Skip to main content
Glama
drvcvt
by drvcvt

solve_crackme

Automatically solves crackme binaries by extracting constraints, mapping success and failure paths, and brute-forcing input characters with ESIL emulation.

Instructions

Automatically attempt to solve a crackme by extracting constraints, identifying success/fail paths, and brute-forcing input character by character using ESIL emulation.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
addressNoHex address of the check function
charsetNoCharacter set to brute-forceprintable
binary_pathYesAbsolute path to the binary file
input_lengthNoMaximum input length to try
function_nameNoCheck/validation function name
input_addressNoMemory address where input is stored (auto-detected if omitted)
max_steps_per_charNoMax ESIL steps per character attempt

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does disclose the core behavior: extracting constraints, identifying paths, and brute-forcing through ESIL emulation. However, it does not mention side effects, what happens on success or failure, runtime costs, or whether the binary is executed natively or only emulated, leaving meaningful gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence that front-loads the primary purpose and then describes the method without filler. Every clause contributes useful information, and it does not repeat schema details or annotation data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 7-parameter tool with no output schema and no annotations, the description covers the high-level strategy but omits important operational details such as what the tool returns, failure modes, timeouts, and whether it modifies the binary. The comprehensive parameter schema compensates somewhat, but the missing return/behavior contract makes it only partially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all seven parameters are already documented with descriptions, enums, defaults, and constraints. The tool description adds no parameter-specific meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('solve a crackme') with a clear resource and method: extracting constraints, identifying success/fail paths, and brute-forcing character by character via ESIL emulation. This clearly distinguishes it from sibling tools like find_constraints, esil_run, or analyze_binary, which are lower-level or partial operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrasing 'Automatically attempt to solve a crackme' gives clear context for when this tool is appropriate: when the goal is full automated solving rather than manual reverse engineering. It does not explicitly name alternatives or exclusion cases, but the high-level 'automatically solve' intent is clear relative to the more granular sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.