SYMB
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dynamically_unpack_binaryA | Unicorn CPU emulation unpacker. Executes binary past packer stubs (UPX, Themida, crypters), detects OEP tail jumps, and dumps unpacked memory images. |
| optimize_large_media_bufferB | Solves agent memory/context exhaustion for oversized media (video/audio) and large binary dumps (> 50MB). Auto-downsamples videos to agent budget, isolates audio tracks for transcription, extracts keyframes, and provides mmap streaming. |
| scan_byte_entropyA | Calculates rolling Shannon entropy heatmap across any binary (PE, ELF, APK, Mach-O). Detects packed/encrypted payloads and outputs visual distribution histograms. |
| trace_binary_xrefsB | Traces whole-program call graph edges, indirect calls, resolved IAT/PLT stubs, and literal string cross-references (XREFs). |
| decompile_ios_ipa_packageA | Decompiles Apple iOS IPA packages (.ipa) and ARM64 Mach-O executables. Audits FairPlay DRM (cryptid), Anti-Jailbreak heuristics, and reconstructs Objective-C / Swift interfaces. |
| decompile_apk_packageB | 5-Pass native Dalvik DEX decompiler. Audits permissions, keystore signature schemes (v1/v2/v3), CWE vulnerabilities, hardcoded secrets, and lifts Dalvik bytecode to Java classes. |
| decrypt_obfuscated_stringsA | Automated string decryptor across raw binary sections. Recovers Single-byte XOR, Multi-byte cycling XOR, and Additive Rolling-Key XOR encrypted strings. |
| decompile_native_functionB | High-speed machine code decompiler (< 400ms). Lifts x86/x64/ARM assembly into clean C pseudocode with branch conditions, string references, and IAT/PLT stub resolution. |
| decompile_entire_programB | Whole-program C decompiler. Discovers function entry points and generates unified, compilable C source files with forward declarations. |
| detect_binary_protectionsC | Detects commercial packers (UPX, Themida, VMProtect, Enigma), Anti-Debugging APIs, Anti-VM heuristics, and RDTSC timing traps. |
| inspect_binary_layoutB | Scans PE/ELF headers, ASLR/DEP/SafeSEH mitigations, IAT/EAT exports, and measures Shannon entropy per section. |
| detect_crypto_primitivesA | Scans for AES S-Boxes, SHA/MD5 constants, CRC32 tables, RC4 loops, and ChaCha schedules for SMT inversion. |
| unflatten_control_flowC | Symbolically deobfuscates OLLVM Control-Flow Flattening (CFF) state dispatchers and reconstructs clean linear basic blocks. |
| solve_branch_reachabilityB | Uses Z3 SMT Theorem Prover and angr to solve for exact concrete inputs reaching target branches while pruning failure paths. |
| trace_symbolic_taintB | Symbolic dataflow taint analysis proving whether attacker-controlled inputs propagate to dangerous memory sinks. |
| hot_patch_live_memoryC | Injects atomic hot-patch memory trampolines into running processes without touching disk binaries. |
| neutralize_anti_debuggingA | Active reverse engineering intervention. Scans and neutralizes anti-debugging traps, PEB BeingDebugged checks, INT 2D/3 traps, and RDTSC timing checks. Automatically NOPs out traps on disk binary with PE checksum recalculation. |
| bypass_license_authorizationB | Active reverse engineering intervention. Detects authorization/license validation branches, computes conditional jump inversions, and applies permanent binary bypass patches on disk. |
| generate_frida_instrumentationB | Active reverse engineering intervention. Generates production-grade Frida dynamic instrumentation scripts for SSL unpinning, root/jailbreak cloaking, anti-debug runtime hooks, and dynamic crypto sniffing. |
| patch_binary_executableB | Active reverse engineering intervention. Surgical disk binary patcher with RVA-to-Raw conversion, PE/ELF section mapping, arbitrary hex byte modification, automatic backup creation, and PE checksum recalculation. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 20 tools
Most tools target clearly distinct reverse-engineering actions, such as static decompilation, symbolic solving, probing entropy, unpacking, and mobile package analysis. Some overlap exists among active patching tools (patch_binary_executable, hot_patch_live_memory, neutralize_anti_debugging, bypass_license_authorization), but their descriptions distinguish disk, live-memory, anti-debug, and licensing scopes.
All tools use snake_case and begin with an action-oriented verb or verb phrase, e.g. decompile_*, detect_*, trace_*, scan_*, patch_*. Minor modifier phrases like dynamically_unpack_binary and hot_patch_live_memory are still readable and consistent within the overall convention.
Twenty tools is slightly heavy, but the breadth of binary analysis, decompilation, dynamic instrumentation, patching, unpacking, and mobile/desktop coverage justifies most of them. A few capabilities are specialized enough that consolidation could reduce overlap, but the set is not bloated for a reverse-engineering suite.
The surface covers static analysis, decompilation, entropy/protection detection, symbolic execution, taint tracing, anti-debug neutralization, binary patching, live memory patching, Frida instrumentation, unpacking, and iOS/Android decompilation. It addresses both analysis and active intervention workflows, leaving no obvious major gap for the stated domain.