JusticeRage/Gepetto

What it solves

Reverse engineering decompiled code is often a tedious process of manually renaming variables and adding comments to understand what a function does. Gepetto automates this by using large language models (LLMs) to analyze and explain the logic of functions decompiled by IDA Pro.

How it works

As a Python plugin for IDA Pro, Gepetto sends the decompiled pseudocode of a function to a chosen LLM provider. The model then analyzes the code and returns suggestions for variable renaming and functional explanations, which the plugin then applies to the IDA environment.

Who it’s for

Security researchers, malware analysts, and reverse engineers who use IDA Pro (version 7.6 or higher) and the Hex-Rays decompiler.

Highlights

• Broad Model Support: Integrates with a wide range of providers including OpenAI, Anthropic, Google Gemini, Azure, Ollama, Groq, Together, Novita AI, and Kluster.ai.
• Coded-in-place Improvements: Provides hotkeys for explaining functions, adding comments, and requesting better variable names.
• Extensible Provider System: Allows users to add their own custom LLM providers via Python scripts or distribution entry points.
• CLI Interface: Includes a built-in CLI within IDA to ask the LLM direct questions about the code.
• Local LLM Support: Compatible with local model runners like Ollama and LM Studio.