Reversecore MCP

Generate automated defenses against detected threats. Actions: - "yara": Generate YARA detection rule - "patch": Generate binary patch (requires file_path) - "both": Generate both YARA rule and patch

Add a timestamped note to the analysis session.

Add an Indicator of Compromise to the current session.

Add a MITRE ATT&CK technique to the session.

Analyze heap corruption crashes and generate exploitation strategies. This tool bridges the gap between a raw heap crash and a practical exploit by performing: 1. **Crash Analysis**: If a crash file is provided, runs GDB triage via ``triage_crash`` to extract the crash signal, address, and backtrace. 2. **Mitigation Assessment**: Uses LIEF to detect binary protections (PIE, NX, canary, RELRO, FORTIFY) and provides bypass strategies for each. 3. **Heap Technique Selection**: Based on the overflow size, crash signal, and detected vulnerability class, selects applicable heap exploitation techniques (tcache poisoning, fastbin dup, house of spirit, etc.). 4. **Chunk Size Analysis**: Calculates the nearest glibc chunk size class and estimates the heap layout needed for exploitation. 5. **Grooming Pseudocode**: Generates pseudocode for setting up the required heap layout (grooming) for the selected technique. 6. **ROP Integration**: Checks if gadgets are available for post-exploitation code execution.

Automatically infer vulnerabilities from binary patch differences. This tool goes beyond structural binary diffing (``diff_binaries``, ``patch_diff_1day``) by applying a **security pattern recognition engine** to the changed functions. It answers: *"What vulnerability was fixed?"* and *"How can I exploit the old version?"* The workflow: 1. Compute overall similarity and identify the most-changed functions via ``radiff2``. 2. For each changed function, extract disassembly diffs and structural metadata (size change, basic block delta). 3. Apply 10 security patch pattern rules (bounds check added, safe API migration, null check, integer overflow, command injection, etc.). 4. Score matches by confidence and severity, generating per-function vulnerability inferences with exploitation hints. 5. Return a ranked report with CVE-style vulnerability candidates and actionable next steps.

Analyze structural changes between two binary variants (Lineage Mapper). This tool combines binary diffing with control flow analysis to understand *how* a binary has evolved. It identifies the most modified functions and generates their Control Flow Graphs (CFG) for comparison. **Use Cases:** - **Malware Lineage**: "How did Lazarus Group modify their backdoor?" - **Patch Diffing**: "What logic changed in the vulnerable function?" - **Variant Analysis**: "Is this a new version of the same malware?"

Analyze cross-references (xrefs) for a specific address using radare2. Cross-references show the relationships between code blocks - who calls this function (callers) and what it calls (callees). This is essential for: - Understanding program flow - Tracing data dependencies - Identifying attack surfaces - Reverse engineering malware C&C **xref_type Options:** - **"to"**: Show who references this address (callers/jumps TO here) - **"from"**: Show what this address references (calls/jumps FROM here) - **"all"**: Show both directions (complete relationship map)

Collect and normalize forensic artifacts from analysis results. Use this tool to register artifacts discovered during memory, disk, or network analysis. Artifacts are normalized and stored for subsequent correlation with ``artifact_correlate_ioc`` and YARA rule generation via ``artifact_generate_yara``.

Correlate collected forensic artifacts against IoC patterns. Runs IoC extraction patterns (IP, URL, hash, CVE, registry) against all artifact values to automatically enrich them with threat intelligence signals. Uses the existing ``extract_iocs`` infrastructure from the malware module.

Auto-generate YARA rules from collected forensic artifacts. Integrates with the adaptive vaccine pipeline to create detection signatures from suspicious strings, process names, network indicators, and injection patterns found during forensics analysis.

Export a comprehensive forensics investigation report. Combines artifact collection summary, IoC correlation results, timeline, and optionally auto-generated YARA rules into a structured Markdown report.

Build a chronological event timeline from multi-source forensic artifacts. Aggregates artifacts from memory, disk (MFT timestamps), and network captures into a single unified timeline, sorted by timestamp.

Assemble assembly instruction strings into raw machine byte values using Keystone.

Perform a security audit on a source code file (SAST). This tool analyzes source code (C, C++, Python, Go, etc.) to identify potential security vulnerabilities such as buffer overflows, injection flaws, and weak cryptography. It provides a structured breakdown of dangerous patterns found in the code to guide deeper manual or AI-driven analysis. Use this tool when you have access to original source code or when you want to analyze decompiled output exported to a file.

Fully autonomous end-to-end vulnerability discovery and exploit generation. Orchestrates a complete security research pipeline without manual intervention: **Phase 1 — Enumerate**: Lists all application functions via radare2 and filters out compiler stubs and import trampolines. **Phase 1.5 — Taint**: Runs ``taint_trace`` to automatically map source→sink data-flow paths (stdin/argv/recv → strcpy/system/execve). Paths reachable by angr are marked with a concrete exploit input. **Phase 2 — Hunt**: Runs ``vulnerability_hunter`` which combines static taint analysis (dangerous API detection), symbolic execution (angr), and dynamic crash triage (GDB) to confirm exploitability. **Phase 2.5 — Fuzz** (optional): When ``enable_fuzzing=True``, runs ``run_fuzzing_campaign`` (AFL++) for ``fuzzing_timeout`` seconds to discover crashes that static analysis may have missed. **Phase 3 — POC**: For every vulnerability where angr verified a concrete input and GDB confirmed a crash, automatically generates a pwntools POC script and verifies it locally. **Phase 4 — ROP**: For buffer-overflow POCs rated CONFIRMED or LIKELY, automatically enumerates gadgets (ROPgadget) and builds a ROP chain (pwntools) aimed at spawning a shell.

Automatically build a Return-Oriented Programming (ROP) exploit chain. Enumerates available ROP gadgets with ROPgadget, then uses the pwntools ``ROP`` class to construct a working chain for the specified exploit objective. Supports three strategies: spawning a shell via execve or ``system()``, returning into libc, and leaking a libc address to defeat ASLR.

Mark an analysis session as completed with a summary. Use this when finishing an analysis to save a summary for future reference.

Copy any accessible file to the workspace directory. This tool allows copying files from any location (including AI agent upload directories) to the workspace where other reverse engineering tools can access them. Supports files from: - Claude Desktop uploads (/mnt/user-data/uploads) - Cursor uploads - Windsurf uploads - Local file paths - Any other accessible location

Generate a comprehensive analysis report.

Create a new sub-directory within the workspace. This tool allows AI agents to dynamically create isolated sub-workspaces for different tasks or sessions.

Create a new memory session to store memories. Use this when starting a new reverse engineering analysis. The session name should be descriptive and follow a template format like 'malware_analysis_2024_001' or 'game_cheat_detection'.

Execute hybrid fuzzing campaign with Sanitizer tracking and angr concolic seed solver. Runs target fuzzer binary with AddressSanitizer, detects coverage stalls, and uses angr symbolic execution to solve magic byte constraints.

Minimize crash testcase payload via delta-debugging and generate standalone PoC scripts. Bsects crash input to find the smallest reproducible byte sequence, and generates standalone Python (subprocess/pwntools) and C reproduction code.

Synthesize LibFuzzer/AFL++ C/C++ test harness and format dictionary (.dict) for target parser. Analyzes target headers, exports, and sample files to extract candidate parser functions, magic byte signatures, and generate ready-to-compile LLVMFuzzerTestOneInput harness code.

Triage AddressSanitizer/UBSan crash log and compute CWE and CVSS v3.1 rating. Extracts bug class (heap-buffer-overflow, UAF, double-free), faulting PC, memory access type, allocation/free/crash callstacks, and calculates CVSS score and vector.

Recover dynamically constructed stack strings and emulated loop strings in a binary. Scans function basic blocks for stack stores (byte/word/dword constants) and micro-emulates tight loops (XOR/additive/rolling ciphers) to capture decrypted strings.

Detect anti-debugging, timing anomalies, hypervisor/anti-VM, and opaque conditionals. Performs a 4-pillar multi-pass heuristic and structural analysis: 1. Anti-Debugging: PEB (BeingDebugged, NtGlobalFlag, ProcessHeap), APIs, Traps. 2. Timing Anomaly: RDTSC/RDTSCP deltas, high-res timers, sleep acceleration. 3. Hypervisor & Anti-VM: CPUID leaf 1/0x40000000, VMware backdoor, VM MAC OUIs, drivers. 4. Opaque Conditionals: SEH/VEH manipulation, memory exhaustion loops, mathematical invariants.

Detect packer, compiler, and protector using Shannon entropy, section heuristics, and signature matching.

Deep scan combining block-level entropy, overlay analysis, section anomaly heuristics, and full signature scanning.

Compare two binary files to identify code changes and modifications. This tool uses radiff2 to perform binary diffing, which is essential for: - **Patch Analysis (1-day Exploits)**: Compare pre-patch and post-patch binaries to identify security vulnerabilities fixed in updates - **Game Hacking**: Find offset changes after game updates to maintain functionality - **Malware Variant Analysis**: Identify code differences between malware variants (e.g., "90% similar to Lazarus malware, but C2 address generation changed") The tool provides: - Similarity score (0.0-1.0) between binaries - List of code changes with addresses and descriptions - Optional function-level comparison for targeted analysis

Analyze the NTFS Master File Table (MFT) for file timeline and metadata. Provides full filesystem metadata including file creation/modification/access times, which is critical for establishing a forensic timeline.

Extract a live (non-deleted) file from a disk image by inode number.

Compute and verify the integrity hash of a disk image or recovered file. Essential for forensic chain of custody — verifies that an image has not been tampered with since acquisition.

List all files and directories in a disk/filesystem image.

List partition layout of a disk image using Sleuth Kit mmls.

Recover a deleted file from a disk/filesystem image by inode number. Use ``disk_list_files`` with ``include_deleted=True`` first to find the inode number of the deleted file, then pass it to this tool.

Detect hidden malicious behaviors using static analysis + emulation. This tool performs a hybrid analysis: 1. **Scan**: Finds "Orphan Functions" (not called by main) and "Suspicious Logic" (magic value checks). 2. **Hypothesize**: (Optional) If `hypothesis` is provided, it sets up emulation conditions. 3. **Emulate**: (Optional) If `focus_function` is provided, it emulates that specific function to verify the hypothesis (e.g., "If register eax=0x1234, does it call system()?").

Analyze opaque predicates and identify unreachable basic blocks in a function CFG. Detects algebraic/constant opaque predicates (e.g. zero-flag tests, constant comparisons, redundant jumps) and computes effective reachable blocks to simplify control flow analysis.

Emulate the execution of a binary using the Qiling framework. Allows running PE, ELF, and Mach-O binaries under dynamic OS-level sandbox emulation. Captures register states, memory modifications, stdout/stderr, and API/syscall traces.

Emulate machine code execution using radare2 ESIL (Evaluable Strings Intermediate Language). This tool provides safe, sandboxed emulation of binary code without actual execution. Perfect for analyzing obfuscated code, understanding register states, and predicting execution outcomes without security risks.

End the current analysis session.

Analyze differences between two binaries and explain changes in natural language. This tool combines binary diffing with decompilation to help understand security patches. It identifies changed functions, decompiles them, and uses heuristics to explain the nature of the changes (e.g., "Added bounds check", "Replaced unsafe API").

Extract Indicators of Compromise (IOCs) from text or file using regex. This tool automatically finds and extracts potential IOCs like IP addresses, URLs, and email addresses from any text input (e.g., strings output, decompiled code, logs).

Extract RTTI (Run-Time Type Information) from C++ binaries. RTTI provides class names and inheritance hierarchies in C++ binaries, which is invaluable for understanding object-oriented malware and game clients.

Find similar patterns from previous analyses. Use this to check if current findings match anything from past analyses. Enables knowledge transfer across projects.

Generate an advanced YARA rule based on radare2 disassembly opcodes. This masks offsets in CALL/JMP instructions to reduce false positives.

Generate an enhanced YARA rule with structural conditions to reduce false positives. This function creates YARA rules that combine: - String patterns (required) - Structural conditions (PE characteristics, file size) - Import table checks (optional) - Section name checks (optional) - Entry point patterns (optional) **Why Enhanced Rules?** Simple string-only rules cause high false positive rates. By adding structural conditions, rules become more precise and suitable for production use.

Generate a Control Flow Graph (CFG) for a specific function. This tool uses radare2 to analyze the function structure and returns a visualization code (Mermaid by default) or PNG image that helps AI understand the code flow without reading thousands of lines of assembly.

Generate a dynamic fuzzing harness (Qiling + AFL++) for a vulnerable function. Instead of running a heavy fuzzer within the MCP server, this tool generates a ready-to-use Python script that the user can run with AFL++ to prove vulnerability exploitability.