Reverse engineering framework with disassembly, decompilation, taint analysis, version diffing and semantic search, plus LLM-driven autonomous binary and firmware analysis.
Ablation is a self-contained reverse engineering framework.
It depends on neither legacy tools nor an MCP server, which removes the attack surface associated with MCP.
When used with Codex or Claude Code, it operates as an autonomous reverse engineering system.
cd ~/ablation && claude
/model claude-sonnet-4-6
or
/model claude-sonnet-4-5
/goal reverse engineer [whatever you want]
Not sure what effort level to be set on? Ask inline without interrupting the main context:
/btw What effort level should we be set on right now?
/config)Auto-compact true
Continue automatically at usage limit true
Switch models when a message is flagged Switch automatically
Show tips false
Claude-drafted feedback off
Reduce motion false
Thinking mode true
Fast mode (Opus 5.5) false
Prompt suggestions true
Session recap true
Rewind code (checkpoints) true
Dynamic workflows true
Ultracode keyword trigger false
Dynamic workflow size unrestricted
Artifacts false
Verbose output true
Terminal progress bar true
Show turn duration true
Time format auto
Default permission mode Manual
Worktree base ref fresh
Use auto mode during plan true
Respect .gitignore in file picker true
Skip the /copy picker false
Copy on select true
Auto-scroll true
Open agents view by default false
← opens agents false
Auto-update channel disabled (config)
Theme Dark mode (colorblind-friendly)
Local notifications Auto
Push when actions required true
Push when Claude decides true
Output style Explanatory
Language Default (English)
Editor mode normal
Question auto-continue timeout never
Show last response in external editor true
Show PR status footer true
Model claude-sonnet-4-6
Auto-connect to IDE (external terminal) true
Claude in Chrome enabled by default true
Enable Remote Control for all sessions false
Dialog expiry never
Messages from your other sessions accept
| Capability | Code | |
|---|---|---|
| On-Demand Analysis | 1 | Cached binary context and targeted function analysis; retain symbols, imports, cross-references and analyst names between sessions. |
| Binary Lifting | 1 | Native instructions to pseudo-C using architecture-specific register state and calling conventions; support varies by backend. |
| Semantic Code Search | 1 | Search functions by behavioral descriptions; normalize assembly, embed descriptions and rank semantic similarity. |
| Hypothesis Engine | 1 | Persist competing explanations, collect evidence, rank probes and update confidence. |
| DAG Adapter Language | 1 | Define fixed-width instruction bitfields, round-trip encodings, semantic operations and dataflow edges through EncodingDAG. |
| Entropy Mapper | 1 | Sliding-window Shannon entropy, region classification and transition detection to guide unpacking and analysis. |
| Capability | Code | |
|---|---|---|
| The Flywheel | 1 2 | Replay stored confirmed finding descriptions and successful semantic queries against later binaries. |
| Cross-Target Learning | 1 2 | Persist transferable finding descriptions, embeddings and search patterns for reuse across products and vendors. |
| KASAN-Oracle | 1 | Workflow for deriving candidates from instrumented/debug builds and checking corresponding production code; includes instrumentation-aware decoding. |