state-machine-extractor

Reconstructs state machines and dispatch maps from decompiled Windows binaries into JSON and Mermaid diagrams.

17|3|Updated Feb 22, 2026

Search Tags:#reverse-engineering #state-machine #diagram-generation #ida-pro #decompiled-code #dispatch-table

Ready to run

npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill state-machine-extractor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: state-machine-extractor
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/state-machine-extractor
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill state-machine-extractor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Reconstructs state machines and dispatch mappings from IDA Pro decompiled Windows binaries, turning complex control-flow into readable models and diagrams for analysis and documentation.

Core Features & Use Cases

Detects switch/case, if-chain, and jump-table patterns in decompiled code to reveal dispatch logic.
Reconstructs state machines with states, transitions, initial and terminal states, and visualizable representations.
Generates Mermaid and DOT diagrams for quick visualization, reporting, and integration with documentation.
Builds per-function dispatch tables mapping case values to handlers, with optional labeling, source tracing, and confidence scoring.
Suitable for reverse engineering, malware analysis, and binary analysis workflows where understanding control flow is critical.

Quick Start

Run the state-machine-extractor on a module analysis database to identify dispatch tables and reconstruct state machines.

Frequently Asked Questions about state-machine-extractor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract a state machine from decompiled binary code?▼

You can extract a state machine from decompiled binary code by detecting switch/case, if-chain, and jump-table patterns in IDA Pro decompiled Windows binaries to reconstruct states, transitions, and dispatch logic.

How do I generate a dispatch table from a decompiled Windows binary?▼

Generating a dispatch table from a decompiled Windows binary involves parsing decompiled code for switch-case handlers and mapping case values to handler functions, with optional labeling, source tracing, and confidence scoring.

Can I use IDA Pro decompiled code to visualize switch-case control flow?▼

Yes, IDA Pro decompiled code can be parsed to visualize switch-case control flow by reconstructing state machines and generating Mermaid and DOT diagrams for quick reporting and documentation integration.

What is the best way to map state transitions during reverse engineering?▼

The best way to map state transitions during reverse engineering is to detect jump-table patterns in decompiled code, reconstruct the state machine with initial and terminal states, and output structured JSON for downstream tooling.

Does state machine reconstruction work for malware analysis on Windows binaries?▼

State machine reconstruction works for malware analysis on Windows binaries by parsing decompiled code to reveal complex dispatch logic, mapping switch-case handlers, and building structured models of the control flow.

What are the limitations of extracting state machines from decompiled code?▼

Limitations of extracting state machines from decompiled code include reliance on accurate decompilation of Windows binaries and the ability to detect recognizable switch, if-chain, or jump-table dispatch patterns in the analyzed module.