Skip to main content
Glama

batch_decrypt_strings

Decrypt obfuscated strings in binaries by emulating the target decryption function at each call site and extracting the plaintext results, aiding reverse engineering and deobfuscation.

Instructions

[Binary/reverse-engineering tool. Use when: disassembly, radare2, r2, debugging, vulnerability research, ELF/PE/SO/DEX analysis.] 【r2ai逆向工具】🔐 [批量解密] 批量解密字符串,批量模拟执行并提取结果。专为对抗混淆 (OLLVM) 和自定义算法设计。 核心能力:

  1. 自动定位函数引用点,批量回溯模拟。

  2. 支持所有架构:通过 instr_sizeresult_reg 适配 ARM64/ARM32/x86。

  3. 解决栈传参:通过 custom_init 注入指令 (如 'wv 0x10 @ 0x178004') 手动修补堆栈。

  4. 解决内存布局:通过 map_size 扩大内存映射范围。 注意:仅适用于纯算法函数,无法模拟 malloc/JNI 等外部系统调用。 【触发场景】当用户询问二进制逆向分析、反汇编、漏洞挖掘、radare2命令执行、调试相关问题时,必须优先调用此工具。 【使用规则】调用前必须确认用户提供了目标文件的绝对路径,禁止捏造不存在的文件路径或命令结果,session_id 不再使用时必须关闭。

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
map_sizeNo模拟器内存映射大小。如 果算法引用了远处的数据段,请调大此值。默认为 '0x40000' (256KB)。0x40000
pre_stepsNo向前回溯的指令条数,用于让 CPU 执行参数准备逻辑。默认为 30。
instr_sizeNo指令平均字节数。用于计算回溯地址。ARM64=4, ARM32=4(或2), x86=变长(可填平均值3)。默认为 4。
result_regNo存放结果字符串指针的寄存器。ARM64通常是'x0', ARM32是'r0', x86是'eax'。默认为 'x0'。x0
session_idYes会话 ID
custom_initNo【高级插槽】在模拟启动前执行的 R2 命令序列。用于手动初始化栈参数或全局变量。 示例 (x86栈传参): 'wv 0x1234 @ esp+4; wv 0x5678 @ esp+8' 示例 (填充全局变量): 'wx 0xff @ 0x80040'
func_addressYes目标解密函数的地址 (例如 '0x401000')

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.0.3

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does a good job: it discloses that the tool performs simulated batch execution, locates function references, patches stack/init state, and cannot handle external calls like malloc/JNI. It also warns about session cleanup, though it does not describe the return format or side effects on sessions in detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The bullet list and parameter examples are useful, but the opening tags, repeated '批量解密', and a trigger paragraph that largely repeats the opening make it less tight. It is not egregiously long, but it does not satisfy the zero-waste standard.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is fairly complete for a complex 7-parameter, no-output-schema tool: it explains architecture adaptation, stack/memory issues, limitations, and path prerequisites. Gaps remain around what the batch result actually looks like and how session_id is created/closed beyond 'when no longer used'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all parameters (100% coverage), establishing baseline 3. The description adds value by explaining how instr_size/result_reg adapt to architectures, custom_init solves stack passing, and map_size addresses memory layout—linking parameters to concrete failure modes beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The core purpose is clear: batch-decrypt strings by emulative/backtracking execution, aimed at OLLVM and custom algorithms. It does not name a sibling such as simulate_execution or r2_list_strings to distinguish itself, and the opening 'Use when: disassembly, radare2...' broadens the purpose beyond what this specialized tool does, which lowers it from 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The trigger statement says it 'must' be prioritized for any binary/RE/radare2/debugging question, which is not reliable guidance and would over-select this tool relative to r2_disassemble and r2_run_command. The 'pure algorithm only' and 'cannot simulate malloc/JNI' notes are useful exclusions, but no alternative tool is mentioned and the when-to-use guidance is misleadingly broad.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.