{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/Cargo.toml",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/LICENSE",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/CHANGELOG.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/docs/MCP.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/docs/external-providers.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/docs/investigation-desk.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/docs/gdb-provider-validation.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/docs/case-study-eqnedt32.md",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/scripts/gen-loldrivers.mjs",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/.github/workflows/ci.yml",
    "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/AGENTS.md",
    "https://github.com/bl4ckr0ss3/knife/releases/tag/v1.8.3",
    "https://docs.rs/crate/reknife/1.8.0"
  ],
  "category": "native-analysis",
  "description_en": "Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. It triages hashes, sections, mitigations, imports, strings, indicators and crypto constants; recovers functions, call graphs and CFGs through recursive-descent disassembly for x86/x64 and AArch64; and lifts functions to experimental pseudocode. Analysts' names, notes, types and staged patches persist in a per-binary database shared by the CLI, a terminal UI and an MCP server, and further passes rank risky API call sites by argument provenance and summarize Windows driver dispatch and IOCTL surfaces.",
  "description_zh": "以 Rust 编写的静态逆向工程工具包，安装后为 knife 命令，可在不运行目标的情况下解析 PE、ELF、Mach-O 和 WebAssembly 文件。它能分诊哈希、节区、缓解措施、导入、字符串、威胁指标和加密常量；通过面向 x86/x64 与 AArch64 的递归下降反汇编恢复函数、调用图和控制流图；还能把函数提升为实验性伪代码。分析者添加的命名、注释、类型和暂存补丁保存在按二进制区分的数据库中，由命令行、终端界面和 MCP 服务器共享；另有分析步骤按参数来源对有风险的 API 调用点排序，并汇总 Windows 驱动的派发例程和 IOCTL 接口。",
  "entry_url": "https://awesomerea.org/resources/knife/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/knife/",
  "evidence_url": "https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/README.md",
  "group": "tools",
  "id": "knife",
  "json_url": "https://awesomerea.org/resources/knife/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/knife/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/knife/index.md",
  "name": "knife",
  "name_zh": "knife 静态逆向工程工具包",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository was created on 2026-08-08. Release v1.8.3 (2026-10-11) ships Linux x86_64, macOS arm64/x86_64 and Windows x86_64 archives, while the reknife crate on crates.io stops at 1.8.0 (2026-09-15); the reviewed main commit is 48 commits past v1.8.3, with unreleased changes listed in CHANGELOG. Source builds need Rust 1.88+, and the README says no system libraries are needed beyond the platform default; knife update needs curl.",
    "Input is a binary the analyst supplies, which knife only reads. Disassembly covers x86/x64 and AArch64, the audit data-flow checks are x86/x64 only, and the README says empty reachability results do not prove unreachability because indirect dispatch is outside the direct call graph. WebAssembly gets section, import/export and WAT views without code analysis. The repository contains no target binaries: tests build synthetic PE and ELF fixtures in code, and data/loldrivers.json is a snapshot of the public LOLDrivers list used for SHA-256 matching.",
    "knife mcp speaks MCP over stdio; docs/MCP.md lists 58 tools, four of which write names, notes, prototypes or staged patches to the project database rather than the binary. The optional investigation desk sends prompts and tool results to the model provider the user configures (local Ollama, OpenRouter, OpenAI or another OpenAI-compatible endpoint) and keeps hosted API keys in the OS credential vault. Optional adapters call a separately installed Rizin, and the provider docs also describe Ghidra headless and capa adapters; YARA-X 1.12 is linked in for rule scans, and a GDB runtime exporter is documented but not yet exposed.",
    "CI runs cargo build and test on Ubuntu, Windows and macOS, plus cargo fmt and clippy. The README presents audit hits as call sites whose argument provenance matches a bug pattern, and its 7z.dll, kernel32.dll and CVE-2017-11882 figures are the author's results.",
    "MIT (2026, 0xblack). The LOLDrivers snapshot comes from that project's public API, and Rizin, Ghidra, capa and YARA-X keep their own licenses. The repository's AGENTS.md is contributor guidance for coding agents."
  ],
  "requirements_zh": [
    "仓库创建于 2026-08-08。v1.8.3 版本（2026-10-11）提供 Linux x86_64、macOS arm64/x86_64 和 Windows x86_64 压缩包，而 crates.io 上的 reknife crate 停在 1.8.0（2026-09-15）；所审阅的 main 提交比 v1.8.3 多 48 个提交，未发布的改动列在 CHANGELOG 中。从源码构建需要 Rust 1.88+，README 称除平台默认库外无需其他系统库；knife update 需要 curl。",
    "输入为分析者提供的二进制，knife 只读取而不运行它。反汇编支持 x86/x64 和 AArch64，audit 的数据流检查仅限 x86/x64；README 指出可达性结果为空并不代表不可达，因为间接派发不在直接调用图之内。WebAssembly 只有节区、导入导出和 WAT 视图，不做代码分析。仓库不含任何目标二进制：测试在代码中生成合成的 PE 和 ELF 样本，data/loldrivers.json 是公开 LOLDrivers 列表的快照，用于 SHA-256 匹配。",
    "knife mcp 通过 stdio 提供 MCP 服务；docs/MCP.md 列出 58 个工具，其中四个会把命名、注释、原型或暂存补丁写入项目数据库，而不修改二进制本身。可选的调查面板会把提示词和工具结果发送给使用者配置的模型服务（本地 Ollama、OpenRouter、OpenAI 或其他 OpenAI 兼容端点），托管服务的 API 密钥保存在操作系统凭据库中。可选适配器会调用另行安装的 Rizin，提供方文档还介绍了 Ghidra headless 和 capa 适配器；YARA-X 1.12 已内置用于规则扫描，GDB 运行时导出器有文档说明但尚未开放。",
    "CI 在 Ubuntu、Windows 和 macOS 上运行 cargo build 与 test，并运行 cargo fmt 和 clippy。README 将 audit 结果描述为参数来源符合某种缺陷模式的调用点；其中关于 7z.dll、kernel32.dll 和 CVE-2017-11882 的数据均为作者自己的结果。",
    "采用 MIT（2026，0xblack）。LOLDrivers 快照来自该项目的公开 API，Rizin、Ghidra、capa 和 YARA-X 保留各自许可证。仓库中的 AGENTS.md 是写给编程智能体的贡献指南。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/bl4ckr0ss3/knife",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}