概述

DeepExtract 代理分析运行时 是一个基于 AI 驱动的二进制分析工具包，运行在 DeepExtractIDA 提取输出之上。它将每个二进制的 SQLite 数据库、反编译的 C++ 源文件和 JSON 元数据转换为可查询运行时，支持斜杠命令、专用子代理、分析技能、生命周期钩子和共享辅助库。

AI编码代理（Cursor、Claude Code、Codex）能够有效解析源代码仓库：它们解析导入、遵循类型定义，并通过语言服务器和语法树导航调用层级。编译后的二进制文件存在结构性空白。二进制分析所需的交叉引用、PE元数据、汇编指令和栈框布局被锁在逆向工程框架中，这些代理无法通过其原生代码导航工具访问。反编译的C++输出使问题更加复杂：它由孤立的函数定义组成，分组成无项目结构、无#include头部、无共享类型定义的扁平.cpp文件。

DeepExtract Agent Analysis Runtime

Overview

DeepExtract Agent Analysis Runtime is an AI-driven binary analysis toolkit that operates on top of DeepExtractIDA extraction outputs. It transforms per-binary SQLite databases, decompiled C++ source files, and JSON metadata into a queryable runtime with slash commands, specialized subagents, analysis skills, lifecycle hooks, and a shared helper library.

AI coding agents (Cursor, Claude Code, Codex) parse source code repositories effectively: they resolve imports, follow type definitions, and navigate call hierarchies through language servers and syntax trees. Compiled binaries present a structural gap. The cross-references, PE metadata, assembly instructions, and stack frame layouts required for binary analysis are locked inside reverse engineering frameworks and are inaccessible to these agents through their native code navigation tools. Decompiled C++ output compounds the problem: it consists of isolated function definitions grouped into flat .cpp files with no project structure, no #include headers, and no shared type definitions. Standard code indexing mechanisms (LSPs, Tree-sitter parsers, embedding-based search) fail to resolve cross-references across these files, forcing the agent to fall back to unreliable text search for callgraph traversal.

DeepExtractIDA addresses the extraction side by running a deterministic pipeline through IDA Pro 9.x and the Hex-Rays decompiler, producing structured SQLite databases with full function records, cross-reference tables, PE metadata, and JSON indexes. The Agent Analysis Runtime addresses the consumption side: it provides deterministic Python scripts that query those databases directly, replacing semantic search with structured tool invocation. The agent invokes a skill script through its shell tool, the script queries the database, and the agent reasons on the structured result. Large payloads (function bodies, callgraph data, scan results) remain on disk in workspace directories; the agent operates on compact summaries and loads full data on demand.

The runtime deploys as a .claude/ directory alongside the extraction data and operates across Claude Code, Cursor, Codex, and any AI coding environment that supports CLAUDE.md or equivalent agent configuration.

DeepExtractIDA does not write the runtime bootstrap by default. Headless extraction must pass -EnableAI so the output directory contains CLAUDE.md. Without that flag the extraction data is still produced, but the runtime cannot be installed through the agent bootstrap flow.

New here? Start with the Onboarding Guide.

---

How It Works

The runtime is organized into five layers. Each layer depends only on the layers below it.

User
  |
  v
Slash Commands (/triage, /audit, /scan, ...)
  |
  v
Specialized Agents (re-analyst, security-auditor, ...)
  |
  v