What problem does it solve?
Deep-analysis helps reverse engineers answer focused, specific questions about binary behavior by guiding an iterative, evidence-based investigation and making incremental, reversible improvements to the decompiler database to improve readability and reproducibility.
Core Features & Use Cases
- Iterative Investigation Loop: Read decompiled code, analyze operations and assumptions, apply small database edits (renames, type fixes, prototypes), verify improvements, and follow new evidence threads.
- Question-Focused Strategies: Prescribed workflows for "What does this function do?", "Does this use cryptography?", "What is the C2 address?", and "Fix types in this function", each with discovery, investigation, improvement, verification, and tracking steps.
- Evidence & Documentation: Emphasizes exact-address evidence, decompilation snippets, documented assumptions with confidence ratings, and actionable follow-up threads for handoff or continued analysis.
- Use Case: Triaged suspicious function flagged for potential crypto can be investigated end-to-end to confirm algorithm type, locate key material, and create precise bookmarks and comments for reviewers.
Quick Start
Investigate function 0x401234 to determine whether it performs AES encryption and update the decompiler database with descriptive renames, corrected types, and decompilation comments.
