mcpField
D
decompiler

decompiler

github.com/vulhunt-reDevelopment1641 installsUpdated 34w ago
Repository

About decompiler

decompiler is a binary-analysis skill that converts selected functions into C-like pseudocode. It uses VulHunt MCP tools to target functions by name, address, or pattern.

Key features

  1. 01Decompile functions into C-like pseudocode
  2. 02Select functions by name or address
  3. 03Match with regex or byte patterns
  4. 04Return all matching functions

Use cases

  1. 01Inspect a function's implementation and logic
  2. 02Analyze function control flow
  3. 03Understand a function before deeper analysis

MCP support

The skill uses VulHunt MCP tools to open a project and run a Lua query that returns decompiled function pseudocode.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vulhunt-re/skills --skill decompiler

After installing, type/decompilerin Claude Code to confirm it loaded.

Details

From the project README

Decompiler

Decompile a function in a binary to C-like pseudocode.

When to use

  • View the decompiled source code of a function
  • Analyze function logic and control flow
  • Understand what a function does before deeper analysis

Instructions

Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:

local d = project:decompile(<target_function>)

return tostring(d)

Possible values for <target_function>:

  • A string, e.g. "system"
  • An AddressValue
    • VulHunt APIs return addresses as an AddressValue
    • To build an AddressValue, use for example: AddressValue.new(0x1234)
  • A regex, e.g. {matching = "<regex>", kind = "symbol", all = true}
  • A byte pattern, e.g. {matching = "41544155", kind = "bytes", all = true}

all is a boolean. If set to true, it returns a table containing all matching functions. If false (default), it returns only the first matching value. The for loop is not necessary if the function target is only one (i.e. all is not set to true)

Returns the decompiled C-like pseudocode as a string.

Related Skills

  • functions (/functions) — Use this skill to locate specific functions by name, address, pattern, or behavioral criteria (e.g., functions that call a particular API) before decompiling them.
  • code-pattern-matching (/code-pattern-matching) - Search for specific code patterns in the decompiled output

Comments

Markdown supported