSID, maps the privilege-boundary attack surface, audits security properties (permissions, elevation, marshalling, DCOM), classifies entry points, and identifies privilege escalation and UAC…
Command Claude Code
Cross-module analysis of two or more DeepExtractIDA-analyzed modules -- comparing dependency relationships, import/export overlap, function classification distributions, and cross-module call chains.
Command Claude Code
Compare findings across AI vulnerability scan reports for the same module. Identifies recurring findings, new findings, missed regressions, severity changes, and verdict conflicts between scans.
Command Claude Code needs its repo
Compare two versions of the same module to identify changed functions, new attack surface, and fixed vulnerabilities. Use when a binary has been updated (patched, new version) and you want to understand what changed from a security perspective.
Command Claude Code needs its repo
Get a quick, structured explanation of what a decompiled function does -- its purpose, parameters, key API calls, data flow, and call context -- without running a full audit or trace pipeline.
Command Claude Code needs its repo
End-to-end analysis of a DeepExtractIDA module combining multiple analysis passes: binary identity, function classification, attack surface mapping, call graph topology, and specialized analysis (COM, global state). This is the most thorough single-command analysis.
Command Claude Code needs its repo
Pre-flight validation of the DeepExtractIDA workspace. Checks that extraction data, analysis databases, skill/agent/command registries, and configuration are present and consistent.
Command Claude Code
Automatically execute a vulnerability research plan produced by /hunt-plan. Runs the investigation commands for each hypothesis, collects evidence, scores confidence, and produces a consolidated findings report.
Command Claude Code
Hypothesis-driven vulnerability research planning and strategic campaign design. Generates testable attack hypotheses, matches observations to known Windows attack patterns, plans variant analysis, validates suspected findings, and maps trust boundaries -- all mapped to concrete workspace commands. Also covers…
Command Claude Code needs its repo
Query PE import/export relationships across modules: who exports a function, who imports it, inter-module dependency graphs, and DLL forwarder chain resolution.
Command Claude Code needs its repo
Batch-lift all methods of a C++ class with shared type context, producing a single cohesive .cpp output file with struct definitions, constants, and all methods in dependency order. Uses assembly as ground truth to ensure 100% functional equivalence.
Command Claude Code needs its repo
AI-driven scan for memory corruption vulnerabilities: buffer overflows, integer overflow/truncation, use-after-free, double-free, and type confusion. Uses LLM agents that navigate cross-module callgraphs, read decompiled code on demand, and verify findings against assembly ground truth.
Command Claude Code needs its repo
Run, validate, or inspect headless batch analysis pipelines from YAML definitions. Wraps the pipelinecli.py CLI for interactive use within a Cursor session.
Command Claude Code needs its repo
Cross-module finding prioritization. Loads cached scan and audit results from multiple modules, normalizes them via the unified finding schema, ranks by exploitability × reachability × impact, and produces a single priority-ordered list spanning all specified modules.
Command Claude Code needs its repo
Reconstruct C/C++ struct and class definitions from a module's decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions. Generates compilable C++ header files with per-field confidence annotations.
Command Claude Code needs its repo
Analyze RPC interfaces in Windows binaries using ground-truth NtApiDotNet extraction data. Enumerates interfaces, maps the RPC attack surface, audits security properties, and traces handler call chains.
Command Claude Code
Browse prior workspace runs created by multi-step workflows such as /triage, /full-report, /scan, and /batch-audit. Use this command to list the most recent runs, reopen the latest run for a module, or inspect the step summaries from a specific run without re-running the workflow.
Command Claude Code needs its repo
Unified vulnerability scan that orchestrates recon, AI scanner context preparation, taint analysis, assembly verification, and deduplication into a single pipeline. Produces a consolidated, severity-ranked findings report.
Command Claude Code needs its repo
Search across all analysis dimensions in one call -- function names, signatures, string literals, API calls, dangerous APIs, class names, and exports. Wraps unifiedsearch.py to find everything related to a search term without needing to know which dimension it belongs to.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: