Which integrations are available for this server?

Supports analysis and unflattening of ARM64 root-detection and integrity-checking routines in Android native .so binaries. Provides an ARM64 backend for symbolic execution, control-flow unflattening, and deobfuscation of ARM64 binaries. Supports analysis and unflattening of ARM64 root-detection and integrity-checking routines in iOS Mach-O binaries. Enables analysis of live Linux processes, including zero-disk function hooking and executable trampoline injection into running services. Supports unflattening switch-heavy WASM dispatchers and normalizing structured block/loop control flow in WebAssembly binaries.

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SYMB Find input bytes that reach the success branch in ./crackme" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

SYMB

by duongtech

Overview Schema Source Related Servers Discussions Admin

Python

Local

English · Tiếng Việt

One MCP server for symbolic execution, OLLVM unflattening, and active binary intervention across binaries and runtimes.

npx symb-agents setup

📑 Table of Contents (Mục Lục)

Related MCP server: Antardrishti

⚡ What is SYMB?

SYMB is an autonomous reverse engineering, constraint solving, and active binary intervention engine purpose-built for AI agents. It wraps low-level symbolic execution engines (Z3 SMT Solver, angr, Unicorn CPU Emulator, Capstone, pefile) into clean Model Context Protocol (MCP) tool contracts.

⚔️ Architectural Comparison: SYMB vs REA

Mainstream reverse engineering assistants (such as morluto/rea) are designed strictly as passive observers: they decompile, format pseudocode, and catalog observations, but explicitly refuse to perform binary mutations, bypass checks, or intervene in execution.

Feature / Capability	Passive Assistants (e.g. REA)	SYMB (Active RE & Symbolic Engine)
Philosophy	Passive Read-Only Analysis	Active Dynamic Intervention & Weaponization
Binary opcodes mutation	❌ Refused / Out of scope	✔ Surgical disk binary patcher with RVA-to-Raw conversion
PE Optional CheckSum	❌ None	✔ Automated PE CheckSum recalculation on patched binaries
Anti-Debug / Anti-Analysis	⚠️ Report detections only	✔ Automated trap neutralization (NOP out RDTSC, INT 2D, PEB BeingDebugged)
License & DRM Logic	⚠️ Static report	✔ Automated branch conditional inversion (`JZ`<->`JNZ`, force success, keygen)
Dynamic Instrumentation	⚠️ Basic passive trace	✔ Frida script generator (SSL Unpinning, Root cloak, Anti-Debug API hook)
Live RAM Hot Patching	❌ None	✔ Zero-disk memory trampolines via Win32 VirtualProtectEx / /proc/pid/mem
OLLVM Deobfuscation	❌ Basic heuristic	✔ Symbolic state-variable dispatcher unflattening via Z3 & angr
Evidence & Provenance	✔ Standard schema	✔ Target Identity (SHA256/MD5), Engine Provenance, Fail-Closed verification
Test Verification	✔ Complex test suite	✔ Vitest Unit/Integration Tests + 8 Automated Verification Suites

🛠️ MCP Tool Reference (20 Native Tools)

SYMB implements 20 high-speed native reversing and intervention tools via standard MCP JSON-RPC:

⚔️ Active Binary Intervention Arsenal (5 Tools)

Tools specifically engineered for active exploitation, cracking, and binary neutralization:

Tool Name	Key Arguments	Primary Capability	Deep-Dive Guide
`patch_binary_executable`	`binary_path`, `patches`, `output_path`	Surgical physical disk patcher. Converts RVA to physical file offset, modifies arbitrary hex bytes, generates byte-by-byte diffs, and updates PE checksums.	Guide
`neutralize_anti_debugging`	`binary_path`, `auto_patch`, `output_path`	Scans and neutralizes inline RDTSC timing traps, INT 2D/3 traps, and PEB BeingDebugged checks. Automatically writes patched binaries with recalculated PE checksums.	Guide
`bypass_license_authorization`	`binary_path`, `force_success`, `apply_to_file`	Evaluates authorization branch conditionals, computes inversion patches (`JE`<->`JNE`, force `JMP`), and writes permanently cracked binaries.	Guide
`generate_frida_instrumentation`	`target`, `platform`, `script_type`	Generates battle-tested Frida dynamic instrumentation scripts for SSL unpinning, RootBeer cloaking, and Windows native API hooks.	Guide
`hot_patch_live_memory`	`pid`, `memory_address`, `patch_bytes_hex`	Injects atomic zero-disk trampolines into running process RAM without touching disk binaries.	Guide

🔬 Symbolic Execution & SMT Solver Engines (3 Tools)

Tool Name	Key Arguments	Primary Capability	Deep-Dive Guide
`unflatten_control_flow`	`binary_path`, `function_address`	Symbolically deobfuscates OLLVM switch dispatchers and restores original CFG.	Guide
`solve_branch_reachability`	`binary_path`, `target_address`	Uses Z3 SMT Solver & angr to solve for exact inputs reaching target branches.	Guide
`trace_symbolic_taint`	`binary_path`, `source_symbol`, `sink_symbol`	Bit-level dataflow propagation analysis from input buffers to critical memory sinks.	Contracts

⚡ Multi-Platform Native Decompilers & Unpackers (4 Tools)

Tool Name	Key Arguments	Primary Capability	Deep-Dive Guide
`dynamically_unpack_binary`	`binary_path`, `max_instructions`	Unicorn CPU emulation unpacker. Executes binary past packer stubs (UPX, Themida, crypters), detects OEP tail jumps, and dumps unpacked memory images.	Guide
`decompile_native_function`	`binary_path`, `function_address`	Decompiles machine code to clean C pseudocode in < 400ms with Capstone and struct layout inference.	Guide
`decompile_entire_program`	`binary_path`, `max_functions`	Automated whole-program decompiler. Recovers function entry points and generates unified C source files.	Guide
`decompile_apk_package`	`target_path`, `max_classes`	5-Pass native Dalvik DEX decompiler. Audits permissions, keystore signature schemes (v1/v2/v3), CWEs, and lifts Dalvik to Java.	Guide

🔍 Deep Binary Auditing & Memory Engines (8 Tools)

Tool Name	Key Arguments	Primary Capability	Deep-Dive Guide
`decompile_ios_ipa_package`	`target_path`	Decompiles Apple iOS IPA packages & ARM64 Mach-O binaries. Audits FairPlay DRM (cryptid) and Anti-Jailbreak heuristics.	Contracts
`decrypt_obfuscated_strings`	`binary_path`, `max_candidates`	Solves Single-byte XOR, Multi-byte cycling XOR, Rolling Key XOR, and Base64 across PE, ELF, APK, and .so binaries.	Contracts
`detect_binary_protections`	`binary_path`	Detects packers (UPX, Themida, VMProtect, Enigma), Anti-Debug APIs, Anti-VM artifacts, and ASM timing traps.	Contracts
`inspect_binary_layout`	`binary_path`	Scans PE/ELF headers, ASLR/DEP/SafeSEH mitigations, IAT/EAT exports, and measures section entropy.	Contracts
`detect_crypto_primitives`	`binary_path`	Scans for AES S-Boxes, SHA/MD5 constants, CRC32 tables, RC4 loops, and ChaCha schedules for SMT inversion.	Contracts
`scan_byte_entropy`	`binary_path`, `block_size`	256-byte sliding window Shannon entropy heatmap generator for encrypted shellcode and compressed overlays.	Contracts
`trace_binary_xrefs`	`binary_path`	Maps whole-program call graph edges, indirect calls, and string literal cross-references.	Contracts
`optimize_large_media_buffer`	`file_path`, `target_max_mb`	Downsamples oversized videos, isolates audio tracks, and streams multi-GB dumps via zero-RAM mmap.	Guide

📚 Documentation Hub & Architecture Guides (`docs/`)

SYMB maintains comprehensive, modular documentation covering theoretical foundations, implementation guides, and MCP specifications:

Guide / Document	Focus Area	Description
⚔️ Active Binary Intervention	Binary Cracking & Patching	Complete guide for RVA-to-Raw mapping, PE CheckSum recalculation, Anti-Debug neutralization, and Frida generator.
📜 Canonical MCP Tool Contracts	Protocol Specification	Formal JSON schemas, inputs, outputs, and Canonical Evidence records for all 20 native MCP tools.
🌪️ OLLVM Control-Flow Unflattening	Deobfuscation	Mathematical state-variable solving, dispatcher pruning, and CFG restoration using Z3 & angr.
🎯 SMT Branch Solving Guide	Symbolic Execution	Automated path reachability, SAT solving, and crackme solving with Z3 SMT Theorem Prover.
⚡ Advanced Decompiler Architectures	Native & Dalvik Lifting	Unicorn CPU emulation unpacker, high-speed C pseudocode generator, and 5-pass Android DEX decompiler.
🔒 Zero-Disk Memory Trampolines	Live Memory Hooking	Win32 API (`VirtualProtectEx`) and Linux `/proc/pid/mem` live memory surgery without disk footprints.
🎬 Large Media & Buffer Optimizer	Context Management	Hardware-accelerated audio extraction, video downsampling budgets, and zero-RAM `mmap` streaming.
🧠 Symbolic Engineering Guide	Architecture	Core system principles, mathematical invariants, and agent integration guidelines.
🎯 Target & Architecture Matrix	Compatibility	Platform support matrix across Windows (x86/x64), Linux (x86/x64/ARM), macOS, Android, and iOS.
🚀 Installation & Setup Guide	Getting Started	Detailed step-by-step setup for Claude Desktop, Cursor, Antigravity, and global CLI usage.

💻 Standalone Command-Line Interface (CLI)

# Neutralize Anti-Debugging traps and produce patched binary
symb antidebug ./target.exe --patch

# Bypass license authorization checks and invert branch logic
symb license-bypass ./target.exe --force-success

# Dynamically unpack UPX or encrypted binary via Unicorn CPU emulation
symb unpack ./examples/01_ollvm_cff/CFF_win64.exe

# Decompile native function with control-flow structuring & struct inference
symb decompile ./examples/02_smt_crackme/ais3_crackme 0x4005f6

# Translate an entire binary to a unified C project file
symb decompile-all ./examples/02_smt_crackme/ais3_crackme --limit 10

# Decompile Android APK with resources.arsc symbol resolution
symb apk ./examples/04_apk_sample/sample_protected.apk

🧪 Testing & Rigorous Verification (100% Pass)

SYMB enforces strict fail-closed verification and canonical evidence contracts:

# Run Vitest Unit & Integration Suites
npm run test:unit

# Run All 8 Comprehensive System Verification Suites
npm test

Suites include:

System Capabilities & Solver Audit (Node, Python, Z3, angr, Unicorn, Capstone)
MCP Tool Contracts & Zod Schemas (Validating all 20 tool schemas)
Native High-Speed EXE Decompiler & Layout Engine
Z3 SMT Mathematical Logic Engine
OLLVM Control-Flow Unflattening (PE & ELF)
SMT Branch Reachability Solver
Large Media & Binary Buffer Optimizer Engine
Active Binary Intervention & Weaponized RE Engine

📦 Requirements & Environment

Node.js: >= 18.0.0 (Verified on Node 20, 22, and 24)
Python: >= 3.10
Native Solvers: pip install -r requirements.txt (Z3 SMT Solver, angr, Unicorn, Capstone, pefile).
Run symb audit or npx symb-agents setup to automatically audit your local runtime capabilities.

📄 License

MIT License. Open-source for developers, security researchers, and autonomous AI agents.

Available Tools

20 tools

bypass_license_authorizationB

Active reverse engineering intervention. Detects authorization/license validation branches, computes conditional jump inversions, and applies permanent binary bypass patches on disk.

Inputs: binary_path (required), output_path, apply_to_file, force_success, +1 more.

decompile_apk_packageB

5-Pass native Dalvik DEX decompiler. Audits permissions, keystore signature schemes (v1/v2/v3), CWE vulnerabilities, hardcoded secrets, and lifts Dalvik bytecode to Java classes.

Inputs: target_path (required), max_classes.

decompile_entire_programB

Whole-program C decompiler. Discovers function entry points and generates unified, compilable C source files with forward declarations.

Inputs: binary_path (required), max_functions.

decompile_ios_ipa_packageA

Decompiles Apple iOS IPA packages (.ipa) and ARM64 Mach-O executables. Audits FairPlay DRM (cryptid), Anti-Jailbreak heuristics, and reconstructs Objective-C / Swift interfaces.

Inputs: target_path (required).

decompile_native_functionB

High-speed machine code decompiler (< 400ms). Lifts x86/x64/ARM assembly into clean C pseudocode with branch conditions, string references, and IAT/PLT stub resolution.

Inputs: binary_path (required), function_address, max_instructions.

decrypt_obfuscated_stringsA

Automated string decryptor across raw binary sections. Recovers Single-byte XOR, Multi-byte cycling XOR, and Additive Rolling-Key XOR encrypted strings.

Inputs: binary_path (required), max_candidates.

detect_binary_protectionsC

Detects commercial packers (UPX, Themida, VMProtect, Enigma), Anti-Debugging APIs, Anti-VM heuristics, and RDTSC timing traps.

Inputs: binary_path (required).

detect_crypto_primitivesA

Scans for AES S-Boxes, SHA/MD5 constants, CRC32 tables, RC4 loops, and ChaCha schedules for SMT inversion.

Inputs: binary_path (required).

dynamically_unpack_binaryA

Unicorn CPU emulation unpacker. Executes binary past packer stubs (UPX, Themida, crypters), detects OEP tail jumps, and dumps unpacked memory images.

Inputs: binary_path (required), max_instructions.

generate_frida_instrumentationB

Active reverse engineering intervention. Generates production-grade Frida dynamic instrumentation scripts for SSL unpinning, root/jailbreak cloaking, anti-debug runtime hooks, and dynamic crypto sniffing.

Inputs: target (required), platform, script_type, custom_filter.

hot_patch_live_memoryC

Injects atomic hot-patch memory trampolines into running processes without touching disk binaries.

Inputs: pid (required), memory_address (required), patch_bytes_hex (required), expected_original_bytes.

inspect_binary_layoutB

Scans PE/ELF headers, ASLR/DEP/SafeSEH mitigations, IAT/EAT exports, and measures Shannon entropy per section.

Inputs: binary_path (required).

neutralize_anti_debuggingA

Active reverse engineering intervention. Scans and neutralizes anti-debugging traps, PEB BeingDebugged checks, INT 2D/3 traps, and RDTSC timing checks. Automatically NOPs out traps on disk binary with PE checksum recalculation.

Inputs: binary_path (required), auto_patch, output_path.

optimize_large_media_bufferB

Solves agent memory/context exhaustion for oversized media (video/audio) and large binary dumps (> 50MB). Auto-downsamples videos to agent budget, isolates audio tracks for transcription, extracts keyframes, and provides mmap streaming.

Inputs: file_path (required), target_max_mb.

patch_binary_executableB

Active reverse engineering intervention. Surgical disk binary patcher with RVA-to-Raw conversion, PE/ELF section mapping, arbitrary hex byte modification, automatic backup creation, and PE checksum recalculation.

Inputs: patches (required), binary_path (required), output_path, create_backup, +1 more.

scan_byte_entropyA

Calculates rolling Shannon entropy heatmap across any binary (PE, ELF, APK, Mach-O). Detects packed/encrypted payloads and outputs visual distribution histograms.

Inputs: binary_path (required), block_size.

solve_branch_reachabilityB

Uses Z3 SMT Theorem Prover and angr to solve for exact concrete inputs reaching target branches while pruning failure paths.

Inputs: binary_path (required), target_address (required), input_length, avoid_addresses.

trace_binary_xrefsB

Traces whole-program call graph edges, indirect calls, resolved IAT/PLT stubs, and literal string cross-references (XREFs).

Inputs: binary_path (required).

trace_symbolic_taintB

Symbolic dataflow taint analysis proving whether attacker-controlled inputs propagate to dangerous memory sinks.

Inputs: binary_path (required), sink_symbol (required), source_symbol (required).

unflatten_control_flowC

Symbolically deobfuscates OLLVM Control-Flow Flattening (CFF) state dispatchers and reconstructs clean linear basic blocks.

Inputs: binary_path (required), function_address (required), timeout_seconds.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.5/5.0

Scored 2026-10-31 05:45 across 20 tools

Disambiguation4/5

Most tools target clearly distinct reverse-engineering actions, such as static decompilation, symbolic solving, probing entropy, unpacking, and mobile package analysis. Some overlap exists among active patching tools (patch_binary_executable, hot_patch_live_memory, neutralize_anti_debugging, bypass_license_authorization), but their descriptions distinguish disk, live-memory, anti-debug, and licensing scopes.

Naming Consistency5/5

All tools use snake_case and begin with an action-oriented verb or verb phrase, e.g. decompile_*, detect_*, trace_*, scan_*, patch_*. Minor modifier phrases like dynamically_unpack_binary and hot_patch_live_memory are still readable and consistent within the overall convention.

Tool Count4/5

Twenty tools is slightly heavy, but the breadth of binary analysis, decompilation, dynamic instrumentation, patching, unpacking, and mobile/desktop coverage justifies most of them. A few capabilities are specialized enough that consolidation could reduce overlap, but the set is not bloated for a reverse-engineering suite.

Completeness5/5

The surface covers static analysis, decompilation, entropy/protection detection, symbolic execution, taint tracing, anti-debug neutralization, binary patching, live memory patching, Frida instrumentation, unpacking, and iOS/Android decompilation. It addresses both analysis and active intervention workflows, leaving no obvious major gap for the stated domain.

Maintenance

ActivityMaintained

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

ByteRay AIA
ai.byteray
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Penetration Testing Code Analysis
2
https://mcp.byteray.ai/mcp
icme-preflightA
io.github.wyattbenno777
Jailbreak-proof AI guardrails. Automated Reasoning SMT solver, not an LLM. ZK proofs included.
AI & Machine Learning Security
142
https://api.icme.io/mcp
injection-detectorA
io.github.viridis-security
Formally-verified injection/exfiltration detector for AI agents (MCP-02).
Security Penetration Testing
22
https://mcp.viridis-security.com/mcp
Diogenes Agent Guardrails & Sandbox MCPA
io.github.stand-out-of-my-sun
Autonomous agent guardrails, bash sandboxing, MCP rugpull diffing & prompt firewalls.
Autonomous Agents Security Shell Access
1212
https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails

Related MCP Servers

KadeMCP
Penetration Testing Autonomous Agents
orgito1015
A
license
Not graded
quality
C
maintenance
Enables AI agents to solve CTF challenges through natural language by disassembling binaries, cracking hashes, fuzzing web applications, extracting steganography, and running pwntools exploits.
Updated 2 months ago (2026-09-06 22:09 UTC)
1
MIT
Antardrishti
Code Analysis Developer Tools
divyanshu-iitian
A
license
Not graded
quality
C
maintenance
Enables AI agents to locally analyze and reverse engineer binaries through a compact 12-tool MCP interface for triage, function discovery, disassembly/decompilation, cross-references, strings/imports, call graphs, memory reads, annotations, and binary diffs.
Updated a month ago (2026-10-17 12:15 UTC)
1
MIT
ghidra-mcp
Code Analysis Penetration Testing
Jorge4748
F
license
Not graded
quality
A
maintenance
Enables AI agents to import, disassemble, and debug binaries directly so they can perform cross-reference reasoning, rename stripped functions, and recover structure layouts during native reverse-engineering workflows. It integrates with offline ELF reconnaissance output to support symbol and struct recovery without opening the Ghidra GUI.
Updated a month ago (2026-10-17 07:03 UTC)
-
toothpick
Code Analysis Developer Tools Security
walkthestars
A
license
Not graded
quality
C
maintenance
Enables AI coding agents to inspect and reverse-engineer large binaries through bounded stdio JSON-RPC 2.0 tools for graph queries, SSA facts, path solving, runtime grounding, and mod scaffolding.
Updated 25 days ago (2026-10-19 16:42 UTC)
1
AGPL 3.0

One MCP server for symbolic execution, OLLVM unflattening, and active binary intervention across binaries and runtimes.

📑 Table of Contents (Mục Lục)

⚡ What is SYMB?

⚔️ Architectural Comparison: SYMB vs REA

🛠️ MCP Tool Reference (20 Native Tools)

⚔️ Active Binary Intervention Arsenal (5 Tools)

🔬 Symbolic Execution & SMT Solver Engines (3 Tools)

⚡ Multi-Platform Native Decompilers & Unpackers (4 Tools)

🔍 Deep Binary Auditing & Memory Engines (8 Tools)

📚 Documentation Hub & Architecture Guides (docs/)

💻 Standalone Command-Line Interface (CLI)

🧪 Testing & Rigorous Verification (100% Pass)

📦 Requirements & Environment

📄 License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

KadeMCP

Antardrishti

ghidra-mcp

toothpick

📚 Documentation Hub & Architecture Guides (`docs/`)