generate-re-report

name	generate-re-report
description	Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the user asks to generate a report, summarize a binary, understand what a module does, get an overview of an extracted module, triage a binary for analysis, or asks about the capabilities or architecture of an analyzed PE binary.
cacheable	true
depends_on	["decompiled-code-extractor"]

Generate RE Report

Purpose

Generate synthesized reverse engineering reports from DeepExtractIDA analysis databases. Unlike raw data dumps (file_info.md/file_info.json), this skill cross-correlates data, computes derived metrics, and produces actionable guidance -- the report you'd write manually after hours with the binary, generated in seconds.

This is per-module analysis. Each report covers one binary. The report is a living document that can be regenerated as analysis progresses.

When NOT to Use

• Deep security analysis of a specific function -- use security-dossier or taint-analysis
• Classifying functions by purpose with interest scoring -- use classify-functions
• Scanning for specific vulnerability classes -- use ai-memory-corruption-scanner or ai-logic-scanner
• Lifting or rewriting decompiled code -- use the code-lifter agent

Data Sources

Reports are generated from individual analysis databases (extracted_dbs/{module}_{hash}.db). These contain per-function data (assembly, decompiled code, xrefs, strings, loops, globals, stack frames, analysis errors) plus binary-level metadata (imports, exports, sections, security features, Rich header, TLS callbacks, load config).

Finding a Module DB

Reuse the decompiled-code-extractor skill's find_module_db.py:

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

Quick Cross-Dimensional Search

To search across function names, signatures, strings, APIs, classes, and exports in one call:

python .claude/helpers/unified_search.py <db_path> --query "SearchTerm"
python .claude/helpers/unified_search.py <db_path> --query "SearchTerm" --json

Utility Scripts

Pre-built scripts in scripts/ handle all analysis and report generation. Run from the workspace root.

generate_report.py -- Full Report (Start Here)

The main orchestrator. Runs all sub-analyses and assembles a 10-section markdown report.

# Full report to stdout
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path>

# Write to file
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --output re_report.md

# Write to module's extracted_code directory
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --output extracted_code/appinfo_dll/re_report.md

# Brief mode (sections 1, 3, 4, 10 only -- fast overview)
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --summary

# Control table sizes (default: top 10)
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --top 20

# JSON output (all raw analysis data)
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --json

analyze_imports.py -- Import Capability Categorization

Categorize imports by API capability:

python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --json
python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --exports --include-delay-load

analyze_complexity.py -- Function Complexity Ranking

Rank functions by multiple metrics:

python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path> --json --top 20

analyze_topology.py -- Call Graph Metrics

Compute call graph metrics:

python .claude/skills/generate-re-report/scripts/analyze_topology.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_topology.py <db_path> --json

analyze_strings.py -- String Literal Categorization

Categorize all string literals:

python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --json --top 20
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category file_path

analyze_decompilation_quality.py -- Decompilation Quality Metrics

Decompilation quality analysis. Scans analysis_errors across all functions: success rates, error category breakdown, problematic functions by severity, and confidence tiers (high/medium/low quality decompilation).

python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path>
python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path> --json
python .claude/skills/generate-re-report/scripts/analyze_decompilation_quality.py <db_path> --no-cache

Report Sections

1. Executive Summary

One-paragraph overview: binary identity, primary capabilities (from import categories), scale (function/class counts), compiler info (Rich header), PDB path, symbol quality.

2. Provenance & Build Environment

Rich header decode (MSVC compiler version, linker, object file counts), PDB path analysis (source tree structure, developer machine hints), compilation timestamp vs file modification date, .NET status.

3. Binary Structure

DLL characteristics, section permission anomalies (W+X).

4. External Interface (Import/Export Analysis)

Imports categorized by capability (file I/O, registry, network, process/thread, crypto, security, COM, RPC, memory, sync, UI, telemetry, etc.). Exports with categories. Delay-loaded imports called out separately. Built-in taxonomy covers ~500 Win32/NT APIs across 15 categories.

5. Internal Architecture

Class hierarchy from mangled names, symbol quality (named vs sub_XXXX), class method counts.

6. Complexity Hotspots

Ranked tables: top by loop complexity, by xref count (hub functions), by global state access, by assembly size. Function distribution by size/type/complexity. Functions with analysis errors.

7. String Intelligence

All strings categorized: file paths, registry keys, URLs, RPC endpoints, named pipes, ETW providers, GUIDs, error messages, format strings, debug strings. Each linked back to referencing functions.

8. Cross-Reference Topology

Call graph metrics: entry point reachability (coverage per export), dead code candidates, leaf functions, recursive groups (SCCs), bottleneck functions, max call depth from entries.

9. Notable Patterns & Anomalies

TLS callbacks, decompiler failures, unusually large functions (>500 asm lines), heavy global state writers.

10. Recommended Focus Areas

Synthesized priority list: top functions by combined complexity/connectivity/size, skill integration suggestions (which other skills to use and on what), entry points by code coverage, functions needing assembly verification.

Workflows

Workflow 1: "Generate a report for this module"

Report Generation:
- [ ] Step 1: Find the module DB
- [ ] Step 2: Generate the report
- [ ] Step 3: Review and save

Step 1: Find the DB

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

Step 2: Generate

python .claude/skills/generate-re-report/scripts/generate_report.py extracted_dbs/appinfo_dll_e98d25a9e8.db

Step 3: Save alongside existing module files

python .claude/skills/generate-re-report/scripts/generate_report.py extracted_dbs/appinfo_dll_e98d25a9e8.db \
  --output extracted_code/appinfo_dll/re_report.md

Workflow 2: "Quick triage of an unknown binary"

# Brief summary -- just the essential sections
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --summary

Workflow 3: "What APIs does this binary use?"

python .claude/skills/generate-re-report/scripts/analyze_imports.py <db_path> --exports --include-delay-load

Workflow 4: "Find the most complex/interesting functions"

python .claude/skills/generate-re-report/scripts/analyze_complexity.py <db_path> --top 20

Workflow 5: "What strings does this binary reference?"

# All strings categorized
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path>

# Just file paths
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category file_path

# Just registry keys
python .claude/skills/generate-re-report/scripts/analyze_strings.py <db_path> --category registry_key

Workflow 6: "JSON for downstream processing"

# Full JSON with all analysis data
python .claude/skills/generate-re-report/scripts/generate_report.py <db_path> --json > analysis.json

Integration with Other Skills

Task	Recommended Skill
Deep-dive into interesting functions from report	security-dossier
Trace call chains for reported hotspots	callgraph-tracer
Map attack surface using report findings	map-attack-surface
Classify functions for focused follow-up	classify-functions

API Taxonomy

The import categorizer uses a canonical taxonomy of ~500 Win32/NT API prefixes across 15 categories. Defined in helpers/api_taxonomy.py:API_TAXONOMY and shared by all skills. Categories: file_io, registry, network, process_thread, crypto, security, com_ole, rpc, memory, ui_shell, sync, string_manipulation, error_handling, service, telemetry, debug_diagnostics.

The taxonomy is importable by any skill via from helpers.api_taxonomy import API_TAXONOMY, classify_api.

Direct Helper Module Access

For custom queries not covered by scripts:

from helpers import open_individual_analysis_db

with open_individual_analysis_db("extracted_dbs/module_hash.db") as db:
    fi = db.get_file_info()
    print(fi.parsed_imports)

Performance

Operation	Typical Time	Notes
Analyze imports	~3-5s	Classifies all imported APIs
Analyze strings	~3-5s	Categorizes all string literals
Analyze complexity	~5-10s	Assembly metrics for all functions
Analyze topology	~5-10s	Call graph statistics
Generate full report	~30-60s	Runs all analysis scripts sequentially

Additional Resources

• For detailed report section definitions, see reference.md
• For DB schema and JSON field formats, see data_format_reference.md
• For file_info.json schema, see file_info_format_reference.md
• For function classification, see classify-functions
• For call graph tracing, see callgraph-tracer