Reversecore MCP

Generate automated defenses against detected threats. Actions: - "yara": Generate YARA detection rule - "patch": Generate binary patch (requires file_path) - "both": Generate both YARA rule and patch

Analyze heap corruption crashes and generate exploitation strategies. This tool bridges the gap between a raw heap crash and a practical exploit by performing: 1. **Crash Analysis**: If a crash file is provided, runs GDB triage via ``triage_crash`` to extract the crash signal, address, and backtrace. 2. **Mitigation Assessment**: Uses LIEF to detect binary protections (PIE, NX, canary, RELRO, FORTIFY) and provides bypass strategies for each. 3. **Heap Technique Selection**: Based on the overflow size, crash signal, and detected vulnerability class, selects applicable heap exploitation techniques (tcache poisoning, fastbin dup, house of spirit, etc.). 4. **Chunk Size Analysis**: Calculates the nearest glibc chunk size class and estimates the heap layout needed for exploitation. 5. **Grooming Pseudocode**: Generates pseudocode for setting up the required heap layout (grooming) for the selected technique. 6. **ROP Integration**: Checks if gadgets are available for post-exploitation code execution.

Automatically infer vulnerabilities from binary patch differences. This tool goes beyond structural binary diffing (``diff_binaries``, ``patch_diff_1day``) by applying a **security pattern recognition engine** to the changed functions. It answers: *"What vulnerability was fixed?"* and *"How can I exploit the old version?"* The workflow: 1. Compute overall similarity and identify the most-changed functions via ``radiff2``. 2. For each changed function, extract disassembly diffs and structural metadata (size change, basic block delta). 3. Apply 10 security patch pattern rules (bounds check added, safe API migration, null check, integer overflow, command injection, etc.). 4. Score matches by confidence and severity, generating per-function vulnerability inferences with exploitation hints. 5. Return a ranked report with CVE-style vulnerability candidates and actionable next steps.

Analyze structural changes between two binary variants (Lineage Mapper). This tool combines binary diffing with control flow analysis to understand *how* a binary has evolved. It identifies the most modified functions and generates their Control Flow Graphs (CFG) for comparison. **Use Cases:** - **Malware Lineage**: "How did Lazarus Group modify their backdoor?" - **Patch Diffing**: "What logic changed in the vulnerable function?" - **Variant Analysis**: "Is this a new version of the same malware?"

Analyze cross-references (xrefs) for a specific address using radare2. Cross-references show the relationships between code blocks - who calls this function (callers) and what it calls (callees). This is essential for: - Understanding program flow - Tracing data dependencies - Identifying attack surfaces - Reverse engineering malware C&C **xref_type Options:** - **"to"**: Show who references this address (callers/jumps TO here) - **"from"**: Show what this address references (calls/jumps FROM here) - **"all"**: Show both directions (complete relationship map)

Collect and normalize forensic artifacts from analysis results. Use this tool to register artifacts discovered during memory, disk, or network analysis. Artifacts are normalized and stored for subsequent correlation with ``artifact_correlate_ioc`` and YARA rule generation via ``artifact_generate_yara``.

Correlate collected forensic artifacts against IoC patterns. Runs IoC extraction patterns (IP, URL, hash, CVE, registry) against all artifact values to automatically enrich them with threat intelligence signals. Uses the existing ``extract_iocs`` infrastructure from the malware module.

Auto-generate YARA rules from collected forensic artifacts. Integrates with the adaptive vaccine pipeline to create detection signatures from suspicious strings, process names, network indicators, and injection patterns found during forensics analysis.

Export a comprehensive forensics investigation report. Combines artifact collection summary, IoC correlation results, timeline, and optionally auto-generated YARA rules into a structured Markdown report.

Build a chronological event timeline from multi-source forensic artifacts. Aggregates artifacts from memory, disk (MFT timestamps), and network captures into a single unified timeline, sorted by timestamp.

Assemble assembly instruction strings into raw machine byte values using Keystone.

Perform a security audit on a source code file (SAST). This tool analyzes source code (C, C++, Python, Go, etc.) to identify potential security vulnerabilities such as buffer overflows, injection flaws, and weak cryptography. It provides a structured breakdown of dangerous patterns found in the code to guide deeper manual or AI-driven analysis. Use this tool when you have access to original source code or when you want to analyze decompiled output exported to a file.

Fully autonomous end-to-end vulnerability discovery and exploit generation. Orchestrates a complete security research pipeline without manual intervention: **Phase 1 — Enumerate**: Lists all application functions via radare2 and filters out compiler stubs and import trampolines. **Phase 1.5 — Taint**: Runs ``taint_trace`` to automatically map source→sink data-flow paths (stdin/argv/recv → strcpy/system/execve). Paths reachable by angr are marked with a concrete exploit input. **Phase 2 — Hunt**: Runs ``vulnerability_hunter`` which combines static taint analysis (dangerous API detection), symbolic execution (angr), and dynamic crash triage (GDB) to confirm exploitability. **Phase 2.5 — Fuzz** (optional): When ``enable_fuzzing=True``, runs ``run_fuzzing_campaign`` (AFL++) for ``fuzzing_timeout`` seconds to discover crashes that static analysis may have missed. **Phase 3 — POC**: For every vulnerability where angr verified a concrete input and GDB confirmed a crash, automatically generates a pwntools POC script and verifies it locally. **Phase 4 — ROP**: For buffer-overflow POCs rated CONFIRMED or LIKELY, automatically enumerates gadgets (ROPgadget) and builds a ROP chain (pwntools) aimed at spawning a shell.

Automatically build a Return-Oriented Programming (ROP) exploit chain. Enumerates available ROP gadgets with ROPgadget, then uses the pwntools ``ROP`` class to construct a working chain for the specified exploit objective. Supports three strategies: spawning a shell via execve or ``system()``, returning into libc, and leaking a libc address to defeat ASLR.

Mark an analysis session as completed with a summary. Use this when finishing an analysis to save a summary for future reference.

Copy any accessible file to the workspace directory. This tool allows copying files from any location (including AI agent upload directories) to the workspace where other reverse engineering tools can access them. Supports files from: - Claude Desktop uploads (/mnt/user-data/uploads) - Cursor uploads - Windsurf uploads - Local file paths - Any other accessible location

Create a new sub-directory within the workspace. This tool allows AI agents to dynamically create isolated sub-workspaces for different tasks or sessions.

Create a new memory session to store memories. Use this when starting a new reverse engineering analysis. The session name should be descriptive and follow a template format like 'malware_analysis_2024_001' or 'game_cheat_detection'.

Detect packer, compiler, and protector using LIEF and Strings heuristics. (Replaces legacy Detect It Easy tool)

Deep scan for packer/compiler/protector detection. Combines LIEF section entropy analysis with full strings heuristic scanning.

Compare two binary files to identify code changes and modifications. This tool uses radiff2 to perform binary diffing, which is essential for: - **Patch Analysis (1-day Exploits)**: Compare pre-patch and post-patch binaries to identify security vulnerabilities fixed in updates - **Game Hacking**: Find offset changes after game updates to maintain functionality - **Malware Variant Analysis**: Identify code differences between malware variants (e.g., "90% similar to Lazarus malware, but C2 address generation changed") The tool provides: - Similarity score (0.0-1.0) between binaries - List of code changes with addresses and descriptions - Optional function-level comparison for targeted analysis

Analyze the NTFS Master File Table (MFT) for file timeline and metadata. Provides full filesystem metadata including file creation/modification/access times, which is critical for establishing a forensic timeline.

Extract a live (non-deleted) file from a disk image by inode number.

Compute and verify the integrity hash of a disk image or recovered file. Essential for forensic chain of custody — verifies that an image has not been tampered with since acquisition.

List all files and directories in a disk/filesystem image.

List partition layout of a disk image using Sleuth Kit mmls.

Recover a deleted file from a disk/filesystem image by inode number. Use ``disk_list_files`` with ``include_deleted=True`` first to find the inode number of the deleted file, then pass it to this tool.

Detect hidden malicious behaviors using static analysis + emulation. This tool performs a hybrid analysis: 1. **Scan**: Finds "Orphan Functions" (not called by main) and "Suspicious Logic" (magic value checks). 2. **Hypothesize**: (Optional) If `hypothesis` is provided, it sets up emulation conditions. 3. **Emulate**: (Optional) If `focus_function` is provided, it emulates that specific function to verify the hypothesis (e.g., "If register eax=0x1234, does it call system()?").

Emulate the execution of a binary using the Qiling framework. Allows running PE, ELF, and Mach-O binaries under dynamic OS-level sandbox emulation. Captures register states, memory modifications, stdout/stderr, and API/syscall traces.

Emulate machine code execution using radare2 ESIL (Evaluable Strings Intermediate Language). This tool provides safe, sandboxed emulation of binary code without actual execution. Perfect for analyzing obfuscated code, understanding register states, and predicting execution outcomes without security risks.

Analyze differences between two binaries and explain changes in natural language. This tool combines binary diffing with decompilation to help understand security patches. It identifies changed functions, decompiles them, and uses heuristics to explain the nature of the changes (e.g., "Added bounds check", "Replaced unsafe API").

Extract Indicators of Compromise (IOCs) from text or file using regex. This tool automatically finds and extracts potential IOCs like IP addresses, URLs, and email addresses from any text input (e.g., strings output, decompiled code, logs).

Extract RTTI (Run-Time Type Information) from C++ binaries. RTTI provides class names and inheritance hierarchies in C++ binaries, which is invaluable for understanding object-oriented malware and game clients.

Find similar patterns from previous analyses. Use this to check if current findings match anything from past analyses. Enables knowledge transfer across projects.

Generate an advanced YARA rule based on radare2 disassembly opcodes. This masks offsets in CALL/JMP instructions to reduce false positives.

Generate a Control Flow Graph (CFG) for a specific function. This tool uses radare2 to analyze the function structure and returns a visualization code (Mermaid by default) or PNG image that helps AI understand the code flow without reading thousands of lines of assembly.

Generate a dynamic fuzzing harness (Qiling + AFL++) for a vulnerable function. Instead of running a heavy fuzzer within the MCP server, this tool generates a ready-to-use Python script that the user can run with AFL++ to prove vulnerability exploitability.

Generate and verify a pwntools proof-of-concept exploit script. Converts the output of ``vulnerability_hunter`` (symbolic execution concrete input + crash metadata) into a runnable Python POC script using pwntools. Automatically verifies the POC by executing it against the binary and checking for fatal crash signals.

Generate a YARA signature from opcode bytes at a specific address. This tool extracts opcode bytes from a function or code section and formats them as a YARA rule, enabling automated malware detection. It attempts to mask variable values (addresses, offsets) to create more flexible signatures. **Use Cases:** - Generate detection signatures for malware samples - Create YARA rules for threat hunting - Automate IOC (Indicator of Compromise) generation - Build malware family signatures **Workflow:** 1. Extract opcode bytes from specified address 2. Apply basic masking for variable values (optional) 3. Format as YARA rule template 4. Return ready-to-use YARA rule

Generate a YARA rule from function bytes. This tool extracts bytes from a function and generates a ready-to-use YARA rule for malware detection and threat hunting.

Retrieve the status and result of a background job from the task queue.

Get complete details and context for a specific session. Use this when resuming an analysis or reviewing past work. Returns all memories and patterns associated with the session.

Get relevant context from past analyses for current work. Use this proactively when analyzing something new to check if there's relevant knowledge from previous sessions.

Get the current health status and resource usage of the MCP server. Use this to monitor the server's uptime, memory consumption, and tool execution statistics. Returns: ToolResult containing: - uptime_seconds: Server uptime - memory_usage_mb: Current memory usage in MB - status: 'healthy' or 'degraded' - tool_stats: Summary of tool execution success/failure

Get detailed execution metrics for specific or all tools.

List all analysis sessions with timestamps and status. Use this to see what analyses have been done before, or to find a session to resume.

List all files in the workspace directory. Returns: ToolResult with list of files in workspace

Match and filter known library functions to focus on user code. This tool uses radare2's zignatures (FLIRT-compatible signature matching) to: - **Reduce Analysis Noise**: Skip analysis of known library functions (strcpy, malloc, etc.) - **Focus on User Code**: Identify which functions are original vs library code - **Save Time & Tokens**: Reduce analysis scope by 80% by filtering out standard libraries - **Improve Accuracy**: Focus AI analysis on the actual malicious/interesting code Common use cases: - Analyzing large binaries (>25MB) where most code is OpenSSL, zlib, MFC, etc. - Game client reverse engineering (filter out Unreal Engine / Unity standard library) - Malware analysis (focus on custom malware code, skip Windows API wrappers) The tool automatically uses built-in signature databases for common libraries and can optionally use custom signature databases for specialized analysis.

Run a Volatility3 plugin against a memory dump file. Supports Windows, Linux, and macOS memory dumps. Heavy plugin operations (malfind, psscan, netscan) are queued via ARQ for non-blocking execution.

Detect process injection and suspicious memory regions using Volatility3 malfind. Uses the ``malfind`` plugin to identify memory regions with executable permissions that contain suspicious patterns (MZ headers, shellcode signatures).