AwesomeREA.org

Integration

DeepExtract (DeepExtractIDA)

IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. It runs headless over directories, file lists or the modules of a running process, or interactively on the open IDA database, keeping the analyst’s renames and comments. The agent commands that work on this output come from the separate DeepExtractRuntime project.

Requirements and limitations

  • The reviewed main commit is the v0.9.14 release of 2026-09-12; ida-plugin.json lists IDA 9.0 to 9.3 on Windows x86-64, and the plugin installs with Hex-Rays’ hcli or runs from a clone. The README requires Windows 10 or 11 and IDA Pro 9.x, with the Pro edition for headless mode. The Hex-Rays decompiler is needed only for pseudocode and C++ output, while assembly output works from disassembly alone. pefile is vendored; the batch script also checks for Python on PATH and needs symchk.exe from the Windows SDK Debugging Tools for its default PDB download from Microsoft’s public symbol server.
  • Users supply the PE files, from single binaries to whole directories such as System32 or the modules loaded by a running process. The README warns that large batches can run for days and produce tens to hundreds of gigabytes. Outputs contain disassembly and decompiled code of the analysed binaries, whose own licences still apply.
  • The extractor calls no model. With -EnableAI, the batch extractor writes a CLAUDE.md that tells the agent, without asking the user, to clone the DeepExtractRuntime repository’s default branch into .claude and install Cursor rules and hooks; that runtime and its agents are not part of this repository.
  • Vtable and indirect-call resolution are labelled experimental, with stated limits such as a single vtable at object offset 0 and a short intra-procedural instruction window. Tests load IDA-independent modules such as the schema, configuration and code formatters outside IDA, and the release workflow only packages the plugin. This collection reviewed source and documentation without running IDA or the extractor.
  • MIT, with the vendored pefile under its own MIT licence; IDA Pro, the Hex-Rays decompiler and the Windows SDK tools are licensed separately. The README presents the output for AI-assisted vulnerability research, reverse engineering, threat hunting and code review. The reviewed sources establish no REA connection.

About this entry

Type
Integration
Category
Independent agent workflows
Relationship
Independent agent integration
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  2. ida-plugin.json GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  3. headless_batch_extractor.ps1 GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  4. docs/data_format_reference.md GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  5. tests/conftest.py GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  6. .github/workflows/release.yml GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  7. deep_extract/deps/pefile-2024.8.26.dist-info/LICENSE GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  8. LICENSE GitHub · marcosd4h/DeepExtractIDA · Revision af6b01d
  9. https://github.com/marcosd4h/DeepExtractIDA/releases/tag/v0.9.14