Skip to content

LLM Explainer v1.7.0

Latest

Choose a tag to compare

@pgarba pgarba released this 15 Jul 09:09

Features

  • Packed-string-table recovery — spots a helper that slices fixed-length substrings out of one merged string blob (a common obfuscation). The model flags it with SUGGESTED_STRING_EXTRACTOR: <fn> ptr=<n> len=<m>; the plugin then reads the constant pointer/length at every call site, defines each carved string literal with a repeatable comment, and invalidates the callers' Hex-Rays cache so the pseudocode re-renders the shortened strings (get_partial_string(dst, blob, 6)"REFLEX").
  • Caller-fetch (REQUEST_CALLERS) — the model can pull in a few of the target's callers to read the concrete arguments passed at real call sites, sharpening inferred parameter types. New Max callers shown per request setting (default 3).

Fixes

  • Prune orphaned saved user-lvar entries — silences the Hex-Rays variable defea=... could not be found warnings — conservatively, dropping an entry only when neither its defea nor a concrete storage location survives, so live renames (e.g. a BYREF stack array after a prototype change) are never lost.
  • Collision-avoidance renames now try a trailing underscore (req_ctxreq_ctx_) before numeric suffixes.
  • A SUGGESTED_CALLEE_NAME that proposes the name a callee already has is now skipped silently instead of logging a spurious "ignored" warning.
  • Robust signature application: strips <old> -> <new> arrow forms, falls back to parse_decl + apply_tinfo, and logs the real reason on failure.
  • No-progress guard on the on-demand fetch loop: if a round surfaces no new code or callers, the model is forced to finalize, preventing a request loop.
  • Prompt: stronger argument-typing rule (address arithmetic / string-literal call args imply a pointer type, never a bare integer).