RE:AI - AI-Powered Reverse Engineering Tool

A modern reverse engineering platform built from scratch with AI-powered natural language queries.

Features

• Multi-format support: ELF, PE, Mach-O
• Multi-architecture: x86, x86_64, ARM32, ARM64, MIPS
• Natural language queries: Ask questions in plain English
• Pattern detection: Crypto, network, anti-debug, anti-VM
• Function detection: Symbol-based and heuristic detection
• AI Integration: Ollama/LLM integration for intelligent analysis
• Two interfaces: CLI and GUI

Screenshots

GUI Overview

AI Analysis Tab

Installation

Prerequisites

# Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env

# Install Ollama (for AI features)
curl -fsSL https://ollama.com/install.sh | sh
ollama pull mistral

Build from Source

git clone https://github.com/iotwizz/re-ai.git
cd re-ai
cargo build --release

Usage

GUI (Recommended)

./target/release/re-ai-gui

GUI Features:

• 📊 Overview Tab: Binary summary, sections, pattern summary
• 📝 Disassembly Tab: Interactive disassembly with address navigation
• ⚙️ Functions Tab: Detected functions list
• 📄 Strings Tab: Found strings in binary
• 🔍 Patterns Tab: Crypto, network, anti-debug, anti-VM detection
• 🔎 Query Tab: Rule-based natural language queries
• 🤖 AI Tab: Ollama integration for intelligent analysis

CLI

# Load and analyze a binary
./target/release/re-ai load --file /bin/ls

# Get binary info
./target/release/re-ai info --file /bin/ls

# Disassemble at address
./target/release/re-ai disasm --file /bin/ls --address 0x401000 --count 50

# Interactive query session
./target/release/re-ai query --file /bin/ls

AI Integration

The GUI includes AI-powered analysis powered by Ollama:

Setup

1. Install Ollama: curl -fsSL https://ollama.com/install.sh | sh
2. Pull a model: ollama pull mistral (or llama3, codellama)
3. Open the GUI and go to the AI Tab
4. Click Connect to detect Ollama
5. Select your model

Example Queries

• "Summarize this binary and its main functionality"
• "Analyze for security vulnerabilities"
• "What cryptographic algorithms are used?"
• "Find anti-debugging techniques"
• "Is this malware?"

Binary Context Sent to AI

The AI receives:

• File format and architecture
• Entry point
• Function count and imports
• Detected patterns (crypto, network, anti-debug counts)
• String references

Natural Language Query Examples

Query	Result
find crypto functions	Lists cryptographic imports and patterns
find network operations	Lists networking imports and patterns
show strings	Lists strings in binary
show functions	Lists detected functions
what is at 0x401000	Shows function/symbol at address
find suspicious patterns	Lists anti-debug, anti-VM patterns
overview	Shows binary summary
explain function sub_401000	Provides function details

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    User Interface                            │
│  (CLI + GUI with tabs: Overview, Disasm, Functions, etc.)   │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│              Natural Language Query Engine                   │
│  - Intent classification                                      │
│  - Pattern matching                                           │
│  - Result ranking                                             │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                    AI/ML Layer                               │
│  - Local LLM (Ollama)                                        │
│  - Query intent classification                                │
│  - Result explanation                                         │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                   Analysis Engine                            │
│  - Function detection                                         │
│  - Pattern matching (50+ patterns)                           │
│  - Control flow analysis                                      │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                Binary Processing Layer                       │
│  - Format parsers (ELF, PE, Mach-O via goblin)               │
│  - Disassembler (Capstone)                                    │
│  - String extraction                                          │
└─────────────────────────────────────────────────────────────┘

Project Structure

re-ai/
├── Cargo.toml
├── README.md
└── src/
    ├── main.rs              # CLI entry point
    ├── gui_main.rs          # GUI entry point
    ├── binary/              # Binary parsing
    │   ├── mod.rs
    │   └── parser.rs
    ├── disasm/              # Disassembly engine
    │   ├── mod.rs
    │   └── engine.rs
    ├── analysis/            # Analysis modules
    │   ├── mod.rs
    │   ├── functions.rs
    │   ├── patterns.rs
    │   └── cfg.rs
    ├── ai/                  # AI integration
    │   ├── mod.rs
    │   ├── llm.rs
    │   └── queries.rs
    ├── ir/                   # Intermediate representation
    │   ├── mod.rs
    │   └── representation.rs
    ├── cli/                  # CLI commands
    │   ├── mod.rs
    │   └── commands.rs
    └── utils/                # Utilities
        └── mod.rs

Pattern Detection

Built-in detection for:

Category	Patterns
Crypto	AES, DES, RSA, MD5, SHA, OpenSSL APIs, Windows CryptoAPI
Network	Socket APIs, HTTP, DNS, cURL, WinINet
FileSystem	File I/O, directory enumeration
Anti-Debug	IsDebuggerPresent, timing checks, debugger detection
Anti-VM	CPUID checks, VMware/VBox/QEMU detection
Process	Process creation, injection, memory manipulation

Configuration

Ollama Endpoint

Default: http://localhost:11434

Change in GUI at AI Tab → Ollama Endpoint field.

Supported Models

• mistral (recommended) - Fast, good for general analysis
• llama3 - Larger, more detailed responses
• codellama - Better for code understanding
• deepseek-coder - Good for reverse engineering

Roadmap

• Phase 1: Core binary parsing and disassembly
• Phase 1: Function detection
• Phase 1: Pattern matching
• Phase 2: CFG construction
• Phase 3: Natural language queries (rule-based)
• Phase 3: LLM integration (Ollama)
• Phase 4: GUI application
• Phase 5: Decompiler (IR → pseudocode)
• Phase 5: Cross-reference browser
• Phase 5: Hex view
• Phase 5: Plugin system

Contributing

Contributions welcome! Areas of interest:

• Additional binary format parsers
• New pattern libraries
• LLM prompt engineering
• GUI improvements
• Test coverage

License

MIT License - see LICENSE file.

Acknowledgments

• Capstone - Disassembly engine
• goblin - Binary parsing
• Ollama - Local LLM server
• egui - GUI framework