AwesomeREA.org

Learning resource

MCP Reversing Dataset (mrexodia)

Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. Each folder holds the input binary, a README giving its origin, the prompt and the model, the agent's own report and the exported session transcript, so readers can follow every tool call, rename, retype and comment the agent made on the database. The tasks cover a small Linux password check, an obfuscated Linux flag checker and a Windows crackme that, according to the agent's report, routes its checks through vectored exception handling.

Targets
Binary
Category
Learning resources
Relationship
Learning resource
Sources reviewed

Requirements & limits

  • Three tasks, committed between 2025-03-28 and 2025-04-14 and unchanged since. Each folder's README gives the input, the prompt and the model, next to the agent's report.md and an exported task-history.md transcript; crackme03 adds the agent's solve.py and a launcher that runs the ELF through WSL. All three runs used Claude 3.7 Sonnet in Roo Cline or Roo Code with the author's IDA Pro MCP server, which this collection lists separately.
  • The repository bundles the three challenge binaries it analyzes: VEHMeme.exe, a Windows crackme the README credits to Brit and xenocidewiki from an earlier CTF; crackme03.elf, compiled with GCC 11.4.0 on Ubuntu 22.04 from a NoraCodes crackmes source file; and transformed.elf, described as a modified version of babush's mcp-job-security obfuscation project. They are small CTF-style samples rather than commercial software, but the repository states no redistribution terms for them.
  • Following a run needs IDA Pro, which is commercial, the IDA Pro MCP server and an MCP client. The prompts ask the model to rename, retype and comment the database and write a report, and the crackme03 prompt forbids brute forcing. The transcripts are single, unscored runs: the crackme03 report records a password confirmed by running the binary, the mcp-job-security report names the flag it extracted, and the VEHMeme report explains the exception-based check without stating a flag. These are author-published results, not reproduced here.
  • There is no license file, so reuse terms for the transcripts and reports are unstated; the README welcomes contributions, but only the original three tasks exist. The reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  2. crackme03/README.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  3. crackme03/report.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  4. VEHMeme/README.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  5. VEHMeme/report.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  6. mcp-job-security/README.md GitHub · mrexodia/mcp-reversing-dataset · Revision 523ce22
  7. https://github.com/mrexodia/mcp-reversing-dataset/tree/523ce22b9b0d3371f6dfc8f344e604064dc0ef97

More in References and learning

All 61 entries in References and learning