| name | AI-Enhanced Features |
| description | Semantic search, similarity detection, auto-documentation |
| tags | ["ai","semantic","search","similarity","documentation","analysis"] |
| allowed_tools | ["search_functions","find_similar","document_function","identify_algorithms"] |
Task: AI-Enhanced Reverse Engineering. Use semantic analysis for intelligent code exploration.
Features
1. Semantic Function Search
Search functions using natural language queries.
Supported Queries:
- "crypto functions" - Encryption, hashing, crypto APIs
- "file operations" - File I/O, filesystem operations
- "network functions" - Socket, HTTP, network APIs
- "string functions" - String manipulation, parsing
- "authentication" - Login, auth, credential handling
- "memory management" - Allocation, freeing, heap ops
Examples:
search_functions("crypto functions")
→ Returns all functions related to cryptography
search_functions("http client")
→ Returns functions that make HTTP requests
search_functions("parse json")
→ Returns JSON parsing functions
2. Similar Function Discovery
Find functions that behave similarly to a target function.
Similarity Criteria:
- Algorithm implemented
- Function category (crypto, network, file, etc.)
- Size and complexity
- Import/API patterns
- Call patterns
Use Cases:
- Find alternative implementations
- Detect code duplication
- Understand variants
- Cross-reference similar logic
3. Algorithm Identification
Automatically detect implemented algorithms.
Detected Algorithms:
- Hash Functions: MD5, SHA1, SHA256, CRC32
- Encryption: AES, RSA, XOR cipher
- Sorting: Bubble sort, quicksort, merge sort
- Compression: Gzip, LZ4, Zlib
- Data Structures: Linked list, binary tree, hash table
4. Auto-Documentation
Generate comprehensive documentation for functions.
Documentation Includes:
- Function signature and location
- Detected category
- Algorithm (if applicable)
- Size metrics
- Functions called
- External APIs used
- Referenced strings
- Behavior summary
- Analysis notes
Usage Examples
Semantic Search
1. User asks: "Find encryption functions"
2. AI runs: search_functions("encryption")
3. Results: Ranked list with:
- encrypt_file (Score: 95)
- aes_encrypt (Score: 90)
- crypt_data (Score: 85)
4. User selects function for detailed analysis
Similarity Search
1. User highlights function: decrypt_data
2. AI runs: find_similar(decrypt_data)
3. Results: Similar functions:
- encrypt_data (85% similar)
- crypt_buffer (70% similar)
4. User compares implementations
Auto-Documentation
1. User opens function: validate_token
2. AI generates: document_function(validate_token)
3. Output:
- Category: crypto/authentication
- Algorithm: SHA256
- Calls: hash_update, hash_compare
- Strings: "secret_key"
- Summary: Validates JWT tokens using SHA256 HMAC
Algorithm Signatures
Hash Functions
- MD5: 0x67452301 magic, "MD5" strings
- SHA1: 0x5a827999, 0x6ed9eba1 constants
- SHA256: 0x6a09e667 constant
- CRC32: 0xedb88320 polynomial
Encryption
- AES: S-box references, ShiftRows, MixColumns
- RSA: Modulo exponentiation patterns
- XOR: Repeated XOR operations
Compression
- Gzip: 0x1f8b magic, deflate references
- LZ4: Rapid compression patterns
- Zlib: Adler32, deflate references
Function Categories
- crypto: Cryptographic operations
- network: Network communication
- file: File I/O operations
- string: String manipulation
- memory: Memory management
- thread: Threading/synchronization
- registry: Registry access
- ui: User interface
Workflows
Exploring Unknown Binary
1. search_functions("authentication") - Find auth functions
2. document_function(auth_func) - Get documentation
3. find_similar(auth_func) - Find related functions
4. Analyze credential handling
Algorithm Analysis
1. identify_algorithms("crypto") - Find all crypto
2. document_function(encryption_func) - Get details
3. Analyze algorithm choice (weak/strong)
4. Check for implementation flaws
Code Review
1. search_functions("file operations")
2. find_similar(file_handler) - Check for duplication
3. get_function_security_score(addr) - Security check
4. Document findings
Tips
- Use specific queries for better results
- Combine semantic search with similarity search
- Document functions before sharing analysis
- Use algorithm detection to identify weak crypto