AwesomeREA.org

Tool

knife

Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. It triages hashes, sections, mitigations, imports, strings, indicators and crypto constants; recovers functions, call graphs and CFGs through recursive-descent disassembly for x86/x64 and AArch64; and lifts functions to experimental pseudocode. Analysts' names, notes, types and staged patches persist in a per-binary database shared by the CLI, a terminal UI and an MCP server, and further passes rank risky API call sites by argument provenance and summarize Windows driver dispatch and IOCTL surfaces.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The repository was created on 2026-08-08. Release v1.8.3 (2026-10-11) ships Linux x86_64, macOS arm64/x86_64 and Windows x86_64 archives, while the reknife crate on crates.io stops at 1.8.0 (2026-09-15); the reviewed main commit is 48 commits past v1.8.3, with unreleased changes listed in CHANGELOG. Source builds need Rust 1.88+, and the README says no system libraries are needed beyond the platform default; knife update needs curl.
  • Input is a binary the analyst supplies, which knife only reads. Disassembly covers x86/x64 and AArch64, the audit data-flow checks are x86/x64 only, and the README says empty reachability results do not prove unreachability because indirect dispatch is outside the direct call graph. WebAssembly gets section, import/export and WAT views without code analysis. The repository contains no target binaries: tests build synthetic PE and ELF fixtures in code, and data/loldrivers.json is a snapshot of the public LOLDrivers list used for SHA-256 matching.
  • knife mcp speaks MCP over stdio; docs/MCP.md lists 58 tools, four of which write names, notes, prototypes or staged patches to the project database rather than the binary. The optional investigation desk sends prompts and tool results to the model provider the user configures (local Ollama, OpenRouter, OpenAI or another OpenAI-compatible endpoint) and keeps hosted API keys in the OS credential vault. Optional adapters call a separately installed Rizin, and the provider docs also describe Ghidra headless and capa adapters; YARA-X 1.12 is linked in for rule scans, and a GDB runtime exporter is documented but not yet exposed.
  • CI runs cargo build and test on Ubuntu, Windows and macOS, plus cargo fmt and clippy. The README presents audit hits as call sites whose argument provenance matches a bug pattern, and its 7z.dll, kernel32.dll and CVE-2017-11882 figures are the author's results; none were reproduced here.
  • MIT (2026, 0xblack). The LOLDrivers snapshot comes from that project's public API, and Rizin, Ghidra, capa and YARA-X keep their own licenses. The repository's AGENTS.md is contributor guidance for coding agents; the reviewed sources establish no REA connection, and nothing was installed or run for this review.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  2. Cargo.toml GitHub · bl4ckr0ss3/knife · Revision f260b87
  3. LICENSE GitHub · bl4ckr0ss3/knife · Revision f260b87
  4. CHANGELOG.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  5. docs/MCP.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  6. docs/external-providers.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  7. docs/investigation-desk.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  8. docs/gdb-provider-validation.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  9. docs/case-study-eqnedt32.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  10. scripts/gen-loldrivers.mjs GitHub · bl4ckr0ss3/knife · Revision f260b87
  11. .github/workflows/ci.yml GitHub · bl4ckr0ss3/knife · Revision f260b87
  12. AGENTS.md GitHub · bl4ckr0ss3/knife · Revision f260b87
  13. https://github.com/bl4ckr0ss3/knife/releases/tag/v1.8.3
  14. https://docs.rs/crate/reknife/1.8.0

More in Native binaries

All 132 entries in Native binaries