{ "added_at": "2026-10-19", "additional_evidence_urls": [ "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/ida-plugin.json", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/pyproject.toml", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/gepetto/config.ini", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/gepetto/ida/cli.py", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/gepetto/ida/tools/tools.py", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/gepetto/ida/tools/run_python.py", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/gepetto/ida/handlers.py", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/tests/conftest.py", "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/LICENSE", "https://github.com/JusticeRage/Gepetto/releases/tag/v1.5.1" ], "category": "agent-workflows", "description_en": "IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. A chat console inside IDA also lets the model call tools that read disassembly, decompilation, cross-references, strings and types, rename and comment the database and run Python. The README warns that these general-purpose models may well be wrong and asks users to treat every result critically.", "description_zh": "IDA Pro 插件，把 Hex-Rays 伪代码发送给使用者选定的托管或本地大模型，用于解释函数、添加注释或提出新的变量名与函数名，由使用者勾选后再应用。IDA 内的对话控制台还允许模型调用工具，读取反汇编、反编译结果、交叉引用、字符串和类型，对数据库进行重命名和注释，并运行 Python。README 提醒这些通用模型很可能出错，要求使用者审慎对待每一个结果。", "entry_url": "https://awesomerea.org/resources/gepetto/", "entry_url_zh": "https://awesomerea.org/zh/resources/gepetto/", "evidence_url": "https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/README.md", "group": "agents", "id": "gepetto", "json_url": "https://awesomerea.org/resources/gepetto/record.json", "kind": "integration", "markdown_url": "https://awesomerea.org/resources/gepetto/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/gepetto/index.md", "name": "Gepetto", "name_zh": "Gepetto：调用大模型辅助逆向的 IDA 插件", "record_type": "resource", "relationship": "independent-agent-integration", "requirements": [ "The reviewed main commit is 38 commits after the v1.5.1 release of 2025-11-19, while ida-plugin.json and pyproject.toml still declare version 1.5.0. The README requires IDA Pro 7.6 or later with the Hex-Rays decompiler. Installation uses Hex-Rays’ hcli plugin command, or copies gepetto.py and the gepetto folder into the IDA plugins directory and installs requirements.txt into IDA’s Python; pyproject.toml asks for Python 3.10+.", "Each request sends the current function’s pseudocode, and in the chat console whatever the tools return, to the selected provider. Built-in providers include Anthropic, OpenAI, Gemini, Azure OpenAI, Groq, Together, Novita AI, Kluster.ai, DeepSeek and OpenRouter with the user’s own API keys, which the README notes are usually paid, plus local Ollama or LM Studio models. Further providers load as drop-in Python files or entry-point packages, which the README warns execute arbitrary code when IDA starts.", "The chat console, chosen as Gepetto in IDA’s input bar, offers the model 22 tools: reading disassembly, bytes, pseudocode, cross-references, imports, symbols, strings, structures and search results; declaring C types; renaming functions, globals and local variables; setting comments; and run_python, which executes model-supplied Python inside IDA with no confirmation step. Its system prompt tells the model to carry out requested changes without asking. The Explain, Comment and Auto-rename menu actions work on one function, and Auto-rename lists the proposed names so the user selects which to apply; two actions the README does not describe, Generate C Code and Generate Python Code, save a model-written rewrite of the function to a file.", "Repository tests use pytest with Hex-Rays’ idapro library and open a bundled manalyze.exe build, from the author’s Manalyze PE analyser, as a fixture; no CI workflow is published. The README’s before-and-after screenshot and its observation that renaming works better after an explanation are the author’s.", "GPL-3.0 per LICENSE and ida-plugin.json; IDA Pro, the Hex-Rays decompiler and model services keep their own licences and terms. The README credits Kaspersky with initial funding and HarfangLab as the current backer." ], "requirements_zh": [ "所审阅的 main 提交位于 2025-11-19 发布的 v1.5.1 之后 38 个提交，而 ida-plugin.json 与 pyproject.toml 仍标注 1.5.0 版。README 要求 IDA Pro 7.6 或更高版本并配备 Hex-Rays 反编译器。可通过 Hex-Rays 的 hcli 插件命令安装，或把 gepetto.py 与 gepetto 文件夹复制到 IDA 插件目录，再把 requirements.txt 安装到 IDA 使用的 Python 中；pyproject.toml 要求 Python 3.10+。", "每次请求都会把当前函数的伪代码发送给所选服务商，在对话控制台中还会发送工具返回的全部内容。内置服务商包括 Anthropic、OpenAI、Gemini、Azure OpenAI、Groq、Together、Novita AI、Kluster.ai、DeepSeek 和 OpenRouter，需使用者自备 API 密钥，README 提示这些调用通常需要付费；也可使用本地 Ollama 或 LM Studio 模型。其他服务商可以作为 Python 文件或入口点软件包加载，README 提醒它们会在 IDA 启动时执行任意代码。", "在 IDA 输入栏选择 Gepetto 即进入对话控制台，模型可调用 22 个工具：读取反汇编、字节、伪代码、交叉引用、导入表、符号、字符串、结构体和搜索结果；声明 C 类型；重命名函数、全局变量和局部变量；设置注释；以及 run_python，它在 IDA 内执行模型给出的 Python 代码，不经确认。其系统提示要求模型直接执行所请求的修改，无需询问。“解释”“注释”和“自动重命名”菜单操作只处理单个函数，自动重命名会列出建议名称供使用者勾选后应用；README 未介绍的“生成 C 代码”和“生成 Python 代码”两项操作会把模型改写的函数代码保存为文件。", "仓库测试使用 pytest 和 Hex-Rays 的 idapro 库，并以仓库自带的 manalyze.exe（作者的 PE 分析工具 Manalyze 的构建产物）为测试样本；仓库未提供 CI 工作流。README 中的前后对比截图，以及先请求解释再重命名效果更好的观察，均为作者所述。", "LICENSE 与 ida-plugin.json 标明采用 GPL-3.0；IDA Pro、Hex-Rays 反编译器和模型服务各有其许可与条款。README 感谢 Kaspersky 提供最初资助，并称 HarfangLab 为当前支持方。" ], "targets": [ "binary" ], "url": "https://github.com/JusticeRage/Gepetto", "verification": "source-reviewed", "verified_at": "2026-10-19" }