| name | generate-re-report |
| description | Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the user asks to generate a report, summarize a binary, understand what a module does, get an overview of an extracted module, triage a binary for analysis, or asks about the capabilities or architecture of an analyzed PE binary. |
| cacheable | true |
| depends_on | ["decompiled-code-extractor"] |
Generate RE Report
Purpose
Generate synthesized reverse engineering reports from DeepExtractIDA analysis databases. Unlike raw data dumps (file_info.md/file_info.json), this skill cross-correlates data, computes derived metrics, and produces actionable guidance -- the report you'd write manually after hours with the binary, generated in seconds.
This is per-module analysis. Each report covers one binary. The report is a living document that can be regenerated as analysis progresses.
When NOT to Use
- Deep security analysis of a specific function -- use security-dossier or taint-analysis
- Classifying functions by purpose with interest scoring -- use classify-functions
- Scanning for specific vulnerability classes -- use ai-memory-corruption-scanner or ai-logic-scanner
- Lifting or rewriting decompiled code -- use the code-lifter agent
Data Sources
Reports are generated from individual analysis databases (extracted_dbs/{module}_{hash}.db). These contain per-function data (assembly, decompiled code, xrefs, strings, loops, globals, stack frames, analysis errors) plus binary-level metadata (imports, exports, sections, security features, Rich header, TLS callbacks, load config).
Finding a Module DB
Reuse the decompiled-code-extractor skill's find_module_db.py:
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
Quick Cross-Dimensional Search
To search across function names, signatures, strings, APIs, classes, and exports in one call:
python .claude/helpers/unified_search.py <db_path> --query "SearchTerm"
python .claude/helpers/unified_search.py <db_path> --query "SearchTerm" --json
Utility Scripts
Pre-built scripts in scripts/ handle all analysis and report generation. Run from the workspace root.
generate_report.py -- Full Report (Start Here)
The main orchestrator. Runs all sub-analyses and assembles a 10-section markdown report.
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path>
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --output re_report.md
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --output extracted_code/appinfo_dll/re_report.md
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --summary
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --top 20
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --json
analyze_imports.py -- Import Capability Categorization
Categorize imports by API capability:
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --json
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --exports --include-delay-load
analyze_complexity.py -- Function Complexity Ranking
Rank functions by multiple metrics:
python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path> --json --top 20
analyze_topology.py -- Call Graph Metrics
Compute call graph metrics:
python .claude/skills/generate-re-report/scripts/analyze_topology.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_topology.py <db_path> --json
analyze_strings.py -- String Literal Categorization
Categorize all string literals:
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --json --top 20
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category file_path
analyze_decompilation_quality.py -- Decompilation Quality Metrics
Decompilation quality analysis. Scans analysis_errors across all functions: success rates, error category breakdown, problematic functions by severity, and confidence tiers (high/medium/low quality decompilation).
python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path> --json
python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path> --no-cache
Report Sections
1. Executive Summary
One-paragraph overview: binary identity, primary capabilities (from import categories), scale (function/class counts), compiler info (Rich header), PDB path, symbol quality.
2. Provenance & Build Environment
Rich header decode (MSVC compiler version, linker, object file counts), PDB path analysis (source tree structure, developer machine hints), compilation timestamp vs file modification date, .NET status.
3. Binary Structure
DLL characteristics, section permission anomalies (W+X).
4. External Interface (Import/Export Analysis)
Imports categorized by capability (file I/O, registry, network, process/thread, crypto, security, COM, RPC, memory, sync, UI, telemetry, etc.). Exports with categories. Delay-loaded imports called out separately. Built-in taxonomy covers ~500 Win32/NT APIs across 15 categories.
5. Internal Architecture
Class hierarchy from mangled names, symbol quality (named vs sub_XXXX), class method counts.
6. Complexity Hotspots
Ranked tables: top by loop complexity, by xref count (hub functions), by global state access, by assembly size. Function distribution by size/type/complexity. Functions with analysis errors.
7. String Intelligence
All strings categorized: file paths, registry keys, URLs, RPC endpoints, named pipes, ETW providers, GUIDs, error messages, format strings, debug strings. Each linked back to referencing functions.
8. Cross-Reference Topology
Call graph metrics: entry point reachability (coverage per export), dead code candidates, leaf functions, recursive groups (SCCs), bottleneck functions, max call depth from entries.
9. Notable Patterns & Anomalies
TLS callbacks, decompiler failures, unusually large functions (>500 asm lines), heavy global state writers.
10. Recommended Focus Areas
Synthesized priority list: top functions by combined complexity/connectivity/size, skill integration suggestions (which other skills to use and on what), entry points by code coverage, functions needing assembly verification.
Workflows
Workflow 1: "Generate a report for this module"
Report Generation:
- [ ] Step 1: Find the module DB
- [ ] Step 2: Generate the report
- [ ] Step 3: Review and save
Step 1: Find the DB
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
Step 2: Generate
python .claude/skills/generate-re-report/scripts/generate_report.py extracted_dbs/appinfo_dll_e98d25a9e8.db
Step 3: Save alongside existing module files
python .claude/skills/generate-re-report/scripts/generate_report.py extracted_dbs/appinfo_dll_e98d25a9e8.db \
--output extracted_code/appinfo_dll/re_report.md
Workflow 2: "Quick triage of an unknown binary"
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --summary
Workflow 3: "What APIs does this binary use?"
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --exports --include-delay-load
Workflow 4: "Find the most complex/interesting functions"
python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path> --top 20
Workflow 5: "What strings does this binary reference?"
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category file_path
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category registry_key
Workflow 6: "JSON for downstream processing"
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --json > analysis.json
Integration with Other Skills
| Task | Recommended Skill |
|---|
| Deep-dive into interesting functions from report | security-dossier |
| Trace call chains for reported hotspots | callgraph-tracer |
| Map attack surface using report findings | map-attack-surface |
| Classify functions for focused follow-up | classify-functions |
API Taxonomy
The import categorizer uses a canonical taxonomy of ~500 Win32/NT API prefixes across 15 categories. Defined in helpers/api_taxonomy.py:API_TAXONOMY and shared by all skills. Categories: file_io, registry, network, process_thread, crypto, security, com_ole, rpc, memory, ui_shell, sync, string_manipulation, error_handling, service, telemetry, debug_diagnostics.
The taxonomy is importable by any skill via from helpers.api_taxonomy import API_TAXONOMY, classify_api.
Direct Helper Module Access
For custom queries not covered by scripts:
from helpers import open_individual_analysis_db
with open_individual_analysis_db("extracted_dbs/module_hash.db") as db:
fi = db.get_file_info()
print(fi.parsed_imports)
Performance
| Operation | Typical Time | Notes |
|---|
| Analyze imports | ~3-5s | Classifies all imported APIs |
| Analyze strings | ~3-5s | Categorizes all string literals |
| Analyze complexity | ~5-10s | Assembly metrics for all functions |
| Analyze topology | ~5-10s | Call graph statistics |
| Generate full report | ~30-60s | Runs all analysis scripts sequentially |
Additional Resources
