AI-driven agent runtime for Windows PE binary analysis. Turns IDA Pro decompiled code and SQLite databases produced by DeepExtractIDA into structured intelligence through specialized agents, analysis skills, and slash commands
This repository also configures its own agents. See what DeepExtractRuntime tells them →
Skill Claude CodeCodex needs its repo
AI-driven logic vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for logic bugs, detect auth bypasses, check for confused deputy, find state machine errors, hunt for logic…
Skill Claude CodeCodex needs its repo
AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for memory corruption, buffer overflows, integer overflows, use-after-free, or wants AI-driven…
Skill Claude CodeCodex needs its repo
AI-driven taint analysis scanner that traces attacker-controlled data through cross-module callgraphs using LLM agents with taint-specific context enrichment, trust boundary analysis, and skeptic verification. Use when the user asks to trace taint, find where attacker data reaches dangerous sinks, analyze data flow…
Skill Claude CodeCodex needs its repo
Lift related groups of decompiled functions together with shared context -- C++ class methods, call chains, or entire subtrees from exports. Builds shared struct definitions, determines dependency order, and generates coordinated output. Use when the user asks to lift multiple related functions, an entire class, a…
Skill Claude CodeCodex needs its repo
Trace call graphs, execution paths, and cross-module xref chains across DeepExtractIDA analysis databases. Use when the user asks to trace a function's call chain, find paths between functions, understand cross-module dependencies, show what a function calls across DLL boundaries, generate call graph diagrams, find…
Skill Claude CodeCodex needs its repo
Automatically classify and triage every function in a DeepExtractIDA module by purpose (file I/O, registry, network, crypto, security, telemetry, dispatch, initialization, etc.) using API calls, string analysis, naming patterns, assembly metrics, and loop complexity. Use when the user asks to classify functions…
Skill Claude CodeCodex
Analyze COM server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about COM servers, COM attack surface, COM security, COM privilege escalation, COM entry points, DCOM, UAC bypass via COM, CLSID lookup…
Skill Claude CodeCodex needs its repo
Reconstruct COM and WRL interface definitions from IDA Pro decompiled Windows PE binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations. Use when the user asks to reconstruct COM interfaces, find COM classes, decode WRL templates, map CLSIDs, generate…
Skill Claude CodeCodex needs its repo
Extract function data from DeepExtractIDA analysis databases -- decompiled C++, raw x64 assembly, signatures, string literals, xrefs, vtable contexts, global variable accesses, stack frames, and loop analysis. Use when you need to locate a module's analysis database, list or search functions within it, or extract all…
Skill Claude CodeCodex needs its repo
Look up, filter, and resolve functions using functionindex.json files generated by DeepExtractIDA for each extracted module. Map function names to their .cpp files, filter application code from library boilerplate (WIL/STL/WRL/CRT/ETW), list module functions with statistics, and resolve function names to absolute file…
Skill Claude CodeCodex needs its repo
Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the…
Skill Claude CodeCodex needs its repo
Resolve PE-level import and export relationships across all analyzed modules in a DeepExtractIDA workspace. Answers which module exports a given function, which modules import it, builds PE-level module dependency graphs, and follows forwarded export chains. Use when the user asks which DLL exports a function, who…
Skill Claude CodeCodex needs its repo
Map the complete attack surface of a Windows PE binary by discovering all entry points (exports, COM vtable methods, RPC handlers, WinRT methods, callbacks, window procedures, service handlers, TLS callbacks, IPC dispatchers, socket handlers, and more), ranking them by attack value using callgraph reachability to…
Skill Claude CodeCodex needs its repo
Reconstruct C/C++ struct and class definitions from IDA Pro decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions in a module. Use when the user asks to reconstruct types, build struct layouts, extract class hierarchies, generate header files, improve type…
Skill Claude CodeCodex
Analyze RPC interfaces in Windows binaries using ground-truth extraction data, C# client stub signatures, and procedure semantic classification. Use when the user asks about RPC interfaces, RPC attack surface, RPC security, RPC procedures, blast-radius, RPC topology, parameter types, or needs to audit RPC handlers.
Skill Claude CodeCodex needs its repo
Build comprehensive security context dossiers for functions in DeepExtractIDA binaries -- gathering identity, attack reachability, data flow exposure, dangerous operations, resource patterns, complexity metrics, and neighboring context in one command. Use when the user asks to audit a function's security posture…
Skill Claude CodeCodex
Analyze WinRT server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about WinRT servers, WinRT attack surface, WinRT security, WinRT privilege escalation, WinRT method signatures, WinRT entry points, or…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: