Provides Delphi-aware reverse engineering capabilities, including mapping published-method RTTI names to code RVAs, Delphi unit/class inventories, and DFM triage for Delphi applications.
Provides tools for .NET assembly analysis via ILSpy, including .NET type inventory and decompilation of specific .NET types.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ih8sn1ff Launch sample.exe, dump live memory, rebuild the PE, and decompile with Ghidra."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Repository: https://github.com/ih8w1nd/ih8sn1ff
Agent-first reverse-engineering toolkit with a native MCP server and a matching CLI. Built for the workflow that actually cracks modern protected binaries: run → dump → rebuild → analyze → decompile, with every step scriptable and every result LLM-friendly.
run_and_dump → rebuild_pe → trim_pe → delphi_methods → ghidra_decompile
│ │ │ │ │
process memory→file analysis-sized RTTI name→RVA C pseudo-code
modules aligned PE PE for Ghidra (Delphi apps)MCP-native. Every capability is exposed as an MCP tool, so an agent (Claude, or any MCP host) drives the analysis loop directly: scan strings, find xrefs, decompile, dump the live process, re-scan.
Actually practical on packed binaries. VMProtect- / Themida-class wrappers are beaten at runtime, not statically. ih8Sn1ff ships the operational chain used for that: elevated module dumping, memory-image → file-aligned PE rebuild, analysis-sized PE trimming, per-function "decrypt-on-execute" workflows.
Delphi-aware. Most commercial RE targets in this space are Delphi; ih8Sn1ff maps
published-method RTTI name → code RVA in one call — the trick that turns a
500 MB mystery dump into a navigable program.
Live debugging without plugins. Launch Windows targets (x64 or WOW64 x86)
under a built-in debugger, set software breakpoints, read registers and memory,
dump modules at a stop, and continue — as MCP calls or ih8sn1ff dbg shell
commands.
Deterministic and auditable. Plain Python, no hidden services. Every tool returns bounds-checked, explicitly-limited results (offsets, digests, counts).
It does not replace Ghidra — it orchestrates it. Deep static analysis stays in Ghidra (headless scripts included). For dynamic work ih8Sn1ff ships its own x64 debugger for scripted sessions; x64dbg remains better for manual GUI exploring.
Related MCP server: REA
The file is a suggestion. Memory is the confession.
A loader is a promise; a dump is a receipt. When the two disagree, trust the one that actually executed.
on-disk image live memory analysis image
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ encrypted │ │ decrypted │ │ readable │
│ sections │ ───▶ │ modules │ ───▶ │ functions │
└──────────────┘ └──────────────┘ └──────────────┘
loader dump rebuildField notes:
Run it before you trust it. The static view is a proposal; execution is the vote.
Strings lie. References rarely do. Follow the pointer, not the marketing copy.
First execution decrypts more than any static pass. Stimulate the feature, then dump again.
If it decrypted once, it will decrypt again. Reproduce the inputs, not just the bytes.
Patch only what you can restore. Keep a clean copy and a log of every byte you touch.
The function you need is always one xref deeper.
Nothing is unreachable once you find the indirect call table.
halt_baddata is not a suggestion; it is a dare.
The bug is never in the compiler. Except that one time, and it was your code anyway.
A stack trace is just the program admitting where it gave up.
Every obfuscator is a love letter to the next analyst.
The ih8 prefix follows the author's handle ih8w1nd; sn1ff is for the part
of reversing that feels like packet sniffing: watching what a program actually
does instead of what it claims. The 1 is not negotiable.
pip install ih8sn1ff # core: capstone + pefile
pip install ih8sn1ff[elf] # + ELF metadata (pyelftools)
pip install ih8sn1ff[emu] # + Unicorn emulation
pip install ih8sn1ff[yara] # + YARA (bundled packer/anti-debug rules)
pip install ih8sn1ff[all] # everything optionalUntil the package is published, install from a checkout:
pip install -e ".[dev,elf]"External engines (optional, auto-detected):
Engine | Enable with |
Ghidra 12.x |
|
.NET decompiler |
|
x64dbg | optional manual sessions; the built-in x64 debugger needs no extra engine |
Register the stdio server (Claude Code example, .mcp.json):
{
"mcpServers": {
"ih8sn1ff": {
"command": "ih8sn1ff-mcp",
"env": { "GHIDRA_INSTALL_DIR": "C:/tools/ghidra_12.1.4_PUBLIC" }
}
}
}Full setup for Claude Code, Claude Desktop, Cursor and uv lives in docs/MCP-SETUP.md. One-liner for Claude Code:
claude mcp add ih8sn1ff -e GHIDRA_INSTALL_DIR=C:/tools/ghidra_12.1.4_PUBLIC -- ih8sn1ff-mcpThen ask the agent:
Dump the modules of PID 7123, rebuild a file-aligned PE, trim it for analysis, map Delphi published methods, and decompile everything that references
KSTRINGB.
ih8sn1ff info sample.exe
ih8sn1ff strings sample.exe --regex "AT\\+" --min-len 6
ih8sn1ff entropy sample.exe --window 1M
ih8sn1ff dump 7123 --out dumps/ --include-main
ih8sn1ff rebuild dumps/00_main.exe.bin -o out/rebuilt.exe
ih8sn1ff trim out/rebuilt.exe -o out/trimmed.exe --scratch-prefix-end 0x1A00000
ih8sn1ff delphi out/main.bin --names-file names.txt
ih8sn1ff disasm out/main.bin --addr 0x163a454 --count 80
ih8sn1ff xrefs out/main.bin --string "KSTRINGB"
ih8sn1ff ghidra import out/trimmed.exe --project out/ghidra_proj
ih8sn1ff ghidra decompile out/ghidra_proj --rva 0x163a454 --rva 0x165103c
ih8sn1ff imports dumps/00_main.exe.bin -o out/rebuilt.exe --meta dumps/dump_meta.json
ih8sn1ff xrefs-rip out/trimmed.exe --string "KSTRINGB"
ih8sn1ff callgraph out/trimmed.exe --root 0x163a454 --depth 2
ih8sn1ff emulate out/trimmed.exe --entry 0x163a454 --max-instructions 500
ih8sn1ff dbg once C:/target/app.exe --dump out/entrydump
ih8sn1ff yara sample.exeSee docs/TOOLS.md for the full parameter/output reference. Highlights:
Tool | Purpose |
| format, arch, sections, entropy, compiler/linker markers |
| ASCII/UTF-16 strings with offsets, regex, min length |
| windowed entropy to separate code/data/packed regions |
| launch (elevated) and snapshot module images — the unpacking step |
| dump modules of an already-running PID |
| memory image → file-aligned PE (Scylla-style unmap) |
| analysis-sized PE for Ghidra (code sections + VA prefix) |
| published-method RTTI: |
| Capstone listing with inline string-ref annotations |
| absolute-immediate xrefs to strings/values inside code ranges |
| RIP-relative refs and direct-call graphs |
| bounded Unicorn trace at an entry RVA |
| live Windows sessions (x64 or WOW64 x86): breakpoints, registers, memory, module dumps |
| IAT/import directory rebuild from |
| journaled tool results with digests |
| headless import + auto-analysis into a project |
| decompile by RVA list or by string keywords |
| ILSpy type inventory / decompile |
| YARA scan; bundled packer/anti-debug rules by default |
docs/WORKFLOWS.md covers, step by step:
Unpacking VMProtect/Themida-class targets by runtime dumping (including the per-function encryption wrinkle — features must execute before their code decrypts).
Rebuilding PEs from memory images and rebuilding the IAT from dump_meta.json.
Delphi app triage: RTTI method tables, unit/class inventories, DFM islands.
Ghidra headless decompilation driven by strings, not symbol names.
Live x64 debugging and bounded emulation for decrypt-on-execute targets.
When to stop scripting and switch to manual x64dbg / Frida.
ih8w1nd is a reverse engineer and toolmaker who treats "impossible" as a scheduling problem. Has built firmware flashing and device-service systems from protocol captures, turned packed binaries into readable code, and convinced devices that "unsupported" was a temporary opinion. ih8Sn1ff exists because the available tools were not fast, honest, or strange enough.
GitHub: @ih8w1nd
Track record: protocol captures turned into working flashing pipelines; packed binaries turned into readable code; "unsupported" devices turned into success logs.
Approach: ask the binary politely, then open a debugger.
House motto: "The file is a suggestion. Memory is the confession."
ih8Sn1ff is a dual-use engineering toolkit for authorized reverse engineering: malware analysis, interoperability, security research, CTFs, and software you own or are licensed to inspect. Do not use it to bypass licensing, DRM, or access controls on systems you do not own. The authors take no responsibility for misuse.
v0.3 — 35 MCP tools: runtime dump + PE/IAT rebuild, live debugger (x64 and
WOW64 x86), Unicorn emulation, Delphi RTTI, Ghidra headless, .NET, YARA,
evidence journal. The ih8sn1ff name was available on PyPI on 2026-10-19
(HTTP 404); publishing still needs the owner's token. Known limits: import
rebuild is experimental on heavily obfuscated/hooked IATs; VMProtect/Themida
devirtualization is not automated (the runtime-dump workflow is).
Contributions welcome; see CONTRIBUTING.md.
PE/ELF metadata: arch, image base, entry RVA, sections, entropy, packer hints.
Inputs: path (required).
Breadth-first direct-call graph from an RVA/VA (indirect calls unresolved).
Inputs: path (required), root (required), depth, layout, +1 more.
Add a software breakpoint by absolute VA or module + RVA.
Inputs: session_id (required), va, rva, module.
Remove a breakpoint and restore the original byte.
Inputs: address (required), session_id (required).
Terminate the target (if alive) and release the debug session.
Inputs: session_id (required).
Resume a debug session and wait for the next stop or timeout.
Inputs: session_id (required), timeout_ms.
Dump module images of the stopped process (dump offset == RVA).
Inputs: session_id (required), outdir.
Launch a Windows target (x64 or WOW64 x86) under the debugger; specs 'module:0xRVA' or '0xVA'.
Inputs: exe (required), args, timeout_ms, breakpoints, +1 more.
Read target memory (hex) at an absolute address.
Inputs: address (required), session_id (required), size.
Read x64 general-purpose registers of the last stopped thread.
Inputs: session_id (required).
Return the debug session summary without touching the target.
Inputs: session_id (required).
Write bytes (hex string) into target memory.
Inputs: address (required), data_hex (required), session_id (required).
Map Delphi published-method names to code RVAs.
Inputs: dump_path (required), names, names_file, max_occurrences.
Frequency-ranked Delphi unit (a.b.c) and TClass inventory.
Inputs: dump_path (required), top.
Capstone x86/x64 listing at addr (hex string). base: file or rva.
Inputs: addr (required), path (required), base, span, +1 more.
Decompile one managed type to C# via ilspycmd.
Inputs: asm (required), type_name (required).
List types in a managed assembly via ilspycmd, optionally filtered.
Inputs: asm (required), limit, pattern.
Dump every module image of a running process; writes dump_meta.json.
Inputs: pid (required), outdir, skip_system, include_main.
Bounded Unicorn emulation in RVA space with an execution trace.
Inputs: path (required), entry, layout, trace_limit, +1 more.
Windowed Shannon entropy: packed/encrypted vs plaintext regions.
Inputs: path (required), step, window.
List journaled tool calls (newest first) with ids and digests.
Inputs: limit.
Read one full evidence record by id.
Inputs: evidence_id (required).
Carve embedded archives or PEs by signature (kind: zip, pe, gzip).
Inputs: path (required), kind, limit, outdir.
Decompile functions by RVA list and/or by string keywords.
Inputs: project (required), rvas, limit, program, +2 more.
List analyzed functions (address + name) from a Ghidra project.
Inputs: project (required), limit, program.
Headless Ghidra import into a project (analysis: full or none).
Inputs: binary (required), project (required), analysis, timeout_min.
Rebuild a dump's IAT/import directory from dump_meta.json module metadata.
Inputs: out (required), dump_meta (required), dump_path (required).
Rebuild a file-aligned PE from a runtime memory image (Scylla-style unmap).
Inputs: out (required), dump_path (required), image_base_guess.
Launch a target (optionally elevated), wait, dump all module images, terminate it.
Inputs: exe (required), outdir, wait_ms, elevated, +1 more.
Extract printable strings with file offsets. encoding: ascii, utf16, both.
Inputs: path (required), limit, regex, min_len, +1 more.
Shrink an unpacked PE for analysis: huge protector arenas keep only a prefix.
Inputs: out (required), rebuilt_path (required), entry_rva, scratch_prefix_end, +1 more.
Find absolute-immediate references to a value or string.
Inputs: path (required), limit, string, target.
Find RIP-relative memory refs and direct branches (RVA space; layout auto/dump/file).
Inputs: path (required), limit, layout, string, +1 more.
Alias for yara_scan with the bundled packer profiles.
Inputs: path (required), rules_file.
Run YARA rules; without rules_file the bundled packer/anti-debug pack is used.
Inputs: path (required), rules_file.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 35 tools
Each tool targets a distinct analysis action or resource, from static metadata (bin_info) to dynamic debugging (debug_*), decompilation (ghidra_*), and evidence journaling (evidence_*). Overlaps like yara_scan vs yara_pack are explicitly aliases, and the dump variants are scoped by context (run_and_dump, dump_process, debug_dump).
All names use snake_case, but the patterns vary: verb_noun (rebuild_pe), noun_noun (strings_scan), single words (disasm), and prefixed groups (debug_*, ghidra_*, dotnet_*). The grouping is consistent within subsystems, making the set readable despite not following one uniform convention.
With 35 tools, the set far exceeds the typical 3–15 range and crosses into heavy territory. While many tools have distinct purposes, several could be consolidated (e.g., debug operations into an action parameter, Ghidra operations into fewer endpoints), making the surface overwhelming.
The server covers a broad reverse-engineering lifecycle: static analysis, PE manipulation, dynamic debugging, decompilation, .NET, YARA, and evidence tracking. Minor gaps exist, such as no debug_attach for existing processes or a dedicated import table viewer, but agents can work around them with available tools.
Evidence-oriented REA + Ghidra static-analysis workflows, read-only PE32 and Delphi VMT tools.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Offline methodology engine for authorized penetration testing, CTF, and security research.
