Decompiled Code Extractor

Decompiled Code Extractor

Purpose

Extract structured function data from DeepExtractIDA analysis databases. This skill provides the core scripts for locating module databases, listing and searching functions, and extracting complete per-function records. It is the foundational data-access layer that nearly every other skill depends on.

The scripts do not perform any analysis, lifting, or rewriting. They are purely data retrieval tools.

When NOT to Use

• Classifying functions by purpose or triaging a module -- use classify-functions
• Understanding what a function does (explanation, not raw data) -- use re-analyst or /explain
• Tracing call chains or cross-module execution paths -- use callgraph-tracer
• Scanning for vulnerabilities in extracted code -- use ai-memory-corruption-scanner or ai-logic-scanner
• Lifting or rewriting decompiled code to readable C++ -- use the code-lifter agent

Data Sources

Finding a Module DB

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

Locating the Target Function

Functions come from two sources:

1. Generated .cpp files in extracted_code/{module}/:

• Class methods: {module}_{ClassName}_group_{N}.cpp
• Standalone: {module}_standalone_group_{N}.cpp
• Each function has a comment header: // Function Name:, // Mangled Name:, // Function Signature (Extended):, // Function Signature:

2. SQLite databases in extracted_dbs/ (preferred -- contains assembly):

• Use the utility scripts in scripts/ to extract function data
• Each function record has decompiled_code, assembly_code, signatures, xrefs, strings, and more

3. Function index (fastest): python .claude/skills/function-index/scripts/lookup_function.py resolves the function name to its .cpp file path across all modules. Use --app-only to skip library boilerplate.

4. Unified search (broadest): When you don't know whether the target is a function name, string literal, API call, or class name, use the unified search to check all dimensions at once:

python .claude/helpers/unified_search.py  --query "CreateProcess"
# Searches: function names, signatures, strings, APIs, classes, exports
# Returns: grouped results by match dimension with function IDs

Utility Scripts

Pre-built scripts in the scripts/ subdirectory handle all DB extraction. Execute these instead of writing inline Python.

All scripts auto-resolve workspace root and .claude/helpers/ imports. Run from the workspace root directory.

findmoduledb.py -- Map Module Name to Analysis DB (Start Here)

# Find DB for a specific module
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

# List all analyzed modules
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list

# Search by extension
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --ext .dll

list_functions.py -- List or Search Functions in a Module DB

# List all functions
python .claude/skills/decompiled-code-extractor/scripts/list_functions.py extracted_dbs/appinfo_dll_e98d25a9e8.db

# Search by name pattern with signatures
python .claude/skills/decompiled-code-extractor/scripts/list_functions.py extracted_dbs/appinfo_dll_e98d25a9e8.db --search "Check" --with-signatures

# Only functions with decompiled code
python .claude/skills/decompiled-code-extractor/scripts/list_functions.py extracted_dbs/cmd_exe_6d109a3a00.db --has-decompiled

extractfunctiondata.py -- Extract All Data for a Function

# By function name
python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py extracted_dbs/appinfo_dll_e98d25a9e8.db AiCheckSecureApplicationDirectory

# By function ID (from list_functions.py output)
python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py extracted_dbs/appinfo_dll_e98d25a9e8.db --id 124

# Search for functions matching a pattern
python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py extracted_dbs/cmd_exe_6d109a3a00.db --search "BatLoop"

Output includes: signatures, decompiled C++, assembly, string literals, outbound/inbound xrefs, vtable contexts, global variable accesses, stack frame, and loop analysis.

Workflows

Workflow 1: "Extract all data for a specific function"

Extraction Progress:

• [ ] Step 1: Locate the module database
• [ ] Step 2: Find the target function
• [ ] Step 3: Extract full function data

Step 1: Locate the module database.

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py 

Step 2: Find the target function by name or search pattern.

python .claude/skills/decompiled-code-extractor/scripts/list_functions.py  --search ""

Step 3: Extract the full function record.

python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py   --json

Workflow 2: "List all functions in a module"

• [ ] Step 1: Locate the module database
• [ ] Step 2: List functions with optional filtering

Step 1: Locate the module database.

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py 

Step 2: List all functions, optionally filtering to those with decompiled code.

python .claude/skills/decompiled-code-extractor/scripts/list_functions.py  --has-decompiled --json

discoverworkspaceipc.py -- Discover Workspace IPC Servers

Intersect workspace modules with the COM, RPC, and WinRT indexes to find which modules implement IPC servers.

python .claude/skills/decompiled-code-extractor/scripts/discover_workspace_ipc.py --json
python .claude/skills/decompiled-code-extractor/scripts/discover_workspace_ipc.py --type com --json
python .claude/skills/decompiled-code-extractor/scripts/discover_workspace_ipc.py --type rpc --type winrt --json

Direct Helper Module Access

For advanced queries not covered by the scripts, use the .claude/helpers/ Python modules directly:

from helpers import open_individual_analysis_db, open_analyzed_files_db

# Custom queries on individual DB
with open_individual_analysis_db("extracted_dbs/module_hash.db") as db:
    db.search_functions_by_signature("%keyword%")
    db.get_function_by_mangled_name("?Name@@...")
    db.get_file_info()  # binary metadata (imports, exports, sections)

See [reference.md](reference.md) for full API details.

Integration with Other Skills

| Task | Recommended Skill | |------|-------------------| | Classify extracted functions by purpose | classify-functions | | Trace call graphs from extracted functions | callgraph-tracer | | Reconstruct struct types from extracted code | reconstruct-types | | Lift extracted functions to clean code | batch-lift |

Performance

| Operation | Typical Time | Notes | |-----------|-------------|-------| | Extract function data | ~1-2s | Single function DB lookup | | List/search functions | ~1-3s | Index-based when available | | Find module DB | <1s | Tracking DB lookup |

Additional Resources

• For detailed technical reference (DB fields, query patterns), see [reference.md](reference.md)
• For DB schema and JSON field formats, see [dataformatreference.md](../../docs/dataformatreference.md)
• For fileinfo.json schema, see [fileinfoformatreference.md](../../docs/fileinfoformat_reference.md)
• For IDA conventions and analysis patterns, see [idaconventionsreference.md](../../docs/idaconventionsreference.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: marcosd4h
• Source: marcosd4h/DeepExtractRuntime
• License: MIT

Install and usage instructions live in the source repository linked above.