| name | decompile |
| description | Decompile a function to C-like pseudocode using angr |
| allowed-tools | mcp__x64dbg__get_debugger_status, mcp__x64dbg__get_register, mcp__x64dbg__eval_expression, mcp__x64dbg__get_symbol, Bash, Read |
decompile
Decompile a function from the debugged binary into C-like pseudocode using angr.
If no address is specified, decompiles the function containing the current instruction pointer. Accepts an address or symbol name as an argument.
Instructions
Follow these steps exactly:
1. Check prerequisites
Run pip show angr via Bash. If angr is not installed, tell the user:
angr is not installed. Install it with pip install angr (requires Python >= 3.10). Note: angr is a large package (~500MB+).
Then stop.
2. Verify debugger connection
Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and paused. If not debugging, tell the user and stop.
3. Determine target function address
If the user provided an address or symbol as an argument:
- If it looks like a hex address, use it directly
- If it looks like a symbol name, resolve it via
mcp__x64dbg__eval_expression
If no argument was provided:
- Get the current instruction pointer via
mcp__x64dbg__get_register (register rip for 64-bit, eip for 32-bit)
- Use the current RIP/EIP value as the target address
Call this resolved value target_addr.
4. Resolve module path and compute RVA
Use mcp__x64dbg__eval_expression to evaluate:
mod.path(target_addr) — to get the on-disk path of the module containing the addressmod.base(target_addr) — to get the module's base address
Compute the RVA: target_addr - module_base
If mod.path fails, the address may not belong to a loaded module. Tell the user and stop.
5. Run the decompile script
Execute:
python "${CLAUDE_PLUGIN_ROOT}\skills\decompile\decompile.py" --binary "<module_path>" --address <rva_hex>
Where:
<module_path> is the on-disk path from step 4<rva_hex> is the RVA in hex (e.g. 0x1060)
The script may take 10-30 seconds for large binaries (CFG generation is the bottleneck). Use a timeout of at least 120 seconds.
6. Present results
The script outputs decompiled C pseudocode to stdout and status messages to stderr.
Present the decompiled code to the user in a ```c code block. If the script failed, relay the error message from stderr (e.g., function not found, decompilation failed) and suggest nearby functions if listed.
