{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/LICENSE",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/compose.yaml",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/Dockerfile.runner",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/requirements.txt",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/src/main.py",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/src/config.py",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/src/tools/tools.py",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/src/tools/sandboxed_shell/dockerized_bash.py",
    "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/tests/test_disassemble.py"
  ],
  "category": "agent-workflows",
  "description_en": "Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. Workspaces are keyed by the binary’s SHA-256, so uploading the same file again restores the session. It came out of a school research project, and its CTF results are the authors’ own report.",
  "description_zh": "Gradio 对话应用，其 LangGraph ReAct 智能体分析使用者上传的 x86 Linux ELF 二进制文件：列出并反汇编函数，用 Ghidra 反编译，调用 radare2 和 gdb，并在特权模式的 Kali Linux 运行容器中执行 shell 命令和 Python 脚本。工作区以二进制文件的 SHA-256 为键，再次上传同一文件即可恢复会话。该项目源自一项学校研究计划，其 CTF 成绩为作者自述。",
  "entry_url": "https://awesomerea.org/resources/decompai/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/decompai/",
  "evidence_url": "https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/README.md",
  "group": "agents",
  "id": "decompai",
  "json_url": "https://awesomerea.org/resources/decompai/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/decompai/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/decompai/index.md",
  "name": "DecompAI",
  "name_zh": "DecompAI：在 Kali 容器中分析二进制的对话智能体",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "The reviewed main commit of 2025-11-10 containerised the app. The repository has no tagged releases; the README points to app and runner images tagged 1.0.0 on Docker Hub. Only x86 Linux ELF binaries are supported, and QEMU-based ARM, MIPS and Windows PE support is listed as future work.",
    "The app needs Python with the pinned requirements.txt (Gradio 5.25, LangGraph and LangChain) and Docker. docker compose builds or pulls a Kali runner image with kali-linux-headless, Ghidra 11.3.1, OpenJDK 21 and radare2 plugins, and the app controls the host Docker daemon through a mounted /var/run/docker.sock. Runner containers start with --privileged on Docker’s default network, and the Gradio interface listens on 0.0.0.0:7860 by default; the README asks maintainers to audit any added dependencies.",
    "An OpenAI or Gemini API key and an LLM_MODEL setting go in .env. The README suggests gemini-2.5-pro or gemini-2.5-flash, while the code defaults to gpt-4o-mini; disassembly, decompiled code and tool output are sent to that provider. Users upload their own binaries. None are committed, and tests/test_disassemble.py expects a binaries/ch2.bin that the repository does not include.",
    "The README reports validation on Root-Me CTF challenges, consistently solving difficulty-3-of-5 exercises automatically or semi-automatically, with no published runs or logs. Session data under /tmp/decompai_analysis_sessions by default is lost on reboot.",
    "LICENSE is MIT text with an added clause requiring any use, modification or distribution to display a “Based on DecompAI” attribution, so GitHub does not recognise it as a standard licence; Ghidra, the Kali packages and model services keep their own terms. The README limits use to lawful reverse engineering, education and security research."
  ],
  "requirements_zh": [
    "所审阅的 main 提交（2025-11-10）将应用容器化。仓库没有打标签的发布版本，README 指向 Docker Hub 上标记为 1.0.0 的应用镜像与运行器镜像。目前只支持 x86 Linux ELF 二进制文件，基于 QEMU 的 ARM、MIPS 与 Windows PE 支持列为未来计划。",
    "应用需要 Python 及 requirements.txt 中固定版本的依赖（Gradio 5.25、LangGraph 和 LangChain），以及 Docker。docker compose 会构建或拉取 Kali 运行器镜像，其中包含 kali-linux-headless、Ghidra 11.3.1、OpenJDK 21 和 radare2 插件；应用通过挂载的 /var/run/docker.sock 控制宿主机的 Docker 守护进程。运行器容器以 --privileged 模式在 Docker 默认网络上启动，Gradio 界面默认监听 0.0.0.0:7860；README 要求维护者审查新增的任何依赖。",
    "需要在 .env 中填写 OpenAI 或 Gemini API 密钥及 LLM_MODEL 设置。README 建议使用 gemini-2.5-pro 或 gemini-2.5-flash，而代码默认使用 gpt-4o-mini；反汇编、反编译代码和工具输出都会发送给该服务商。二进制文件由使用者自行上传，仓库未提交任何二进制文件，而 tests/test_disassemble.py 需要仓库中并不存在的 binaries/ch2.bin。",
    "README 称已在 Root-Me CTF 题目上验证，能自动或半自动地稳定解出难度为 3/5 的题目，但未公开运行记录或日志。会话数据默认保存在 /tmp/decompai_analysis_sessions，重启后会丢失。",
    "LICENSE 为 MIT 文本另加一条款，要求任何使用、修改或分发都须显著标注“Based on DecompAI”署名，因此 GitHub 不将其识别为标准许可证；Ghidra、Kali 软件包和模型服务各有其条款。README 将用途限定于合法的逆向工程、教学和安全研究。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/louisgthier/decompai",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}