decompile

name	decompile
description	Decompile a function to C-like pseudocode using angr
allowed-tools	mcp__x64dbg__get_debugger_status, mcp__x64dbg__get_register, mcp__x64dbg__eval_expression, mcp__x64dbg__get_symbol, Bash, Read

decompile

Decompile a function from the debugged binary into C-like pseudocode using angr.

If no address is specified, decompiles the function containing the current instruction pointer. Accepts an address or symbol name as an argument.

Instructions

Follow these steps exactly:

1. Check prerequisites

Run pip show angr via Bash. If angr is not installed, tell the user:

angr is not installed. Install it with pip install angr (requires Python >= 3.10). Note: angr is a large package (~500MB+).

Then stop.

2. Verify debugger connection

Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and paused. If not debugging, tell the user and stop.

3. Determine target function address

If the user provided an address or symbol as an argument:

• If it looks like a hex address, use it directly
• If it looks like a symbol name, resolve it via mcp__x64dbg__eval_expression

If no argument was provided:

• Get the current instruction pointer via mcp__x64dbg__get_register (register rip for 64-bit, eip for 32-bit)
• Use the current RIP/EIP value as the target address

Call this resolved value target_addr.

4. Resolve module path and compute RVA

Use mcp__x64dbg__eval_expression to evaluate:

• mod.path(target_addr) — to get the on-disk path of the module containing the address
• mod.base(target_addr) — to get the module's base address

Compute the RVA: target_addr - module_base

If mod.path fails, the address may not belong to a loaded module. Tell the user and stop.

5. Run the decompile script

Execute:

python "${CLAUDE_PLUGIN_ROOT}\skills\decompile\decompile.py" --binary "<module_path>" --address <rva_hex>

Where:

• <module_path> is the on-disk path from step 4
• <rva_hex> is the RVA in hex (e.g. 0x1060)

The script may take 10-30 seconds for large binaries (CFG generation is the bottleneck). Use a timeout of at least 120 seconds.

6. Present results

The script outputs decompiled C pseudocode to stdout and status messages to stderr.

Present the decompiled code to the user in a ```c code block. If the script failed, relay the error message from stderr (e.g., function not found, decompilation failed) and suggest nearby functions if listed.