Batch Lift
Lift related groups of decompiled functions together with shared context -- C++ class methods, call chains, or entire subtrees from exports. Builds shared struct definitions, determines dependency order, and generates coordinated output. Use when the user asks to lift multiple related functions, an entire class, a call chain, all methods of a type, everything reachable from an export, or mentions…
Ai Logic Scanner
>-
Decompiled Code Extractor
Extract function data from DeepExtractIDA analysis databases -- decompiled C++, raw x64 assembly, signatures, string literals, xrefs, vtable contexts, global variable accesses, stack frames, and loop analysis. Use when you need to locate a module's analysis database, list or search functions within it, or extract all data for a specific function. This is the foundational data-access skill that ot…
Reconstruct Types
Reconstruct C/C++ struct and class definitions from IDA Pro decompiled code by scanning memory access patterns, vtable contexts, and mangled names across all functions in a module. Use when the user asks to reconstruct types, build struct layouts, extract class hierarchies, generate header files, improve type information for code lifting, or analyze struct/class definitions from decompiled binari…
Generate Re Report
Generate comprehensive reverse engineering reports from DeepExtractIDA analysis databases, synthesizing binary identity, security posture, import/export capabilities, internal architecture, complexity hotspots, string intelligence, call graph topology, anomalies, and prioritized focus recommendations. Use when the user asks to generate a report, summarize a binary, understand what a module does,…
Winrt Interface Analysis
>
Rpc Interface Analysis
>
Ai Memory Corruption Scanner
>-
Ai Taint Scanner
>-
Function Index
Look up, filter, and resolve functions using function_index.json files generated by DeepExtractIDA for each extracted module. Map function names to their .cpp files, filter application code from library boilerplate (WIL/STL/WRL/CRT/ETW), list module functions with statistics, and resolve function names to absolute file paths. Use when locating a function's source file, filtering boilerplate from…
Import Export Resolver
>-
Com Interface Reconstruction
Reconstruct COM and WRL interface definitions from IDA Pro decompiled Windows PE binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations. Use when the user asks to reconstruct COM interfaces, find COM classes, decode WRL templates, map CLSIDs, generate IDL descriptions, identify QueryInterface patterns, analyze vtable layouts as C…
Classify Functions
Automatically classify and triage every function in a DeepExtractIDA module by purpose (file I/O, registry, network, crypto, security, telemetry, dispatch, initialization, etc.) using API calls, string analysis, naming patterns, assembly metrics, and loop complexity. Use when the user asks to classify functions, triage a binary, understand what a module does at a high level, find functions by cat…
Security Dossier
Build comprehensive security context dossiers for functions in DeepExtractIDA binaries -- gathering identity, attack reachability, data flow exposure, dangerous operations, resource patterns, complexity metrics, and neighboring context in one command. Use when the user asks to audit a function's security posture, build a security dossier, assess attack surface, check function reachability from ex…
Map Attack Surface
Map the complete attack surface of a Windows PE binary by discovering all entry points (exports, COM vtable methods, RPC handlers, WinRT methods, callbacks, window procedures, service handlers, TLS callbacks, IPC dispatchers, socket handlers, and more), ranking them by attack value using callgraph reachability to dangerous operations, and generating CRS-compatible entrypoints.json. Use when the u…
Com Interface Analysis
>
Callgraph Tracer
Trace call graphs, execution paths, and cross-module xref chains across DeepExtractIDA analysis databases. Use when the user asks to trace a function's call chain, find paths between functions, understand cross-module dependencies, show what a function calls across DLL boundaries, generate call graph diagrams, find reachable functions from an entry point, identify recursive call clusters, or asks…