Ablation is a self-contained reverse engineering framework.
It depends on neither legacy tools nor an MCP server, which removes the attack surface associated with MCP.
When used with Codex or Claude Code, it operates as an autonomous reverse engineering system.
Claude Code Setup & Configuration
cd ~/ablation && claude/model claude-sonnet-4-6
or
/model claude-sonnet-4-5
/goal reverse engineer [whatever you want]
Not sure what effort level to be set on? Ask inline without interrupting the main context:
/btw What effort level should we be set on right now?
Auto-compact true
Continue automatically at usage limit true
Switch models when a message is flagged Switch automatically
Show tips false
Claude-drafted feedback off
Reduce motion false
Thinking mode true
Fast mode (Opus 5.5) false
Prompt suggestions true
Session recap true
Rewind code (checkpoints) true
Dynamic workflows true
Ultracode keyword trigger false
Dynamic workflow size unrestricted
Artifacts false
Verbose output true
Terminal progress bar true
Show turn duration true
Time format auto
Default permission mode Manual
Worktree base ref fresh
Use auto mode during plan true
Respect .gitignore in file picker true
Skip the /copy picker false
Copy on select true
Auto-scroll true
Open agents view by default false
← opens agents false
Auto-update channel disabled (config)
Theme Dark mode (colorblind-friendly)
Local notifications Auto
Push when actions required true
Push when Claude decides true
Output style Explanatory
Language Default (English)
Editor mode normal
Question auto-continue timeout never
Show last response in external editor true
Show PR status footer true
Model claude-sonnet-4-6
Auto-connect to IDE (external terminal) true
Claude in Chrome enabled by default true
Enable Remote Control for all sessions false
Dialog expiry never
Messages from your other sessions accept
Core analysis engine
| Capability | Code | |
|---|---|---|
| On-Demand Analysis | 1 | Cached binary context and targeted function analysis; retain symbols, imports, cross-references and analyst names between sessions. |
| Binary Lifting | 1 | Native instructions to pseudo-C using architecture-specific register state and calling conventions; support varies by backend. |
| Semantic Code Search | 1 | Search functions by behavioral descriptions; normalize assembly, embed descriptions and rank semantic similarity. |
| Hypothesis Engine | 1 | Persist competing explanations, collect evidence, rank probes and update confidence. |
| DAG Adapter Language | 1 | Define fixed-width instruction bitfields, round-trip encodings, semantic operations and dataflow edges through EncodingDAG. |
| Entropy Mapper | 1 | Sliding-window Shannon entropy, region classification and transition detection to guide unpacking and analysis. |
Learning and continuity
| Capability | Code | |
|---|---|---|
| The Flywheel | 1 2 | Replay stored confirmed finding descriptions and successful semantic queries against later binaries. |
| Cross-Target Learning | 1 2 | Persist transferable finding descriptions, embeddings and search patterns for reuse across products and vendors. |
| KASAN-Oracle | 1 | Workflow for deriving candidates from instrumented/debug builds and checking corresponding production code; includes instrumentation-aware decoding. |
Vulnerability discovery and validation
| Capability | Code | |
|---|---|---|
| Taint Analysis | 1 2 | Source-to-sink register/dataflow tracking, with architecture-specific intraprocedural, interprocedural and flow-sensitive implementations. |
| Cross-Library Analysis | 1 2 | Resolve imports and exports across a firmware library set and propagate supported argument taint across library boundaries. |
| Pre-Authentication Exposure | 1 | Recover supported Flatui route/auth-wrapper structures, associate handlers and identify pre-authentication handlers with sensitive sinks. |
| Sink Arg Classifier | 1 | Classify command arguments as constant, formatted constant, argument-propagated or unknown before deeper tracing. |
| Finding Validation | 1 2 | Bounded x86-64 symbolic path solving produces entry-register constraints/models; a registry stores findings and submission metadata. It does not establish automatic HTTP reproduction for every find... |
| Compiler Defect Detection | 1 2 | Detect the implemented LoongArch64 min/max miscompilation pattern and run supported security scans on compiler output. |
| Source Code Auditing | 1 2 | Ingest repositories, profile/rank files, map entry points and sinks, trace source paths and support review coverage accounting. |
| Cryptographic Analysis | 1 2 | Key/secret discovery, repeating-XOR recovery, crypto implementation fingerprinting and JWT/SAML/TLS posture checks. |
| Protocol FSM Extractor | 1 | Infer an ARM64 protocol state graph from BSS state accesses and a selected handshake-function cluster; includes MMTLS-oriented assumptions. |
| BMP LSB Key Extractor | 1 | Read BMP pixel least-significant bits and reconstruct keys for the implemented seed/polynomial encoding scheme. |
| Format String Scanner | 1 | Flag supported printf-family, syslog and logging call sites with potentially unsafe format-argument provenance in x86-64 ELF. |
| Heap Vulnerability Scanner | 1 2 | x86-64 allocation-overflow, use-after-free, double-free and off-by-one/pointer-state heuristics; LoongArch64 allocation-arithmetic overflow scanning. |
| SQL Injection Scanner | 1 | Trace formatted query construction into supported MySQL C API and SQLite sinks in native binaries. |
| RPC Server Analyzer | 1 | Recover Windows RPC interface/endpoint indicators and examine supported registration/authentication patterns. |
| IOCTL Attack Surface | 1 | Decode driver IOCTLs and inspect METHOD_NEITHER, buffer-length handling, probe APIs and allocation/copy patterns. |
| Length Underflow Scanner | 1 | Find supported x86-64 parser patterns where subtracting a header size from a narrow length can wrap before allocation or copying. |
| Setuid Auth Oracle | 1 | Identify raw shadow-password validation/import patterns without PAM mediation as authentication-oracle candidates. |
| Lua Injection Analyzer | 1 | Detect Python strings formatted into Lua source before execution through supported Lua interfaces. |
Specialized recovery
| Capability | Code | |
|---|---|---|
| C++ Vtable Reconstruction | 1 | Recover ELF virtual tables, name slots from available evidence and generate annotations for virtual dispatch analysis. |
| PPC32 GOT2 Resolver | 1 | Recover GOT2 bases and resolve supported indirect BCTRL targets in stripped PPC32 big-endian PIC binaries. |
| Dynamic Sandbox | 1 | Probe ARM64 or x86-64 leaf functions in Unicorn, capture return/register state and writes, and compare behavioral signatures. |
| Firmware Extraction | 1 2 | Format/vendor-specific container parsing, supported Fortinet XOR/key recovery and inner-partition decryption, plus selected filesystem extraction. |
| Firmware Key Corpus | 1 2 | Fingerprint recovered Fortinet certificate keys, compare known key families and classify expected keys by firmware build track. |
Platform and runtime support
| Capability | Code | |
|---|---|---|
| Windows PE Security Analysis | 1 2 | PE sweeps and dedicated CFG, SEH, RPC, COM, ETW, symbol and pool-allocation analyses. |
| Windows Kernel Driver & BYOVD | 1 2 | Inspect driver imports, IOCTLs, callbacks, pool operations and dangerous primitives; rank BYOVD-related capability indicators. |
| Android / APK Analysis | 1 2 | Parse APK/AXML/DEX, review manifest exposure and dangerous APIs, inventory native libraries and prioritize findings. |
| HarmonyOS / ArkTS Analysis | 1 2 | Parse extracted Ark ABC bytecode, enumerate classes/methods/strings, disassemble and produce JavaScript-like pseudocode. |
| Go Binary Reverse Engineering | 1 2 | Recover supported pclntab function metadata, analyze stripped Go ELF/Mach-O binaries and inspect garble-obfuscated layouts. |
| Erlang / BEAM Analysis | 1 | Read BEAM module/export/import/atom data, lift supported bytecode, scan risky imports and compare module sets. |
| MicroPython .mpy Lifter | 1 | Parse supported.mpy v6 files, lift bytecode to pseudo-Python and flag dangerous imports/calls and direct memory access. |
| Game & Legacy RE | 1 2 | Label known game-engine code and provide selected PS3/Cell, classic Mac, old Windows/DOS and other legacy-format tools. |
| PS3 SELF Decryptor | 1 | Decrypt supported Signed ELF containers using registered keysets, detect key revision and emit a loadable ELF. |
| MCP Server Security Scanner | 1 | Scan Python/JavaScript/TypeScript MCP source for exposed bindings, missing-authentication patterns and dangerous tool methods. |
| LoongArch64 | 1 2 | Dedicated decoding, CFG/dataflow, lifting, taint, syscall classification and DWARF/CFI/BTF function-boundary recovery. |
| nanoMIPS | 1 2 | Variable-width decoding, function/frame discovery and supported intra/interprocedural taint analysis. |
Automotive ECU analysis
| Capability | Code | |
|---|---|---|
| ECU Architecture Detector | 1 | Rank candidate instruction sets for raw ECU ROMs using reset vectors, signatures and structural heuristics. |
| ROM Layout Analyzer | 1 | Classify raw-ROM regions as code, calibration, interrupt vectors or erased data and identify application-code regions. |
| Calibration Parsers | 1 2 | Parse TunerPro XDF, ASAM A2L, RomRaider XML, open_damos, Conescan and Nissan/Pytrex definitions into calibration tables and labels. |
| CAN DBC Parser | 1 | Parse CAN message/signal definitions, bit layouts, value tables and comments for analysis context. |
| ECU Security Access Scanner | 1 | Fingerprint the implemented static-seed UDS/KWP2000 SecurityAccess patterns in M68K/CPU32 and PPC32 ROMs. |
| TriCore Taint Analysis | 1 | TriCore ECU source-to-sink analysis with supported GHS/IAR ABI and flat-image handling. |
| RH850 Taint Analysis | 1 | RH850 ECU register/argument taint tracking with supported ABI and flat-ROM analysis paths. |
Workflow and quality gates
| Capability | Code | |
|---|---|---|
| Version Diffing | 1 2 | Match corresponding functions, follow identities across releases and localize instruction-category changes. |
| Kernel Module Subsystem Classifier | 1 | Infer a Linux module's subsystem and attack-surface priority from its source-tree/install path. |
| Module Quality Gate | 1 | FORGE audit records, severity-based gates and local-module registration/loading; audit behavior depends on configured analysis. |
| Coverage Gate | 1 2 | Configured 85% statement-coverage threshold for the selected labeled taint-engine modules; not a whole-repository coverage guarantee. |
| YARA Rule Generation | 1 | Generate YARA text from supported findings/strings and supplied technique templates. |
Binary loading, discovery and navigation
| Capability | Code | |
|---|---|---|
| Binary format and platform identification | 1 2 | Detect ELF/PE/Mach-O and inspect file/OS/architecture metadata through the appropriate parser. |
| ELF internals and hardening | 1 2 | Parse ELF32/64 program/section headers, symbols, dependencies, RPATH/RUNPATH and GOT/PLT; inspect NX, PIE, RELRO and canary indicators. |
| PE internals and indicators | 1 2 | Inspect sections, imports, strings, resources and selected malware/anti-debug/IOC patterns. |
| Mach-O internals | 1 2 | Inspect load commands, segments, dylib dependencies and code-signing information. |
| Call and string cross-references | 1 2 | Find callers, callees, referenced strings, functions referencing strings, containing functions, exports and import names. |
| Persistent analysis context | 1 2 | Cache binary metadata and cross-reference structures and reload analyst naming overlays. |
| Native-library inventory | 1 2 | Rank a directory of ELF libraries by architecture, functions, exports, JNI presence and security-relevant strings. |
| Stripped function discovery | 1 2 | Recover candidate entries from architecture-specific prologues, calls, reset vectors and available metadata. |
| Flat-ROM function discovery | 1 2 | Harvest call targets and prologues without ELF headers, using the supported ECU decoder/layout paths. |
| i386 absolute cross-references | 1 2 | Find x86-32 string/data references encoded as absolute immediates. |
| Debug metadata recovery | 1 2 | Recover LoongArch function boundaries from.eh_frame, DWARF and BTF where available. |
| Swift symbol demangling | 1 2 | Best-effort Swift symbol decoding with an optional swift-demangle fallback. |
Disassembly, graphs and symbolic analysis
| Capability | Code | |
|---|---|---|
| Streaming and windowed disassembly | 1 2 | Produce instruction streams or annotated address windows with calls, strings and function boundaries. |
| Single-function profiling | 1 2 | Combine callee names, strings, argument values and sink flags in one function report. |
| Optional angr-backed analysis | 1 2 | Extended disassembly engine supports caller/xref resolution and register/block dataflow via angr. |
| Control-flow graph construction | 1 2 | Architecture-specific block/edge construction, branch targets, return handling and selected delay-slot semantics. |
| Generic dataflow worklist | 1 2 | Monotone-framework propagation with supported lattice/state joins across a CFG. |
| Constant propagation and reaching definitions | 1 2 | Track definitions/constants and perform sparse conditional constant propagation. |
| Dominators and loop analysis | 1 2 | Build dominator/post-dominator information and identify natural loops. |
| Structured control-flow recovery | 1 2 | Render supported CFG regions as sequences, conditions, loops, breaks, continues and returns. |
| Call-argument annotation | 1 2 | Forward symbolic register propagation for supported x86-64/ARM32 call sites. |
| Interprocedural argument provenance | 1 2 | Seed callees with caller values and follow supported argument chains across functions. |
| Lightweight ARM32 symbolic execution | 1 2 | Track argument/buffer relationships and protocol field writes without an SMT solver. |
| ARM64 symbolic slicing | 1 2 | Backward/forward structured-expression slicing for memory addresses and stores. |
| Global-symbol and BSS tracking | 1 2 | Resolve named global/GOT relationships and find state, buffer or decrypt-loop accesses. |
| Call-site backward slicing | 1 2 | Recover x0-x7 symbolic values at selected ARM64 calls. |
| Interprocedural field-writer discovery | 1 2 | Locate functions writing a selected field when its structure pointer crosses call boundaries. |
Instruction, ABI and labeled-taint APIs
| Capability | Code | |
|---|---|---|
| Instruction-stream import and normalization | 1 2 | Convert supported Capstone, objdump or hand-written listings into common per-ISA instruction/operand objects; normalize aliases and x86 syntax. |
| Calling-convention and syscall models | 1 2 | Encode supported register aliases, argument/return registers, caller/callee saves and syscall conventions separately from decoders. |
| Named taint sources and bounds | 1 2 | Preserve source labels and supported bounds on attacker-controlled contributions rather than a single boolean taint flag. |
| Frame, pointer and memory-range state | 1 2 | Track supported frame slots, spilled pointers, constants, memory ranges and register aliases across instruction streams. |
| Configurable taint reporting | 1 2 | Policies control supported branch, memory-address, return-address, syscall-argument and bounded-index findings. |
| CFG fixpoint dataflow | 1 2 | Iterate supported per-architecture state joins across blocks and loops; separate from the binary-path scanners' linear/BFS modes. |
| Instrumentation-noise removal | 1 2 | Tag/filter supported LoongArch KASAN/KCOV call and shadow-address idioms using instrumentation symbols or addresses. |
| LoongArch syscall labeling | 1 2 | Classify supported Linux syscall numbers, labels and security-relevant categories. |
Semantic matching and retained knowledge
| Capability | Code | |
|---|---|---|
| Single/multi-binary corpus building | 1 2 | Populate a function-identity database with descriptions, product/version metadata and inferred records. |
| Function identity database | 1 2 | Store function names, roles, signatures, structures and call chains across binary versions. |
| Analyst naming registry | 1 2 | Persist, bulk-update and reload confirmed function names per binary. |
| Signature-based auto-naming | 1 2 | Match unknown functions against behavioral signatures with thresholds and dry-run support. |
| SAX approximate indexing | 1 2 | Index opcode-category sequences for fast structural candidate lookup. |
| Behavioral subsequence search | 1 2 | Find exact or approximate opcode-category subpatterns within functions. |
| Structural similarity and orphan detection | 1 2 | Compare opcode histograms, constants, calls and other structural signals to identify unmatched functions. |
| Embedding fine-tuning | 1 2 | Generate structural homolog pairs, fine-tune similarity models and evaluate homolog/non-homolog separation. |
| Finding-corpus mining | 1 2 | Extract confirmed local findings, summarize CWE frequency and identify repeated cross-target patterns or scanner gaps. |
| CVE byte-signature checks | 1 2 | Match implemented architecture-specific vulnerable-byte signatures for selected patch-verification tasks. |
| Version-aware scan caching | 1 2 | Invalidate persisted scanner results when either target bytes or scanner source changes. |
| Vendor sink profiles | 1 2 | Load vendor-specific sinks and known-safe command patterns from profiles. |
Additional vulnerability scanners and triage
| Capability | Code | |
|---|---|---|
| Architecture-specific sink provenance | 1 2 | Separate classifiers for ARM32, MIPS32, PPC32, i386 and PPC64 big-endian calling conventions. |
| Transitive sink-wrapper discovery | 1 2 | Find supported wrappers around dangerous x86-64 string/exec sinks. |
| Sanitizer recognition | 1 2 | Identify allowlist-style validators and assess coverage of shell metacharacters. |
| Sanitizer-gated sink filtering | 1 2 | Reclassify supported argument-propagated sites whose paths include recognized validation. |
| File-versus-socket input discrimination | 1 2 | Classify ARM64 fgets sources using FILE-pointer provenance to reduce configuration-file false positives. |
| scanf-family overflow candidates | 1 2 | Identify unbounded string conversion specifications at supported formatted-input call sites. |
| Deprecated unsafe-function scanning | 1 2 | Flag imported inherently unsafe functions such as gets/mktemp/tmpnam/getwd as review candidates. |
| ARM32 allocation arithmetic overflow | 1 2 | Trace supported multiply operations with input-derived operands into allocation sizes. |
| PPC32 heap-slot overflow | 1 2 | Detect fixed-slot allocation followed by supported unbounded string-copy patterns. |
| TLV/chunk alignment checks | 1 2 | Identify supported parser pointer advances that omit expected alignment rounding. |
| Shared-epilogue detection | 1 2 | Detect tail blocks shared through jumps so analysis can account for compiler-merged epilogues. |
| Fork/exec classification | 1 2 | Distinguish worker-child, exec-after-fork and exit-in-child patterns in supported x86-64 functions. |
| Apache module analysis | 1 2 | Inspect supported APR/Apache binary module hooks and security-relevant authentication/session patterns. |
| CMDB-to-sink mapping | 1 2 | Associate supported Fortinet database-table accesses with functions that also invoke execution sinks. |
| HTTP method-enum recovery | 1 2 | Infer supported Flatui route method identifiers from route-registration evidence. |
| Firmware-flasher trust checks | 1 2 | Flag PE firmware-update capability lacking recognized signature-verification imports as a review candidate. |
| VxWorks static-archive scanning | 1 2 | Inspect PPC32 archive members for unbounded copies within selected stack-frame sizes. |
| Post-link compiler security gate | 1 2 | Run supported binary scanners against newly compiled artifacts and aggregate findings. |
C++ and architecture-specific recovery
| Capability | Code | |
|---|---|---|
| ARM64 virtual-call resolution | 1 2 | Infer vtables, constructor vptr writes and supported BLR targets. |
| x86-64 relocation-based vtables | 1 2 | Reconstruct virtual table slots from ELF RELA entries. |
| Live virtual-dispatch slots | 1 2 | Find x86-64 indirect-call slot uses and distinguish referenced slots from unobserved ones. |
| PS3 OPD virtual tables | 1 2 | Recover PPC64 Cell PPU virtual tables through function descriptors. |
| Verified PPC32 import callers | 1 2 | Trace PLT thunk calls while checking the caller's active GOT2 base. |
| PPC64 ELFv1 resolution | 1 2 | Resolve OPD function descriptors, TOC-related metadata and glink import stubs. |
| Unnamed ARM64 library-call classification | 1 2 | Classify PLT entries using argument/return behavior and a library-function summary database. |
| Classic Mac ABI clobber scanning | 1 2 | Detect supported PPC32 PEF argument-register clobbers across intervening calls. |
| Data-structure pattern classification | 1 2 | Identify supported PPC64/Cell list/tree/traversal patterns from structural signals. |
| VMX/AltiVec density ranking | 1 2 | Locate vector-heavy PPC64 functions as candidates for math, physics or rendering code. |
| PPC32/PPC476 dedicated lifting | 1 2 | Additional pseudo-code/decompiler entry points for PowerPC and IBM Book E binaries. |
Firmware, containers and legacy formats
| Capability | Code | |
|---|---|---|
| Firmware signature and secret triage | 1 2 | Locate embedded format signatures, security-relevant strings, version indicators and entropy changes. |
| Partition-table extraction | 1 2 | Enumerate and extract supported fixed-record firmware container partitions. |
| Hardware-root discovery | 1 2 | Identify MMIO load/store references to known peripheral address ranges. |
| AMI modified CramFS | 1 2 | Extract supported BMC filesystems with AMI-specific extended inode layouts. |
| Huawei modified SquashFS | 1 2 | Extract supported vendor SquashFS/XZ layouts, including handling of ARM64 BCJ-filtered blocks. |
| Apple bv41 decompression | 1 2 | Probe, iterate and stream-decode Apple's proprietary chunked LZ4 framing. |
| FortiMail VM key extraction | 1 2 | Extract supported key files from OVF/VMDK firmware layouts and their filesystem partitions. |
| Fortinet build-track classification | 1 2 | Parse product/version/build-track names and predict the known certificate-key family. |
| AIX plain BFF extraction | 1 2 | Parse backup-by-name archives and extract contained files/directories. |
| Compressed BFF detection and LZW attempt | 1 2 | Identify compression variants and attempt supported LZW decompression through uncompress; Huffman variants report that AIX tooling is required. |
| AIX big archive extraction | 1 2 | Extract members from the AIX library/archive format. |
| AIX XCOFF32/64 analysis | 1 2 | Parse executable sections and loader symbols; enumerate imports/exports and candidate function entries. |
| Standalone XCOFF symbol resolution | 1 2 | Recover library imports and exported code addresses without a full BinaryContext session. |
| IBM W-Code parsing | 1 2 | Parse supported XLC intermediate records and builtin-catalog references. |
| Motorola 88000 BCS COFF | 1 2 | Parse legacy executable sections and feed the dedicated M88K decoder/context path. |
| Tandem Guardian PAK | 1 2 | Decompress supported Guardian BACKUP records and extract NonStop files. |
| AppleDouble resource forks | 1 2 | Parse classic Mac resource-fork and metadata containers. |
| PowerPC PEF/CFM | 1 2 | Parse classic Mac code/data sections, imports and supported container metadata. |
| Installer payload analysis | 1 2 | Extract supported BitRock LZMA payloads, carve PE candidates and optionally unpack UPX; recognize NSIS/Inno signatures. |
| Windows 16-bit NE | 1 2 | Parse segmented New Executable binaries and sweep supported imports/calls/security patterns. |
| Windows LE/VxD | 1 2 | P 10BC8 arse Linear Executable drivers, inspect device-descriptor data and sweep supported ring-0 code patterns. |
| MS-DOS MZ | 1 2 | Parse real-mode headers/relocations and analyze supported multi-segment 16-bit code. |
Language and application runtimes
| Capability | Code | |
|---|---|---|
| DEX disassembly and lifting | 1 2 | Decode instructions to annotated smali and supported pseudo-Java. |
| Android Binder surface | 1 2 | Correlate exported services and DEX classes to identify Binder IPC exposure. |
| JNI bridge reconstruction | 1 2 | Associate native declarations, loadLibrary uses, peer-pointer fields and native exports. |
| Specialized JNI protocol analysis | 1 2 | Scripts for deeper vtable, field-write and protocol analysis, including libhijoyptt-specific assumptions. |
| Go string recovery | 1 2 | Resolve length-delimited strings under the supported AMD64 Go register ABI. |
| Go subprocess surface | 1 2 | Find os/exec call sites and recover static command-path arguments where possible. |
| Go dangerous-call graph | 1 2 | Build/cache caller maps, filter application namespaces and resolve supported interface tables. |
| Stripped Go x86-64 boundaries | 1 2 | Recover function entries from pclntab when conventional symbols/debug info are absent. |
| Java class/JAR parsing | 1 2 | Read constant pools, methods, fields, descriptors, manifests and archives. |
| Java security pattern scans | 1 2 | Flag supported reflection, serialization, class-loading, Runtime.exec, SSRF, XXE, JNDI, weak randomness and hardcoded-secret patterns. |
| JVM/Spring exposure inspection | 1 2 | Inspect JVM flags/debug endpoints, agents and supported Spring Actuator/application-context surfaces. |
| Python .pyc scanning | 1 2 | Inspect supported code objects for dangerous bytecode/name/constant patterns without source files. |
| Perl shell-injection scanning | 1 2 | Trace supported Perl input sources into system/exec/qx/backtick-style sinks. |
| Electron application auditing | 1 2 | Scan extracted JavaScript for unsafe Electron settings, IPC and execution patterns. |
| Browser-extension auditing | 1 2 | Inspect extension manifests, permissions, external messaging and privileged JavaScript patterns. |
Source repository auditing
| Capability | Code | |
|---|---|---|
| Repository ingestion and search | 1 2 | Build a local/remote source index, categorize languages and retrieve matching text/context. |
| Route authentication classification | 1 2 | Map supported source HTTP routes to authentication-wrapper levels. |
| Source dangerous-sink detection | 1 2 | Scan supported eval, subprocess, SSRF, path traversal and internal-endpoint patterns. |
| Tenant-isolation checks | 1 2 | Identify supported database accesses without expected user/project/organization scoping. |
| Architectural-risk detection | 1 2 | Flag unsafe rendering combined with extensible dispatch or shared context that may increase future exposure. |
Automotive and embedded details
| Capability | Code | |
|---|---|---|
| C166/C167 decoding | 1 2 | Decode supported instructions, find functions, inspect XRAM accesses and parse interrupt vectors. |
| TI C28x decoding | 1 2 | Decode supported DSP instructions and recover candidate function starts. |
| M68K/CPU32 decoding | 1 2 | Decode supported ECU instructions and discover function entries. |
| Renesas SH-2A decoding | 1 2 | Handle supported instruction widths, calls, functions and delay-slot-aware CFG/lifting. |
| PowerPC VLE decoding | 1 2 | Handle supported mixed 16/32-bit e200 ECU instructions and function discovery. |
| HiSilicon RISC-V extensions | 1 2 | Decode supported proprietary riscv31 opcodes, widths and multi-register memory operations. |
| 8051 ISA modeling | 1 2 | Model MCS-51 registers, separate memory spaces, instruction semantics and selected security-analysis facts. |
| TI COFF/archive loading | 1 2 | Parse supported TI COFF2 objects and archive symbols/sections. |
| TI neural-network artifacts | 1 2 | Identify supported TVM/NNC-generated symbols and inspect inference-artifact metadata/patterns. |
| TI SDK package sweeping | 1 2 | Dispatch supported COFF, ARM, ARM64 and flat-ROM artifacts across package directories/archives. |
| Calibration table interpretation | 1 2 | Represent axes, scaling and table metadata; read supported calibration values and produce address labels. |
| Calibration variant/relocation support | 1 2 | Resolve supported inherited definition variants, identify ROMs and locate fingerprint-relocated open_damos tables. |
Windows security details
| Capability | Code | |
|---|---|---|
| Control Flow Guard review | 1 2 | Inspect CFG metadata and supported exported-target/bypass opportunity patterns. |
| SEH and SafeSEH review | 1 2 | Inspect x86 handler registration/chains, protections and suspicious handler patterns. |
| COM attack-surface mapping | 1 2 | Find supported COM registrations and privilege-boundary/hijacking indicators. |
| ETW provider extraction | 1 2 | Recover provider/event indicators and assess supported telemetry patterns. |
| Kernel pool flow checks | 1 2 | Track supported pool allocations toward copies/writes using bounded instruction-window heuristics. |
| PDB integration | 1 2 | Read PE debug references, fetch/load supported PDB information and inject recovered names into context. |
Cryptography and authentication details
| Capability | Code | |
|---|---|---|
| Repeating-XOR key recovery | 1 2 | Use known plaintext, key-length scoring and frequency/transposition methods. |
| Affine mapping analysis | 1 2 | Inspect supported affine byte mappings as a helper for encoded data recovery. |
| Hash/AES implementation recognition | 1 2 | Detect hash constants and supported custom ARM32/Thumb AES-CBC patterns. |
| JWT analysis and weak-secret testing | 1 2 | Decode tokens, inspect algorithms and test candidate weak signing secrets; token-construction helpers are present. |
| SAML and key-material review | 1 2 | Inspect assertion structure/wrapping indicators and search for embedded key material. |
| RSA/ECDSA and randomness checks | 1 2 | Helpers inspect RSA/prime properties, ECDSA nonce reuse, RNG/hash/key-management weaknesses and selected timing/nonce risks. |
| Crypto/C2 encoding indicators | 1 2 | Recognize selected XOR, RC4, Base64, Salsa/ChaCha, AES and arithmetic-encoding patterns. |
TLS and web/API analysis
| Capability | Code | |
|---|---|---|
| TLS certificate and protocol probing | 1 2 | Inspect certificates, key strength, legacy versions/ciphers, DH-related properties and handshake behavior. |
| TLS policy checks | 1 2 | Probe HSTS, redirects, mTLS, pinning-related headers, SCT/CT indicators and ACME-related exposure. |
| TLS session/downgrade surfaces | 1 2 | Probe supported resumption, downgrade, inspection/proxy and zero-trust gateway configurations. |
| Unknown HTTP API mapping | 1 | Discover paths/versions/methods, harvest OpenAPI and infer parameter/schema/error/state behavior. |
| API authorization checks | 1 | Probe supported object/function-level authorization, mass assignment and excessive-data exposure cases. |
| API injection and validation checks | 1 | Probe supported parameter pollution, content-type switching, SSRF, NoSQL, host-header and other input-handling surfaces. |
| API authentication and token checks | 1 | Inspect JWT/OAuth flows, state/PKCE, default credentials, rate limiting and timing behavior. |
| Additional API protocols | 1 | Discovery/probes for GraphQL, gRPC reflection, SOAP/WSDL, JSON-RPC and WebSocket interfaces. |
| Business-logic and version exposure | 1 | Probe state changes, pagination, hidden parameters, shadow versions and webhook behaviors. |
| Nginx fingerprinting and exposure | 1 | Inspect server/version disclosure, status/debug endpoints, autoindex and sensitive paths. |
| Nginx configuration probes | 1 | Check supported alias traversal, proxy SSRF, host-header, smuggling, authentication, ingress and rate-limit surfaces. |
| Version-linked web checks | 1 | Identify selected historical nginx CVE indicators; matches still require target-specific verification. |
Host, process and privilege enumeration
| Capability | Code | |
|---|---|---|
| Host platform inventory | 1 2 | Detect OS, architecture, kernel/libc and selected security/capability settings. |
| Process and memory-map inventory | 1 2 | Enumerate processes, loaded modules, executable/RWX regions, open files and environment data. |
| System-call tracing | 1 2 | Invoke supported strace/ptrace-based tracing and summarize file, network and process operations. |
| Injection and persistence indicators | 1 2 | Inspect supported process-hollowing, preload/library-hijack, ptrace, cron, services and named-pipe patterns. |
| Linux privilege-escalation triage | 1 2 | Enumerate SUID, sudo, capabilities, writable paths/cron, credential-file exposure, Docker access and kernel/namespace conditions. |
| Windows live enumeration | 1 2 | Inspect COM registration differences, RPC endpoints, ETW sessions, pipes, policies, services, autoruns, privileges and loaded modules. |
| Windows escalation indicators | 1 2 | Check supported unquoted-service, installer-policy, token, scheduled-task and UAC/driver indicators. |
Forensics and malware triage
| Capability | Code | |
|---|---|---|
| Windows artifact discovery | 1 2 | Locate MFT/LNK/Prefetch/EVTX-related artifacts and markers; this is not full decoding of those formats. |
| Volatile and Linux artifact triage | 1 2 | Inspect process/procfs/memory-access indicators, histories, deleted executables and selected volatile evidence. |
| Timestamp/log anomaly checks | 1 2 | Identify selected timestomping, empty/deleted log and related metadata indicators. |
| Rootkit/bootkit indicators | 1 2 | Match supported SSDT/callback/hiding, DPC/timer, raw-disk and boot-sector patterns. |
| Malware behavior indicators | 1 2 | Inspect keylogger, clipboard, mutex, downloader/backdoor, fileless and reflective-loading API/string combinations. |
| Packing and anti-analysis indicators | 1 2 | Detect selected packed-section, PEB/debugger, opaque/junk-code, anti-disassembly and sandbox-environment patterns. |
| Office/PDF triage | 1 2 | Scan raw document markers for macro and exploit indicators without full document interpretation. |
| ELF recovery from physical-memory dumps | 1 2 | Find supported ELF64 images and reconstruct candidates using contiguous mappings and proximity heuristics. |
| Video-container forensics | 1 2 | Parse MP4/MOV, MKV/WebM and AVI structures for appended payloads, suspicious metadata, malformed sizes and encrypted-track markers. |
| IOC candidate extraction | 1 2 | Extract supported URL/address/path/key/certificate and other suspicious-string candidates. |
| ATT&CK labeling | 1 | Map recognized finding categories to configured ATT&CK technique labels. |
Network discovery and traffic inspection
| Capability | Code | |
|---|---|---|
| Local network inventory | 1 2 | Enumerate interfaces, connections, listening ports and firewall rules. |
| Raw packet capture | 1 2 | Capture supported traffic and parse selected IPv4/TCP/UDP headers. |
| PCAP inspection | 1 2 | Packet-level DNS queries, HTTP metadata and selected cleartext credential extraction. |
| Host/service discovery | 1 2 | ICMP/TCP discovery, banners, mDNS, SSDP, ARP observations and basic TTL/application fingerprinting. |
| Web-path enumeration | 1 2 | Discover directories, listings and other supported web paths. |
| Industrial/IoT probes | 1 2 | Exposure checks for supported Modbus, MQTT, CoAP, SNMP, NTP and NetFlow/IPFIX services. |
| Additional industrial/debug probes | 1 2 | Probe BACnet, EtherNet/IP and supported debugger interfaces. |
| Internal-network reconnaissance | 1 2 | Parse ARP/routes, discover subnets/names and inspect remote-management/database surfaces. |
| Credential/token/key discovery | 1 2 | Enumerate accessible configuration credentials, API tokens, SSH keys and cloud-metadata surfaces. |
| Remote-management and identity probes | 1 2 | Supported SMB/NTLM, RPC, WinRM, RDP, WMI, SSH and Active Directory-related surface checks. |
| Credential-testing helpers | 1 2 | Explicit SSH/FTP credential-spray and related authentication-testing helpers exist as callable functions. |
| C2/exfiltration indicators | 1 2 | Inspect supported beaconing, DNS/HTTP/IRC/ICMP/covert-channel, tunneling, cloud-storage and ransomware-precursor patterns. |
| IOS/IOS-XE appliance enumeration | 1 2 | HTTP/API, SNMP, CDP/LLDP, Telnet/TFTP, configuration parsing and supported AAA/network/security-management checks. |
| Appliance configuration secret helpers | 1 2 | Type-7 decoding and selected SNMP-community/enable-secret credential-testing helpers. |
| SD-WAN/Meraki management probes | 1 2 | Management-API exposure probes for supported SD-WAN and cloud-managed network products. |
Containers, cloud infrastructure and services
| Capability | Code | |
|---|---|---|
| Docker inventory and posture | 1 2 | Enumerate containers, images, volumes, networks, mounts, capabilities, privileged modes, sockets, ports and environment secrets. |
| Container isolation/escape surface | 1 2 | Inspect supported host mounts, namespace/capability, resource and image-layer risks. |
| Kubernetes inventory | 1 2 | Enumerate pods, services, namespaces, secrets and ConfigMaps through kubectl or supported direct API calls. |
| Kubernetes identity and RBAC | 1 2 | Inspect service-account bundles, SelfSubjectAccessReview permissions and cluster-admin/role bindings. |
| Kubernetes policy/posture | 1 2 | Review network policies, admission/webhooks, pod security, hostPath/projected storage, ingress, mesh mTLS and resource settings. |
| Cluster management exposure | 1 2 | Probe supported etcd, kubelet, dashboards, node services, cloud metadata and Orka endpoints. |
| Messaging/streaming enumeration | 1 2 | Inspect supported Kafka, Flink, NiFi, schema registries, RabbitMQ, NATS, Pulsar and event-store/registry surfaces. |
| Streaming operational helpers | 1 2 | Kafka topic/sample consumption and Flink JAR-submission helpers are present, alongside enumeration. |
| Database/storage exposure | 1 2 | Probe supported Redis, Elasticsearch, MinIO, InfluxDB and database endpoints. |
| Observability exposure | 1 2 | Probe Prometheus, Grafana, Jaeger, Loki, OpenTelemetry, Alertmanager, Thanos and related collectors. |
| Orchestration/management exposure | 1 2 | Probe supported vCenter, Rancher, Consul, Linkerd, Kong, Traefik, Temporal, Argo, Nomad and AWX/NSO surfaces. |
| CI/CD and artifact services | 1 2 | Probe supported Jenkins, GitLab, Tekton, Argo CD, Flux, Crossplane, SonarQube, Artifactory and Nexus endpoints. |
| Secrets/access infrastructure | 1 2 | Probe supported Vault and Boundary management exposure. |
| DNS service posture | 1 2 | Probe zone transfer, recursion, dynamic-update and DoT/DoH-related surfaces. |
| NX-OS/ACI/APIC fabric enumeration | 1 2 | NX-API, fabric nodes/endpoints, tenants/contracts, L3Out, VMM, audit/config data and selected management probes. |
| VXLAN/DCNM exposure | 1 2 | Inspect supported VTEP and management exposure and retrieve firmware/license/version details. |
| HyperFlex/UCS/Intersight | 1 2 | Inspect Connect APIs, cluster/storage interfaces, iSCSI-related exposure and selected management endpoints. |
| Nexus Dashboard | 1 2 | Enumerate supported dashboard, NDI/NDFC/NDO, telemetry and provisioning surfaces. |
VoIP and real-time communications
| Capability | Code | |
|---|---|---|
| SIP service and extension discovery | 1 | Probe OPTIONS/REGISTER behavior, enumerate extensions and examine supported authentication/registration patterns. |
| Media and signaling posture | 1 | Parse SDP, inspect RTP/SRTP expectations, AMI, WebRTC and selected media/interception indicators. |
| Legacy voice protocols | 1 | Probe supported H.323, SCCP/Skinny, MGCP and media-gateway surfaces. |
| Voice abuse indicators | 1 | Heuristics/probes for signaling manipulation, DTMF exposure, covert channels, flooding and denial-of-service susceptibility. |
AI, agent and MCP security
| Capability | Code | |
|---|---|---|
| Inference endpoint enumeration | 1 | Probe supported Ollama, LM Studio, LocalAI, Hugging Face and OpenAI-compatible services. |
| LLM behavior/security probes | 1 | Test supported prompt-disclosure/injection, unsafe-output, excessive-agency and sensitive-information surfaces. |
| Model/data pipeline exposure | 1 | Inspect model metadata, upload/fine-tune endpoints, RAG/vector-store/knowledge-graph and memory-poisoning surfaces. |
| Agent protocol exposure | 1 | Probe supported MCP/A2A authentication, tool-schema, trust-boundary and orchestration interfaces. |
| AI control indicators | 1 | Gather selected OWASP LLM, ATLAS and incident-response/posture indicators through implemented probes. |
| MCP manifest grammar fuzzing | 1 | Atheris harness and seed validation for tool names, descriptions and schemas with prompt-injection indicators. |
Research and payload-development helpers
| Capability | Code | |
|---|---|---|
| Shellcode templates | 1 2 | Supplied x86/x86-64/ARM64 shell and staged-loader construction helpers. |
| Payload formatting | 1 2 | Bad-byte checks, XOR/ADD encoding, NOP generation and buffer assembly helpers. |
| Crash-offset and ROP helpers | 1 2 | Cyclic patterns/offset lookup, common gadget detection and a minimal x86-64 chain-construction helper. |
| Exploitability-context checks | 1 2 | Helpers inspect canary, NX/ASLR and selected format-string indicators. |
| BARE integration | 1 2 | Convert supported findings for the external BARE tool to rank related Metasploit modules. |
Assistant integration and workflow machinery
| Capability | Code | |
|---|---|---|
| LLM analyst loop | 1 2 | Optional Claude tool-calling analysis loop with bounded iterations and stored results. |
| Prior-finding retrieval | 1 2 | Supply related function identities/findings as context for subsequent analysis. |
| Assisted function naming | 1 2 | Propose and batch-process names from strings, callees and prior evidence. |
| Assisted structure reconstruction | 1 2 | Extract memory-access offsets/widths and propose structure layouts. |
| Assisted vulnerability hypotheses | 1 2 | Generate candidate explanations of suspicious function behavior for later validation. |
| Evidence scoring and probe ranking | 1 2 | Weight evidence families, track contradictions/uncertainty and rank useful next analyses. |
| Analyzer probe adapters | 1 2 | Dispatch supported disassembly, CFG, xref, lifting, semantic, version, taint and manual evidence probes. |
| Stage commitments and audit trail | 1 2 | Hash stage artifacts, record approval states and verify persisted commitments. |
| Structured workflow documents | 1 2 | Validate stage outputs, advance through configured transitions and serialize/reload sessions. |
Outputs, integration and project tooling
| Capability | Code | |
|---|---|---|
| JSON and SARIF export | 1 2 | Export supported sweep/finding records to structured JSON or SARIF 2.1.0. |
| Markdown research reports | 1 2 | Render ranked sweep results, prior-finding correlations and verification notes. |
| Binary Ninja plugin | 1 2 | Apply corpus names, launch semantic search/sweeps and show stored findings inside Binary Ninja. |
| Terminal presentation | 1 2 | Colored/plain output, boxes and structured terminal reports. |
| Documentation prose checks | 1 2 | Lint documentation against configured writing-style patterns. |
| Generic vulnerability-profile sweeps | 1 2 | Encode discovered functions and rank candidates against configured vulnerability profiles plus prior findings. |
| Fortinet multi-phase 8 directo DE2D ry sweeps | 1 2 | Prefilter ELF files by relevant imports and run the supported semantic, sink and follow-on analysis stages. |
| Bundled finding/signature seeds | 1 2 | Ship initial finding and function-signature data to populate or bootstrap local analysis libraries. |
| Dependency and supply-chain tooling | 1 2 | Scripts for dependency auditing, hash-pinned requirements, SBOM generation and monitoring. |
| CI and release automation | 1 2 | Repository workflows for configured checks, coverage and package publishing. |
30 Decompilers
Native CPUs
| ISA | Variants |
|---|---|
| x86 | x86-32 · x86-64 |
| ARM | ARM-32 · ARM-64 · Thumb |
| MIPS | MIPS-32 · nanoMIPS · MIPS-64 |
| PowerPC | PPC-32 · PPC-64 · VLE · PPC476 Book E |
| RISC-V | RV32 · RV64 · HiSilicon ext |
| ARC | ARC EM/HS |
| LoongArch | LoongArch64 |
| Intel MCS | 8051 |
Automotive ECUs
| ISA | Variants |
|---|---|
| V850 / RH850 | V850-32 · RH850 |
| Renesas SH | SH-2A |
| Motorola | M68K / CPU32 · MC88100 |
| Infineon | TriCore TC1.6x |
| TI DSP | TMS320C28x |
VMs & Runtimes
| ISA | Variants |
|---|---|
| DEX | Dalvik · ART |
| ARK | ArkTS |
| MicroPython | .mpy v6 |
Real-World Results
Ablation has been used to analyze production firmware and kernel drivers from Cisco, Fortinet, TencentOS, Huawei, and more.
Following coordinated disclosure, the Cisco Product Security Incident Response Team (PSIRT) adopted Ablation for internal vulnerability triage and continues to use it to evaluate ongoing disclosure reports. Cisco Adaptive Security Appliance (ASA) LINA is among the artifacts analyzed, with findings submitted through CERT/CC VINCE.
| CVE | Product | Title | CVSS |
|---|---|---|---|
| CVE‑2026‑76420 | Secure Firewall Management Center (FMC) | Peer Impersonation | 9.0 Critical |
| CVE‑2026‑76412 | Secure Firewall Management Center (FMC) | Privilege Escalation to root | 8.5 High |
| CVE‑2026‑76413 | Secure Firewall Management Center (FMC) | Single Sign-On Token Forgery | 8.5 High |
| CVE‑2026‑76447 | Identity Services Engine (ISE) | OCSP Responder Authentication Bypass | 5.3 Medium |
Acknowledgments
The code couldn't exist without their ideas. Though no code was written by these authors, doctors, and engineers their work has direct influence on the production of code that makes Ablation what it is.
Research Papers
Books supplied by www.oreilly.com | github.com/oreillymedia
| Title | Authors |
|---|---|
| The Art of Software Security Assessment | Mark Dowd, John McDonald, Justin Schuh |
| Practical Binary Analysis | Dennis Andriesse |
| Practical Malware Analysis | Michael Sikorski, Andrew Honig |
| Practical Reverse Engineering | Bruce Dang, Alexandre Gazet, Elias Bachaalany |
| Hacking: The Art of Exploitation (2e) | Jon Erickson |
| Learning Linux Binary Analysis | Ryan O'Neill |
| Windows Internals Part 1 & 2 | Pavel Yosifovich, Mark Russinovich, David Solomon, Alex Ionescu, Andrea Allievi |
| Rootkits: Subverting the Windows Kernel | Greg Hoglund, Jamie Butler |
| Advanced Compiler Design and Implementation | Steven Muchnick |
| Engineering a Compiler | Keith Cooper, Linda Torczon |
| Practical IoT Hacking | Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Woods |
| Inside the Android OS: Building, Customizing, Managing and Operating Android System Services | G. Blake Meike |
| Malware Analysis and Detection Engineering | Abhijit Mohanta, Anoop Saldanha |
| Evasive Malware | Kyle Cucci |
| Hacking Cryptography | Kamran Khan, Bill Cox |
| Real-World Cryptography | David Wong |
Honorable Mention
Microsoft Excel (Data Analysis ToolPak) When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.
Responsible Use
Ablation is built for authorized security research. Use it only against systems you own or have explicit written permission to test. Running it against systems without authorization violates computer fraud laws in most jurisdictions. The author is not responsible for misuse.
Standards
This defines how software should be built, organized around four practice areas: preparing the development environment, protecting the codebase from unauthorized changes, writing software with security built into every layer, and responding when vulnerabilities surface after release.
What this means for Ablation in practice is a mandatory ten-section security audit on every module before it touches the repository.
The audit covers input validation, memory handling, integer safety, error handling, concurrency, dependency security, injection prevention, secrets handling, logging, and residual risks.
No module is committed without passing it.
Taint trackers, which are the modules that matter most if they get something wrong, carry an additional requirement: 85% statement coverage enforced by a hard gate in the test suite, verified against byte-exact synthetic instruction sequences that test ABI register behavior, not just whether the code runs without crashing.
Dependencies are pinned with exact hashes and scanned weekly for known CVEs.
CISA asks software manufacturers to commit to three things: take ownership of the security outcomes of the people who rely on the software, be transparent about its limitations, and treat security as a requirement rather than a recommendation.
For a RE framework, taking ownership of security outcomes has a specific meaning.
A taint tracker that misses a vulnerability does not just produce a wrong answer.
It produces a result someone may act on as evidence the binary is clean.
That is why a false negative in any Ablation taint tracker is classified as a CRITICAL defect.
Every tracker ships with a documented known-anomalies file describing the exact conditions under which it can produce false negatives, so a researcher knows when to apply manual verification on top of the automated result.
The precommit gate is not advisory. No code enters the repository without passing it.
The US Department of Defense handbook for reverse engineering methodology.
It defines four phases:
Phase 1. Every engagement starts with a session file recording the target description, artifact hash, tool selection, and documentation plan before any analysis runs. The rule that semantic search runs before manual disassembly maps to the following phase.
Phase 2 Requires characterizing a binary at the function level before doing detailed trace work. The DynamicSandbox covers the following.
Phase 3. The structured retrospective written at the close of every completed project maps to the final phase.
Phase 4. The standards document tracks 29 specific requirements drawn from all three frameworks. All 29 are met.
Contact
Feel free to contact me if you have any questions, ideas, complaints or bugs.