{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/ida-plugin.json",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/headless_batch_extractor.ps1",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/docs/data_format_reference.md",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/tests/conftest.py",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/.github/workflows/release.yml",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/deep_extract/deps/pefile-2024.8.26.dist-info/LICENSE",
    "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/LICENSE",
    "https://github.com/marcosd4h/DeepExtractIDA/releases/tag/v0.9.14"
  ],
  "category": "agent-workflows",
  "description_en": "IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. It runs headless over directories, file lists or the modules of a running process, or interactively on the open IDA database, keeping the analyst’s renames and comments. The agent commands that work on this output come from the separate DeepExtractRuntime project.",
  "description_zh": "IDA Pro 9.x 插件与 PowerShell 批量提取脚本，可把 Windows PE 文件转换为 AI 编程智能体能够读取的材料：每个二进制文件对应一个 SQLite 数据库，内含 PE 元数据、函数签名、反汇编、Hex-Rays 伪代码、交叉引用、字符串、栈帧、循环与危险 API 调用；还可选择输出分组的 C++ 与汇编文件，每个函数附带调用者、被调者与字符串信息头，并生成 JSON 索引。它可以无界面地处理目录、文件列表或正在运行进程加载的模块，也可以在已打开的 IDA 数据库上交互运行，并保留分析者所做的重命名和注释。处理这些输出的智能体命令来自独立的 DeepExtractRuntime 项目。",
  "entry_url": "https://awesomerea.org/resources/deepextract-ida/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/deepextract-ida/",
  "evidence_url": "https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/README.md",
  "group": "agents",
  "id": "deepextract-ida",
  "json_url": "https://awesomerea.org/resources/deepextract-ida/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/deepextract-ida/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/deepextract-ida/index.md",
  "name": "DeepExtract (DeepExtractIDA)",
  "name_zh": "DeepExtract：把 PE 文件导出给 AI 智能体的 IDA 插件",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "The reviewed main commit is the v0.9.14 release of 2026-09-12; ida-plugin.json lists IDA 9.0 to 9.3 on Windows x86-64, and the plugin installs with Hex-Rays’ hcli or runs from a clone. The README requires Windows 10 or 11 and IDA Pro 9.x, with the Pro edition for headless mode. The Hex-Rays decompiler is needed only for pseudocode and C++ output, while assembly output works from disassembly alone. pefile is vendored; the batch script also checks for Python on PATH and needs symchk.exe from the Windows SDK Debugging Tools for its default PDB download from Microsoft’s public symbol server.",
    "Users supply the PE files, from single binaries to whole directories such as System32 or the modules loaded by a running process. The README warns that large batches can run for days and produce tens to hundreds of gigabytes. Outputs contain disassembly and decompiled code of the analysed binaries, whose own licences still apply.",
    "The extractor calls no model. With -EnableAI, the batch extractor writes a CLAUDE.md that tells the agent, without asking the user, to clone the DeepExtractRuntime repository’s default branch into .claude and install Cursor rules and hooks; that runtime and its agents are not part of this repository.",
    "Vtable and indirect-call resolution are labelled experimental, with stated limits such as a single vtable at object offset 0 and a short intra-procedural instruction window. Tests load IDA-independent modules such as the schema, configuration and code formatters outside IDA, and the release workflow only packages the plugin.",
    "MIT, with the vendored pefile under its own MIT licence; IDA Pro, the Hex-Rays decompiler and the Windows SDK tools are licensed separately. The README presents the output for AI-assisted vulnerability research, reverse engineering, threat hunting and code review."
  ],
  "requirements_zh": [
    "所审阅的 main 提交即 2026-09-12 发布的 v0.9.14；ida-plugin.json 列出支持 Windows x86-64 上的 IDA 9.0 至 9.3，可通过 Hex-Rays 的 hcli 安装插件，也可直接从克隆的仓库运行。README 要求 Windows 10 或 11 与 IDA Pro 9.x，无界面模式需要 Pro 版。只有输出伪代码和 C++ 文件时才需要 Hex-Rays 反编译器，汇编输出仅依赖反汇编。pefile 已随仓库附带；批量脚本还会检查 PATH 中的 Python，并需要 Windows SDK 调试工具中的 symchk.exe，以便默认从 Microsoft 公共符号服务器下载 PDB。",
    "PE 文件由使用者提供，范围可从单个二进制文件到 System32 等整个目录，或某个运行中进程加载的全部模块。README 提醒大规模批处理可能持续数天，并产生数十至数百 GB 的输出。输出包含被分析二进制文件的反汇编和反编译代码，这些文件自身的许可依然适用。",
    "提取器本身不调用任何模型。使用 -EnableAI 时，批量提取脚本会写入一份 CLAUDE.md，要求智能体不经询问使用者，就把 DeepExtractRuntime 仓库的默认分支克隆到 .claude 并安装 Cursor 规则与钩子；该运行时及其智能体不属于本仓库。",
    "虚表与间接调用解析标注为实验性功能，并说明了限制，例如仅处理对象偏移 0 处的单个虚表，且只在过程内的短指令窗口中匹配。测试在 IDA 之外加载模式定义、配置和代码格式化等不依赖 IDA 的模块，发布工作流只负责打包插件。",
    "采用 MIT 许可，附带的 pefile 保留其自身的 MIT 许可；IDA Pro、Hex-Rays 反编译器和 Windows SDK 工具需另行获得许可。README 将其输出定位于 AI 辅助的漏洞研究、逆向工程、威胁狩猎和代码审查。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/marcosd4h/DeepExtractIDA",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}