Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Integration

DecompAI

Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. Workspaces are keyed by the binary’s SHA-256, so uploading the same file again restores the session. It came out of a school research project, and its CTF results are the authors’ own report.

Targets
Binary
Category
Independent agent workflows
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • The reviewed main commit of 2025-11-10 containerised the app. The repository has no tagged releases; the README points to app and runner images tagged 1.0.0 on Docker Hub. Only x86 Linux ELF binaries are supported, and QEMU-based ARM, MIPS and Windows PE support is listed as future work.
  • The app needs Python with the pinned requirements.txt (Gradio 5.25, LangGraph and LangChain) and Docker. docker compose builds or pulls a Kali runner image with kali-linux-headless, Ghidra 11.3.1, OpenJDK 21 and radare2 plugins, and the app controls the host Docker daemon through a mounted /var/run/docker.sock. Runner containers start with --privileged on Docker’s default network, and the Gradio interface listens on 0.0.0.0:7860 by default; the README asks maintainers to audit any added dependencies.
  • An OpenAI or Gemini API key and an LLM_MODEL setting go in .env. The README suggests gemini-2.5-pro or gemini-2.5-flash, while the code defaults to gpt-4o-mini; disassembly, decompiled code and tool output are sent to that provider. Users upload their own binaries. None are committed, and tests/test_disassemble.py expects a binaries/ch2.bin that the repository does not include.
  • The README reports validation on Root-Me CTF challenges, consistently solving difficulty-3-of-5 exercises automatically or semi-automatically, with no published runs or logs. Session data under /tmp/decompai_analysis_sessions by default is lost on reboot.
  • LICENSE is MIT text with an added clause requiring any use, modification or distribution to display a “Based on DecompAI” attribution, so GitHub does not recognise it as a standard licence; Ghidra, the Kali packages and model services keep their own terms. The README limits use to lawful reverse engineering, education and security research.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · louisgthier/decompai · Revision 0c2398c
  2. LICENSE GitHub · louisgthier/decompai · Revision 0c2398c
  3. compose.yaml GitHub · louisgthier/decompai · Revision 0c2398c
  4. Dockerfile.runner GitHub · louisgthier/decompai · Revision 0c2398c
  5. requirements.txt GitHub · louisgthier/decompai · Revision 0c2398c
  6. src/main.py GitHub · louisgthier/decompai · Revision 0c2398c
  7. src/config.py GitHub · louisgthier/decompai · Revision 0c2398c
  8. src/tools/tools.py GitHub · louisgthier/decompai · Revision 0c2398c
  9. src/tools/sandboxed_shell/dockerized_bash.py GitHub · louisgthier/decompai · Revision 0c2398c
  10. tests/test_disassemble.py GitHub · louisgthier/decompai · Revision 0c2398c

More in Agents and MCP

All 87 entries in Agents and MCP

↑↓ move↵ open⌘↵ new tab