DeepExtractRuntime

AI-driven logic vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for logic bugs, detect auth bypasses, check for confused deputy, find state machine errors, hunt for logic vulnerabilities with AI, or wants AI-driven logic vulnerability analysis of decompiled Windows binaries.

AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for memory corruption, buffer overflows, integer overflows, use-after-free, or wants AI-driven vulnerability analysis of decompiled Windows binaries.

AI-driven taint analysis scanner that traces attacker-controlled data through cross-module callgraphs using LLM agents with taint-specific context enrichment, trust boundary analysis, and skeptic verification. Use when the user asks to trace taint, find where attacker data reaches dangerous sinks, analyze data flow security, or wants AI-driven taint analysis of decompiled Windows binaries.

Lift related groups of decompiled functions together with shared context -- C++ class methods, call chains, or entire subtrees from exports. Builds shared struct definitions, determines dependency order, and generates coordinated output. Use when the user asks to lift multiple related functions, an entire class, a call chain, all methods of a type, everything reachable from an export, or mentions batch lifting or contextual lifting.

Trace call graphs, execution paths, and cross-module xref chains across DeepExtractIDA analysis databases. Use when the user asks to trace a function's call chain, find paths between functions, understand cross-module dependencies, show what a function calls across DLL boundaries, generate call graph diagrams, find reachable functions from an entry point, identify recursive call clusters, or asks about execution flow across extracted modules.

Automatically classify and triage every function in a DeepExtractIDA module by purpose (file I/O, registry, network, crypto, security, telemetry, dispatch, initialization, etc.) using API calls, string analysis, naming patterns, assembly metrics, and loop complexity. Use when the user asks to classify functions, triage a binary, understand what a module does at a high level, find functions by category, identify interesting functions, filter out noise, or asks about function purpose distribution in an extracted module.

Analyze COM server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about COM servers, COM attack surface, COM security, COM privilege escalation, COM entry points, DCOM, UAC bypass via COM, CLSID lookup, COM activation, COM service identity, or needs to audit COM server permissions.

Reconstruct COM and WRL interface definitions from IDA Pro decompiled Windows PE binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations. Use when the user asks to reconstruct COM interfaces, find COM classes, decode WRL templates, map CLSIDs, generate IDL descriptions, identify QueryInterface patterns, analyze vtable layouts as COM interfaces, or understand COM class hierarchies in extracted modules.

Extract function data from DeepExtractIDA analysis databases -- decompiled C++, raw x64 assembly, signatures, string literals, xrefs, vtable contexts, global variable accesses, stack frames, and loop analysis. Use when you need to locate a module's analysis database, list or search functions within it, or extract all data for a specific function. This is the foundational data-access skill that other skills depend on.

Look up, filter, and resolve functions using function_index.json files generated by DeepExtractIDA for each extracted module. Map function names to their .cpp files, filter application code from library boilerplate (WIL/STL/WRL/CRT/ETW), list module functions with statistics, and resolve function names to absolute file paths. Use when locating a function's source file, filtering boilerplate from application code, listing functions in a module, resolving function names to paths for reading, or when another skill needs to find which .cpp file contains a specific function.

Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the user asks to generate a report, summarize a binary, understand what a module does, get an overview of an extracted module, triage a binary for analysis, or asks about the capabilities or architecture of an analyzed PE binary.

Resolve PE-level import and export relationships across all analyzed modules in a DeepExtractIDA workspace. Answers which module exports a given function, which modules import it, builds PE-level module dependency graphs, and follows forwarded export chains. Use when the user asks which DLL exports a function, who imports a function, what a module depends on at the loader level, wants PE import/export tables (not code xrefs), asks about forwarded exports, needs cross-module dependency mapping from import tables, or wants to know all consumers of a given DLL.

Map the complete attack surface of a Windows PE binary by discovering all entry points (exports, COM vtable methods, RPC handlers, WinRT methods, callbacks, window procedures, service handlers, TLS callbacks, IPC dispatchers, socket handlers, and more), ranking them by attack value using callgraph reachability to dangerous operations, and generating CRS-compatible entrypoints.json. Use when the user asks to map attack surface, find entry points, discover where an attacker can enter a binary, rank exports by risk, generate entrypoints for fuzzing, identify attack-accessible functions, or asks about the attack surface of an extracted module.

Reconstruct C/C++ struct and class definitions from IDA Pro decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions in a module. Use when the user asks to reconstruct types, build struct layouts, extract class hierarchies, generate header files, improve type information for code lifting, or analyze struct/class definitions from decompiled binaries.

Analyze RPC interfaces in Windows binaries using ground-truth extraction data, C# client stub signatures, and procedure semantic classification. Use when the user asks about RPC interfaces, RPC attack surface, RPC security, RPC procedures, blast-radius, RPC topology, parameter types, or needs to audit RPC handlers.

Build comprehensive security context dossiers for functions in DeepExtractIDA binaries -- gathering identity, attack reachability, data flow exposure, dangerous operations, resource patterns, complexity metrics, and neighboring context in one command. Use when the user asks to audit a function's security posture, build a security dossier, assess attack surface, check function reachability from exports, find dangerous API usage, or needs pre-audit context gathering for a decompiled function.

Analyze WinRT server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about WinRT servers, WinRT attack surface, WinRT security, WinRT privilege escalation, WinRT method signatures, WinRT entry points, or needs to audit WinRT activation servers.