# MCP Reversing Dataset (mrexodia) > Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. Each folder holds the input binary, a README giving its origin, the prompt and the model, the agent's own report and the exported session transcript, so readers can follow every tool call, rename, retype and comment the agent made on the database. The tasks cover a small Linux password check, an obfuscated Linux flag checker and a Windows crackme that, according to the agent's report, routes its checks through vectored exception handling. - Type: Learning resource - Targets: Binary - Category: Learning resources - Relationship: Learning resource - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/mcp-reversing-dataset/index.md) ## Requirements & limits - Three tasks, committed between 2025-03-28 and 2025-04-14 and unchanged since. Each folder's README gives the input, the prompt and the model, next to the agent's report.md and an exported task-history.md transcript; crackme03 adds the agent's solve.py and a launcher that runs the ELF through WSL. All three runs used Claude 3.7 Sonnet in Roo Cline or Roo Code with the author's IDA Pro MCP server. - The repository bundles the three challenge binaries it analyzes: VEHMeme.exe, a Windows crackme the README credits to Brit and xenocidewiki from an earlier CTF; crackme03.elf, compiled with GCC 11.4.0 on Ubuntu 22.04 from a NoraCodes crackmes source file; and transformed.elf, described as a modified version of babush's mcp-job-security obfuscation project. They are small CTF-style samples rather than commercial software, but the repository states no redistribution terms for them. - Following a run needs IDA Pro, which is commercial, the IDA Pro MCP server and an MCP client. The prompts ask the model to rename, retype and comment the database and write a report, and the crackme03 prompt forbids brute forcing. The transcripts are single, unscored runs: the crackme03 report records a password confirmed by running the binary, the mcp-job-security report names the flag it extracted, and the VEHMeme report explains the exception-based check without stating a flag. These are author-published results. - There is no license file, so reuse terms for the transcripts and reports are unstated; the README welcomes contributions, but only the original three tasks exist. ## Primary sources 1. 2. 3. 4. 5. 6. 7. ## More in References and learning - [ICSim (Instrument Cluster Simulator)](https://awesomerea.org/resources/icsim/index.md) · Learning resource - [CNNPRE (IEEE Access 2023)](https://awesomerea.org/resources/cnnpre/index.md) · Research - [RPISEC Malware Analysis course (CSCI 4976)](https://awesomerea.org/resources/rpisec-malware-analysis-course/index.md) · Learning resource - [Corkami pics](https://awesomerea.org/resources/corkami-pics/index.md) · Learning resource - [Practical Malware Analysis](https://awesomerea.org/resources/practical-malware-analysis/index.md) · Learning resource - [Windows Malware Analysis training, volume 1 (malware_training_vol1)](https://awesomerea.org/resources/malware-training-vol1/index.md) · Learning resource ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.