개요

DeepExtract Agent Analysis Runtime는 DeepExtractIDA 추출 출력의 상단에 작동하는 AI 기반 이진 분석 툴킷입니다. SQLite 데이터베이스, decompiled C++ 소스 파일 및 JSON 메타데이터를 슬래시 명령, 특수 서브 시약, 분석 기술, 수명주기 후크 및 공유 헬퍼 라이브러리로 쿼리 가능한 런타임으로 변환합니다.

AI 코딩 에이전트 (Cursor, Claude Code, Codex) 파스 소스 코드 저장소 효과적으로: 그들은 수입을 해결, 유형 정의를 따르고, 언어 서버와 구문 나무를 통해 전화 계층을 탐색. Compiled binaries는 구조적 간격을 제시합니다. 교차 환경, PE 메타데이터, 조립 지침 및 이진 분석에 필요한 스택 프레임 레이아웃은 역방향 엔지니어링 프레임 워크 내부에 잠겨 있으며, 기본 코드 탐색 도구를 통해 이러한 에이전트에 액세스 할 수 있습니다. Decompiled C++ 출력 화합물 문제: 그것은 평평한 .cpp]로 그룹화되는 고립된 기능 정의로, 프로젝트 구조 없음, 아니 #include 우두머리 및 공유된 유형 정의 이루어져 있습니다.

DeepExtract Agent Analysis Runtime

Overview

DeepExtract Agent Analysis Runtime is an AI-driven binary analysis toolkit that operates on top of DeepExtractIDA extraction outputs. It transforms per-binary SQLite databases, decompiled C++ source files, and JSON metadata into a queryable runtime with slash commands, specialized subagents, analysis skills, lifecycle hooks, and a shared helper library.

AI coding agents (Cursor, Claude Code, Codex) parse source code repositories effectively: they resolve imports, follow type definitions, and navigate call hierarchies through language servers and syntax trees. Compiled binaries present a structural gap. The cross-references, PE metadata, assembly instructions, and stack frame layouts required for binary analysis are locked inside reverse engineering frameworks and are inaccessible to these agents through their native code navigation tools. Decompiled C++ output compounds the problem: it consists of isolated function definitions grouped into flat .cpp files with no project structure, no #include headers, and no shared type definitions. Standard code indexing mechanisms (LSPs, Tree-sitter parsers, embedding-based search) fail to resolve cross-references across these files, forcing the agent to fall back to unreliable text search for callgraph traversal.

DeepExtractIDA addresses the extraction side by running a deterministic pipeline through IDA Pro 9.x and the Hex-Rays decompiler, producing structured SQLite databases with full function records, cross-reference tables, PE metadata, and JSON indexes. The Agent Analysis Runtime addresses the consumption side: it provides deterministic Python scripts that query those databases directly, replacing semantic search with structured tool invocation. The agent invokes a skill script through its shell tool, the script queries the database, and the agent reasons on the structured result. Large payloads (function bodies, callgraph data, scan results) remain on disk in workspace directories; the agent operates on compact summaries and loads full data on demand.

The runtime deploys as a .claude/ directory alongside the extraction data and operates across Claude Code, Cursor, Codex, and any AI coding environment that supports CLAUDE.md or equivalent agent configuration.

DeepExtractIDA does not write the runtime bootstrap by default. Headless extraction must pass -EnableAI so the output directory contains CLAUDE.md. Without that flag the extraction data is still produced, but the runtime cannot be installed through the agent bootstrap flow.

New here? Start with the Onboarding Guide.

---

How It Works

The runtime is organized into five layers. Each layer depends only on the layers below it.

User
  |
  v
Slash Commands (/triage, /audit, /scan, ...)
  |
  v
Specialized Agents (re-analyst, security-auditor, ...)
  |
  v