Antardrishti · अन्तर्दृष्टि

Local reverse engineering for humans and AI agents.

PE · ELF · Mach-O · x86 · x64 · ARM64 · .NET IL

Quick start · REA comparison · Commands · हिन्दी · Contribute

Open a binary. Find its functions. Follow a string to the code that uses it. Read C-like pseudocode, save what you learn, and compare the next build—from a terminal or an MCP-connected agent.

Antardrishti brings its own analysis and decompilation pipeline. No IDA, Ghidra, Hopper, Java runtime, API key, or hosted model is required for the engine. Its two direct runtime dependencies are Capstone and LIEF.

Early alpha · v0.1.0. Pseudocode and inferred types are analysis aids. Check disassembly and warnings before relying on a conclusion. See limitations.

Why the name?

Antardrishti (अन्तर्दृष्टि) is a Sanskrit-derived word used in Hindi for inner insight: looking beneath the surface to understand what is happening within. That is the job of a reverse engineering tool. Pronounced roughly an-tar-drish-ti.

Related MCP server: RE-MCP Server

Quick start

Requires Python 3.10+. Install from this repository; a PyPI release is not currently provided.

git clone https://github.com/divyanshu-iitian/antardrishti.git
cd antardrishti
python -m venv .venv

Activate the environment:

# Linux / macOS
source .venv/bin/activate

# Windows PowerShell
.\.venv\Scripts\Activate.ps1

Then install and try the included fixtures. You do not need a compiler to run them.

python -m pip install -e .
antardrishti --version
antardrishti brief tests/fixtures/sample32.exe
antardrishti info tests/fixtures/sample32.exe
antardrishti decompile tests/fixtures/sample32.exe _crc32_compute
antardrishti report tests/fixtures/sample32.exe -o analysis.html

If activation is unavailable, use .venv/Scripts/python.exe on Windows or .venv/bin/python on Unix with -m pip and -m antardrishti.

A small investigation

Not sure where to start? Run antardrishti brief FILE. It explains what stands out, separates static indicators from observed behavior, and suggests commands that point to discovered functions. It prioritizes application entry points, referenced strings and algorithm indicators before falling back to complex code. No model, API key or network access is needed.

The same investigation guide appears in HTML reports and MCP triage. Reports link suggested functions directly to included code, show decompiler warnings, support native and .NET methods, and make export limits explicit. Search by name, address or text; press Escape to clear a filter. Reports remain standalone and work offline.

# Hashes, entropy, imports, hardening checks and algorithm indicators.
antardrishti triage tests/fixtures/sample32.exe

# Follow a string to the functions that use it.
antardrishti trace tests/fixtures/sample32.exe crc=

# Inspect pseudocode and save your understanding across sessions.
antardrishti decompile tests/fixtures/sample32.exe _crc32_compute
antardrishti annotate tests/fixtures/sample32.exe _crc32_compute --comment "CRC-32 checksum routine"

# Export facts as JSON or a standalone report.
antardrishti funcs tests/fixtures/sample32.exe --json
antardrishti report tests/fixtures/sample32.exe -o analysis.html

See a captured demo for actual output from the included fixture.

Why Antardrishti?

The engine reads local files and does not execute the target. Connecting it to an AI client gives that client access to analysis results; the client's own data handling still applies.

Antardrishti vs REA

REA is a broader reverse engineering orchestration project. Antardrishti is a better fit when your priority is self-contained static binary analysis with a compact agent interface.

The REA column is based on its README at fe7bcc3, reviewed on 16 October 2026. REA also documents offline objdump/Rizin paths and built-in metadata readers. The external-engine requirement here refers to deep native decompilation, not every REA feature.

This compares architecture and setup, not decompilation accuracy or speed. See evidence and reproduction. Antardrishti is independent of REA and is not affiliated with its maintainers.

Connect your AI agent

antardrishti mcp-config

This prints configuration using your current Python executable. Paste it into your client's MCP settings. For clients using the mcpServers format:

{
  "mcpServers": {
    "antardrishti": {
      "command": "/absolute/path/to/.venv/bin/python",
      "args": ["-m", "antardrishti", "mcp"]
    }
  }
}

On Windows, use an absolute executable path such as C:/tools/antardrishti/.venv/Scripts/python.exe. Clients with another settings format can register the same command and arguments. MCP uses stdio; no HTTP server is started.

Tools: triage, list_functions, get_function, xrefs, list_strings, list_imports, trace_feature, call_graph, search, read_memory, annotate, diff_binaries.

Each tool accepts the target path directly. Results are paginated and capped at 24,000 characters by default (ANTARDRISHTI_MCP_MAX_CHARS). Input schemas avoid $ref, const, oneOf and anyOf; tests enforce catalog constraints. Verify client interoperability in your environment.

For a shorter first response, call triage with brief: true. This returns the overview, evidence-led findings, suggested next steps and caveats without the full section/string tables. Omit it for the detailed report; the catalog stays at 12 tools. Suggested steps use CLI command names and references; agents can map fn to get_function and funcs to list_functions.

Try asking your agent:

Analyze /absolute/path/to/sample32.exe. Start with triage, trace the string crc=, inspect matching functions, and explain the logic with addresses and uncertainty. Save useful names and comments.

Command reference

Prefix commands with antardrishti. REF accepts a function name or address; managed methods also accept qualified names and method tokens. Most analysis commands accept --json; use COMMAND --help for exact options. Raw code supports --arch x64 --base 0x1000; universal Mach-O supports --slice arm64.

Cache and annotations live in ~/.antardrishti/antardrishti.db. Override with ANTARDRISHTI_HOME. Use --no-cache to reanalyze a target.

Supported analysis

• Formats: PE, ELF, Mach-O (including universal slices), raw code, and managed PE/.NET IL.

• Native pseudocode: x86, x64 and ARM64; branches, loops, switches, arguments, expression simplification and basic type/structure inference.

• Other architectures: disassembly and analysis paths for ARM, MIPS, PowerPC, RISC-V and SPARC; coverage depends on instructions and format.

• Discovery: symbols, exports, entry points, unwind/function metadata, recursive calls, thunks, jump tables and prologue scanning.

• Triage: hashes, import features, entropy, compiler/runtime indicators, packing indicators, hardening and known algorithm constants.

• Signatures: bundled musl x64/ARM64 packs, library/archive pack building, and learning from named functions. See notices.

Architecture

flowchart LR
    A[PE / ELF / Mach-O / raw / .NET] --> B[Load and discover]
    B --> C[Functions, CFGs, references]
    C --> D[Lift, simplify, structure, infer types]
    C --> E[Triage, search, trace, diff]
    D --> F[Session API + SQLite]
    E --> F
    F --> G[CLI]
    F --> H[12-tool MCP server]
    F --> I[HTML report]

Start with project.py for the shared API, analysis.py for discovery, and decompiler/ for pseudocode generation.

Development and validation

python -m pip install -e ".[dev]"
python -m pytest -q
python scripts/measure_mcp.py python -m antardrishti mcp

Tests use included PE/ELF/Mach-O/.NET binaries and generated tiny ELF fixtures. Coverage includes native analysis, pseudocode, signatures, search, annotations, diffing, CLI, reports and MCP contracts. Fixture sources and rebuild instructions are in tests/fixtures/. The CI matrix exercises Windows, Linux and macOS; check its actual status above. See captured validation.

Limitations

• Early static analyzer: pseudocode is reconstructed, not original source, and may be incomplete or incorrect.

• Type/structure recovery is heuristic. Indirect branches, obfuscation, unusual calling conventions and optimized code can lose information or leave gotos.

• ARM64 and .NET paths have narrower validation than mature dedicated decompilers. Other advertised disassembly architectures have no native pseudocode lifter.

• Packing/algorithm indicators are clues, not proof of malicious behavior or cryptographic use. Packed code is not automatically unpacked.

• No debugger, live instrumentation, JavaScript/Electron, JVM/DEX, website or packet-capture analysis.

• Large targets may take substantial time and memory. No comparative speed or accuracy benchmark is published here.

• Dependency wheel availability varies by Python/OS/CPU combination.

Roadmap

• Broaden compiler and optimization fixture coverage.

• Improve native/managed control-flow recovery and inferred types.

• Expand redistributable library signatures with provenance and regression cases.

• Add reproducible accuracy/performance benchmarks against ground truth.

• Explore optional external decompiler providers for deeper investigations.

Contributing

Small, reproducible cases make the engine better. Source, compiler flags, expected behavior and observed output are especially useful. Read CONTRIBUTING.md, security reporting, and third-party notices.

If this helps your work, star the repository and share a reproducible investigation. Launch copy is included for sharing the project.

License

MIT. Built with Capstone and LIEF. Bundled musl-derived signatures retain upstream attribution. Use the tool for software you own or are authorized to examine.