AI-driven agent runtime for Windows PE binary analysis. Turns IDA Pro decompiled code and SQLite databases produced by DeepExtractIDA into structured intelligence through specialized agents, analysis skills, and slash commands
Command
AI-driven scan for logic vulnerabilities: authentication/authorization bypass, state machine errors, confused deputy, privilege escalation, missing impersonation revert, and sensitive API parameter injection.
Command
Perform a focused security audit of a specific function -- building a comprehensive security dossier, tracing attack reachability, and reporting findings with risk assessment and recommendations.
Command
Security audit multiple functions in parallel, targeting the top-ranked attack surface entry points, module-scoped privilege-boundary handlers (RPC/COM/WinRT), or a user-specified list. Produces a consolidated security report with per-function audit summaries and cross-function patterns.
Command
View statistics, clear, or refresh cached analysis results stored in .claude/cache/. Caching significantly speeds up commands like /triage, /full-report, and /audit by avoiding redundant expensive computations.
Command
Build, query, and visualize call graphs for a module or function. Shows topology statistics, strongly connected components, hub functions, root/leaf nodes, and generates Mermaid diagrams.
Command
Analyze COM server interfaces in Windows binaries using ground-truth extraction data. Enumerates COM servers by module or CLSID, maps the privilege-boundary attack surface, audits security properties (permissions, elevation, marshalling, DCOM), classifies entry points, and identifies privilege escalation and UAC…
Command
Cross-module analysis of two or more DeepExtractIDA-analyzed modules -- comparing dependency relationships, import/export overlap, function classification distributions, and cross-module call chains.
Command
Compare findings across AI vulnerability scan reports for the same module. Identifies recurring findings, new findings, missed regressions, severity changes, and verdict conflicts between scans.
Command
Compare two versions of the same module to identify changed functions, new attack surface, and fixed vulnerabilities. Use when a binary has been updated (patched, new version) and you want to understand what changed from a security perspective.
Command
Get a quick, structured explanation of what a decompiled function does -- its purpose, parameters, key API calls, data flow, and call context -- without running a full audit or trace pipeline.
Command
End-to-end analysis of a DeepExtractIDA module combining multiple analysis passes: binary identity, function classification, attack surface mapping, call graph topology, and specialized analysis (COM, global state). This is the most thorough single-command analysis.
Command
Pre-flight validation of the DeepExtractIDA workspace. Checks that extraction data, analysis databases, skill/agent/command registries, and configuration are present and consistent.
Command
Automatically execute a vulnerability research plan produced by /hunt-plan. Runs the investigation commands for each hypothesis, collects evidence, scores confidence, and produces a consolidated findings report.
Command
Hypothesis-driven vulnerability research planning and strategic campaign design. Generates testable attack hypotheses, matches observations to known Windows attack patterns, plans variant analysis, validates suspected findings, and maps trust boundaries -- all mapped to concrete workspace commands. Also covers…
Command
Query PE import/export relationships across modules: who exports a function, who imports it, inter-module dependency graphs, and DLL forwarder chain resolution.
Command
Batch-lift all methods of a C++ class with shared type context, producing a single cohesive .cpp output file with struct definitions, constants, and all methods in dependency order. Uses assembly as ground truth to ensure 100% functional equivalence.
Command
AI-driven scan for memory corruption vulnerabilities: buffer overflows, integer overflow/truncation, use-after-free, double-free, and type confusion. Uses LLM agents that navigate cross-module callgraphs, read decompiled code on demand, and verify findings against assembly ground truth.
Command
Run, validate, or inspect headless batch analysis pipelines from YAML definitions. Wraps the pipelinecli.py CLI for interactive use within a Cursor session.
Command
Cross-module finding prioritization. Loads cached scan and audit results from multiple modules, normalizes them via the unified finding schema, ranks by exploitability × reachability × impact, and produces a single priority-ordered list spanning all specified modules.
Command
Reconstruct C/C++ struct and class definitions from a module's decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions. Generates compilable C++ header files with per-field confidence annotations.
Command
Analyze RPC interfaces in Windows binaries using ground-truth NtApiDotNet extraction data. Enumerates interfaces, maps the RPC attack surface, audits security properties, and traces handler call chains.
Command
Browse prior workspace runs created by multi-step workflows such as /triage, /full-report, /scan, and /batch-audit. Use this command to list the most recent runs, reopen the latest run for a module, or inspect the step summaries from a specific run without re-running the workflow.
Command
Unified vulnerability scan that orchestrates recon, AI scanner context preparation, taint analysis, assembly verification, and deduplication into a single pipeline. Produces a consolidated, severity-ranked findings report.
Command
Search across all analysis dimensions in one call -- function names, signatures, string literals, API calls, dangerous APIs, class names, and exports. Wraps unifiedsearch.py to find everything related to a search term without needing to know which dimension it belongs to.