Zfinix/eleven

Eleven – an AI‑agent‑driven reverse‑engineering workstation

What it is – Eleven is a desktop application (macOS, Windows, Linux) that lets you load a binary, Android APK, GPU kernel, shader, or machine‑learning model and explore it with the help of large‑language‑model agents. The UI is built with React on the native GPUIX layer, while the heavy lifting of decompilation is delegated to existing tools (Ghidra, REA, Rizin, jadx, etc.).

How it works –

• You drop a file into Eleven. The appropriate backend (Ghidra + REA for native binaries, Rizin for fast loading, jadx for APKs, etc.) disassembles and produces pseudocode, assembly, control‑flow graphs, etc.
• Any agent that implements the Agent Client Protocol (ACP) can be attached (Claude, Gemini, Copilot, Cursor, OpenCode, etc.). The agent receives the decompiled view, can issue commands (open a function, rename it, add a note, propose a byte‑patch) and returns its answer directly in the UI.
• All interactions are logged with author attribution, and every suggestion (renames, patches, rewrites) appears as an accept/decline card, keeping you in full control.

Key capabilities

• Agent‑first workflow – multiple agents can run side‑by‑side on the same project, each in its own chat pane.
• Rich code views – pseudocode, assembly, CFGs, cross‑references, strings, and hex for Mach‑O, ELF, PE binaries.
• Cross‑language rewrites – ask an agent to rewrite a function in C, Rust, Go, Swift, Python, TypeScript, Java, C# or Zig.
• Android support – APKs are opened with Java (jadx) and optionally smali (apktool), with resources and manifests displayed.
• GPU assets – CUDA/HIP fat binaries, Metal shaders, and ML model files (GGUF, safetensors, PyTorch, ONNX) can be inspected and linked to the code that loads them.
• Project management – a project bundles chats, renames, notes, patches, etc. into a single .eleven file that can be shared.
• Patching & diffing – edit bytes, generate patched copies, compare two builds function‑by‑function.
• Debugging – launch the binary under LLDB, set breakpoints on the currently viewed function, step and view locals.
• Playbooks – built‑in skills (first‑look, name‑functions, trace‑feature, network‑map) that any ACP‑compatible agent can invoke.
• Export – export pseudocode, assembly, or CFGs as PDFs; export Objective‑C class inventories.

Installation

• macOS 14+ (Apple Silicon) – one‑line script installs Eleven.app to /Applications and clears quarantine.
• Windows (x64) – PowerShell one‑liner runs the installer script.
• Linux (x64) – download the AppImage or tarball from the latest GitHub release.
• The first launch walks you through selecting an LLM engine and installs missing dependencies (Rizin, Ghidra 12 + Java 21, ACP adapters, optional jadx/apktool).

Building from source

• Requires Bun, Node 20+, a JDK, Ghidra, and the companion REA repository (../rea or ELEVEN_REA).
• Typical workflow: bun install → bun run dev [file] for hot‑reload development, ./script/bundle‑macos|windows|linux to produce native bundles, and ./script/package for signed releases.

Configuration – optional environment variables let you point Eleven at custom installations of Ghidra, Java, REA, Rizin, jadx, apktool, LLDB‑DAP, and directories for caches, projects, and exports.

Documentation – includes detailed MCP‑tool specs (what agents can do), built‑in playbooks, and an AGENTS.md that describes the internal agent‑interaction model.

License – Apache 2.0 (with third‑party notices for bundled tools).

---

Bottom line – Eleven is a full‑featured reverse‑engineering GUI that treats LLM agents as first‑class collaborators, letting you query, annotate, rewrite, and patch binaries while staying in control of every change.