概要

DeepExtract Agent Analysis Runtime は、DeepExtractIDA 抽出出力の上に動作する AI 主導のバイナリ解析ツールキットです。 バイナリ SQLite データベース、デコンパイルされた C++ ソースファイル、および JSON メタデータをスラッシュコマンド、特殊なサブエージェント、解析スキル、ライフサイクルホック、共有ヘルパーライブラリでクエリ可能なランタイムに変換します。

AI コーディングエージェント (Cursor, Claude Code, Codex) は、ソースコードのリポジトリを効果的に解析します: インポートを解決し、型定義に従い、言語サーバーや構文ツリーを介して呼び出し階層を移動します。 コンパイルされたバイナリは構造的なギャップを示します。 バイナリ解析に必要なクロスリファレンス、PEメタデータ、アセンブリの指示、およびスタックフレームのレイアウトは、リバースエンジニアリングフレームワーク内でロックされ、ネイティブコードナビゲーションツールを介してこれらのエージェントにアクセスできます。 C++ 出力コンパウンドの問題を解読: これは、プロジェクト構造なしの [.cpp] ファイルにグループ化された分離された関数の定義から構成され、 #include] ヘッダーなし、共有型定義なし.

DeepExtract Agent Analysis Runtime

Overview

DeepExtract Agent Analysis Runtime is an AI-driven binary analysis toolkit that operates on top of DeepExtractIDA extraction outputs. It transforms per-binary SQLite databases, decompiled C++ source files, and JSON metadata into a queryable runtime with slash commands, specialized subagents, analysis skills, lifecycle hooks, and a shared helper library.

AI coding agents (Cursor, Claude Code, Codex) parse source code repositories effectively: they resolve imports, follow type definitions, and navigate call hierarchies through language servers and syntax trees. Compiled binaries present a structural gap. The cross-references, PE metadata, assembly instructions, and stack frame layouts required for binary analysis are locked inside reverse engineering frameworks and are inaccessible to these agents through their native code navigation tools. Decompiled C++ output compounds the problem: it consists of isolated function definitions grouped into flat .cpp files with no project structure, no #include headers, and no shared type definitions. Standard code indexing mechanisms (LSPs, Tree-sitter parsers, embedding-based search) fail to resolve cross-references across these files, forcing the agent to fall back to unreliable text search for callgraph traversal.

DeepExtractIDA addresses the extraction side by running a deterministic pipeline through IDA Pro 9.x and the Hex-Rays decompiler, producing structured SQLite databases with full function records, cross-reference tables, PE metadata, and JSON indexes. The Agent Analysis Runtime addresses the consumption side: it provides deterministic Python scripts that query those databases directly, replacing semantic search with structured tool invocation. The agent invokes a skill script through its shell tool, the script queries the database, and the agent reasons on the structured result. Large payloads (function bodies, callgraph data, scan results) remain on disk in workspace directories; the agent operates on compact summaries and loads full data on demand.

The runtime deploys as a .claude/ directory alongside the extraction data and operates across Claude Code, Cursor, Codex, and any AI coding environment that supports CLAUDE.md or equivalent agent configuration.

DeepExtractIDA does not write the runtime bootstrap by default. Headless extraction must pass -EnableAI so the output directory contains CLAUDE.md. Without that flag the extraction data is still produced, but the runtime cannot be installed through the agent bootstrap flow.

New here? Start with the Onboarding Guide.

---

How It Works

The runtime is organized into five layers. Each layer depends only on the layers below it.

User
  |
  v
Slash Commands (/triage, /audit, /scan, ...)
  |
  v
Specialized Agents (re-analyst, security-auditor, ...)
  |
  v