AI-driven logic vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for logic bugs, detect auth bypasses, check for confused deputy, find state machine errors, hunt for logic vulnerabilities with AI, or wants AI-driven logic vulnerability analysis of decompiled Windows binaries.
AI-driven memory corruption vulnerability scanner that navigates cross-module callgraphs using LLM agents with adversarial prompting, type-specific specialists, and skeptic verification. Use when the user asks to scan for memory corruption, buffer overflows, integer overflows, use-after-free, or wants AI-driven vulnerability analysis of decompiled Windows binaries.
AI-driven taint analysis scanner that traces attacker-controlled data through cross-module callgraphs using LLM agents with taint-specific context enrichment, trust boundary analysis, and skeptic verification. Use when the user asks to trace taint, find where attacker data reaches dangerous sinks, analyze data flow security, or wants AI-driven taint analysis of decompiled Windows binaries.
Lift related groups of decompiled functions together with shared context -- C++ class methods, call chains, or entire subtrees from exports. Builds shared struct definitions, determines dependency order, and generates coordinated output. Use when the user asks to lift multiple related functions, an entire class, a call chain, all methods of a type, everything reachable from an export, or mentions batch lifting or contextual lifting.
Trace call graphs, execution paths, and cross-module xref chains across DeepExtractIDA analysis databases. Use when the user asks to trace a function's call chain, find paths between functions, understand cross-module dependencies, show what a function calls across DLL boundaries, generate call graph diagrams, find reachable functions from an entry point, identify recursive call clusters, or asks about execution flow across extracted modules.
Automatically classify and triage every function in a DeepExtractIDA module by purpose (file I/O, registry, network, crypto, security, telemetry, dispatch, initialization, etc.) using API calls, string analysis, naming patterns, assembly metrics, and loop complexity. Use when the user asks to classify functions, triage a binary, understand what a module does at a high level, find functions by category, identify interesting functions, filter out noise, or asks about function purpose distribution in an extracted module.
Analyze COM server interfaces in Windows binaries using ground-truth extraction data across four access contexts (caller integrity level x server privilege). Use when the user asks about COM servers, COM attack surface, COM security, COM privilege escalation, COM entry points, DCOM, UAC bypass via COM, CLSID lookup, COM activation, COM service identity, or needs to audit COM server permissions.
Reconstruct COM and WRL interface definitions from IDA Pro decompiled Windows PE binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations. Use when the user asks to reconstruct COM interfaces, find COM classes, decode WRL templates, map CLSIDs, generate IDL descriptions, identify QueryInterface patterns, analyze vtable layouts as COM interfaces, or understand COM class hierarchies in extracted modules.