v0.6.0

sleuthre v0.6.0

Open-source reverse engineering desktop application built from scratch in Rust.

What's new

Native debugger

• Register and memory writes — P / M packets honouring per-register width, with an editable register list and a hex write field in the memory inspector
• Step Into / Step Over / Step Out — call-aware step-over and return-address step-out via one-shot breakpoints; a working Stop button that interrupts a running inferior through a socket-sharing handle even while a blocking continue runs on a worker thread
• Module enumeration — shared libraries listed from the stub via qXfer:libraries-svr4
• Attach and local launch — attach to a PID, or launch a target locally (sleuthre spawns and owns a gdbserver child on Linux, reaped on disconnect/exit)
• Saved debug profiles — per-project launch/attach configs; sensitive launch args can be kept off disk, and attach PIDs are never persisted
• Source context — clickable backtrace frames (resolved to function names) and a file:line readout at the PC when debug info is present
• RSP decoding — run-length encoding and }-escapes are decoded, so register dumps and qXfer payloads are no longer truncated

Backward type inference

• Interprocedural type recovery — infers untyped functions' return and parameter types by following values across calls, built on a new IL substrate (arch-dispatched lifting, an ABI register model, MLIL call-effect modelling, and a def-use index)
• Fixpoint propagation — iterates until stable, resolving multi-hop call chains
• Provenance-aware — inferred signatures are tagged and shown as lower-confidence in the decompiler, and never override debug-info or user types

Disassembly & control flow

• Switch / jump-table recovery — indirect jmp [reg*scale + base] now produces Switch edges to recovered case targets (restricted to executable memory)
• Leader-based CFG — basic blocks are rebuilt so mid-block branch targets split correctly instead of producing overlapping blocks
• Calling-convention detection — stdcall via callee stack-cleanup, and Microsoft x64 vs SysV by binary format, detected in the pipeline and persisted per function

Architecture support

• RISC-V (rv32 / rv64) ELF loading
• Lifter coverage — MIPS addi / addiu and negative immediates (stack prologues), and ARM movs / muls / bics / lsls flag-setting forms now lift correctly; unhandled MIPS and RISC-V instructions surface as Unimplemented rather than being silently dropped

Project format & persistence

• More state persisted — binary architecture and format, image base, and each function's calling convention and stack-frame size are now saved and restored (reopened non-x86_64 projects no longer decode as x86_64)
• Schema versioning — a stamped project schema version is checked on load, rejecting files written by a newer, incompatible build

Dependencies

• Upgraded with API migrations — egui / eframe 0.33 → 0.34 and egui_dock 0.18 → 0.19 (unified Panel API, App::ui), gimli 0.31 → 0.33, rusqlite 0.33 → 0.40, plus goblin 0.10, capstone 0.14, object 0.39, petgraph 0.8, and rfd 0.17

Reliability & hardening

• Decompiler fidelity — fixed dead-store elimination that was deleting live code (it keyed on SSA versions the definition-only SSA pass never matched)
• PDB addresses — symbol offsets are mapped to virtual addresses via the PDB address map and image base instead of being used as raw section-relative offsets
• Untrusted-input safety — fixed an RSP stop-reply char-boundary panic and a PCX out-of-bounds index; capped image and segment allocations; bounded RSP packet size and thread-enumeration rounds against a hostile stub; validated TGA and segment inputs and capped the MCP get_disasm request count
• Fuzz-smoke harness — a deterministic no-panic sweep over the binary loader and image/archive decoders runs in the test suite

Tooling

• Background re-analysis — runs off the UI thread with a cancel button, quick / normal / deep mode presets, and command-palette actions
• Green quality gate — cargo fmt --check and cargo clippy --workspace -- -D warnings both pass

Full changelog: v0.4.0...v0.6.0

v0.4.0

sleuthre v0.4.0

Open-source reverse engineering desktop application built from scratch in Rust.

What's new

Native debugger

• GDB Remote Serial Protocol backend — connects to any gdbserver, qemu -gdb, rr, or lldb-server endpoint; software (Z0) and hardware (Z1) breakpoints, read / write / access watchpoints (Z2 / Z3 / Z4), register and memory access, step and continue
• Stop-reply parsing — extracts swbreak, hwbreak, watch / rwatch / awatch data addresses, signals, and thread IDs
• Multi-thread support — thread selector, per-thread register views, per-thread breakpoint scope toggle
• Debugger panel in the GUI — async continue/step so the UI never freezes, interrupt button, watch buttons, run-to-cursor from the decompiler and disassembly, disassembly context menu, auto-jump to PC on stop, and auto-clear of temporary breakpoints
• Watchpoint hit view — stop replies surface the faulting data address and auto-scroll the hex view to it

DWARF debug info

• Stack unwinder — .eh_frame + .debug_frame consumer with per-row register rules and frame-pointer fallback when CFI is absent or corrupt
• Source-line stepping — line-table aware step so stepping crosses statement boundaries, not individual instructions
• Location expression evaluator — public helper for .debug_loc / location-list consumers, handling RequiresRegister, RequiresMemory, and RequiresFrameBase callbacks
• PDB sidecar auto-detect — PE binaries probe the embedded PDB path, sibling directory, and <stem>.pdb fallback automatically

Decompiler

• Compilable C output — the pseudo-C now round-trips through a real C compiler on tested inputs
• Floating-point arithmetic — FAdd, FSub, FMul, FDiv rendered with native C operators
• Indirect calls — rendered through explicit function-pointer casts so the output stays valid C
• Recompile-diff harness — decompile → compile → diff semantics check for regression tests
• Cache dependency graph — renaming a callee or editing a type invalidates exactly the affected cached decompilations, not the whole cache

Live collaboration

• TCP broadcaster — bidirectional project event transport so analysts can share state over the network
• UndoCommand streaming — every rename, comment, bookmark, tag, and patch replicates to subscribers
• 3-way JSONL merge — git-friendly merge resolver for divergent project edits
• JSON-Lines project export — diffable, mergeable representation of project state for version control

Scripting (Rhai)

• Plugin discovery and hot-reload — the runner polls ~/.sleuthre/plugins/ once per frame; edits land without restarting the app
• Async plugin runner — scripts run on a background thread and apply actions on the main thread; the UI never blocks
• Bundled example plugins — rename_alloc_funcs, find_xor_loops, plus a plugin API README
• Archive / bytecode / symbol import APIs — open_archive, archive_entries, archive_extract, disassemble_bytecode, import_symbols

Architecture support

• ARM / Thumb-2 lifter — minimum-viable IL coverage for 32-bit ARM

Signatures and symbols

• FLIRT PAT signature importer — reads IDA Pro .pat pattern files into the sleuthre signature database
• Binary Ninja .bndb importer — pulls symbols, function renames, and comments from BN projects

C++ class analysis

• Vtable resolution — indirect calls resolved through known C++ vtables
• Class metadata in TypeManager — ClassInfo persisted in SQLite and auto-linked to declared classes
• MSVC pattern recognition pass — identifies MSVC-specific class prologues and vtable layouts

MCP server

• MLIL / SSA / IL rewrite tools — expose lifted IL to AI agents for higher-level reasoning
• Variable uses, source diff, JSONL merge tools — round out the collab and review surface
• Cached decompilation — get_decompilation reuses the shared decomp cache with surgical invalidation

GUI

• Data inspector, source compare, and tabular views — new analysis panes
• Struct overlay persistence — applied struct layouts survive save/load

Multi-binary workspace (library API)

• Workspace scaffolding — collection of named binaries analysed together
• Cross-binary symbol / import resolution — resolve_symbol and resolve_import across the whole set

Tooling

• parse_type_str in re-core — one canonical parser shared by scripting and MCP
• Criterion benchmark harness — covers analysis hot paths
• CI release jobs — Linux and Windows artifacts in addition to macOS ARM64, plus a bench-compile job

v0.3.0

sleuthre v0.3.0

Open-source reverse engineering desktop application built from scratch in Rust.

What's new

x87 FPU instruction support

• FPU lifter — fld, fst, fstp, fild, fistp, fadd, fsub, fmul, fdiv and their variants
• Floating-point binary ops — FAdd, FSub, FMul, FDiv carried through LLIL → MLIL → HLIL with correct precedence and identity folding

x86 calling convention detection

• Thiscall / Fastcall heuristics — detects ecx/edx register usage in function prologues to distinguish thiscall, fastcall, and cdecl
• x86 ABI parameter recovery — ecx, edx added as x86 argument registers for structuring pass

Struct inference analysis pass

• Automatic struct detection — identifies pointer-plus-offset access patterns in disassembly to infer struct field layouts
• Plugin integration — runs as a standard analysis pass via the plugin manager

Win32 & DirectX type library

• Common Win32 structs — POINT, RECT, MSG with correct field offsets and types
• COM vtable types — IDirectDrawSurface7 and IDirectDrawSurface7Vtbl with QueryInterface, AddRef, Release function pointers

Scripting: BinaryFile API

• open_binary(path) — open raw binary files from Rhai scripts
• Read helpers — read_u32_le, read_u16_le, read_string with bounds-checked access
• len() — query file size

Functions panel column alignment

• Fixed-width columns — Address, Name, Size, and Xrefs columns now align properly with their headers
• Badge column — consistent width for function/library badges

Project save reliability

• Transactional save — full clear + reinsert wrapped in BEGIN IMMEDIATE / COMMIT with rollback on error, preventing partial writes
• Save path consistency — "Save As" now updates the project path so auto-save targets the correct file

CI & release automation

• Tag trigger fix — glob pattern now correctly matches v* release tags
• Auto-create release — CI creates a draft GitHub Release on tag push before uploading assets
• macOS ARM64 release job — automated build and upload for Apple Silicon

Quality & testing

• cargo fmt / clippy clean — full workspace passes cargo fmt --check and cargo clippy -- -D warnings
• re-gui tests — theme color validation across Dark, Light, and Solarized modes
• re-mcp tests — MCP JSON-RPC protocol tests covering initialize, tools/list, error handling, and tool dispatch

v0.2.0

sleuthre v0.2.0

Open-source reverse engineering desktop application built from scratch in Rust.

What's new

Binary diffing

• Two-phase function matching — exact name matching + byte-pattern hash matching for renamed functions
• Similarity scoring — 0.0–1.0 ratio based on LCS byte-level comparison
• Instruction-level diff — same/added/removed lines with color coding
• Diff view — two-pane UI with function list, filtering, match summary, and side-by-side diff

Entropy analysis

• Shannon entropy — sliding-window computation (0.0–8.0 range) with configurable window size and step
• Region classification — packed/encrypted (high), code (medium), data/padding (low)
• Entropy view — color-coded bar chart with interactive hover, tooltips, and summary statistics

RISC-V architecture support

• RISC-V IL lifter — ~90+ instructions including compressed (RVC) variants
• Coverage — arithmetic, logic, comparisons, memory ops, branches, jumps, pseudo-instructions
• Disassembly — full RISC-V disassembly via Capstone

Decompiler improvements

• Function signature recovery — parameter detection from ABI registers (x86_64, ARM64)
• Stack variable recovery — heuristic detection of locals from stack references
• Symbol/global resolution — resolves memory accesses to named functions and global variables
• Label optimization — removes unused labels, folds return values, detects for-loops
• Type propagation — debug info and TypePropagator output feed into structuring decisions

Shared analysis pipeline

• analyze_binary() / analyze_loaded() / reanalyze() — unified entry points with modular stages
• AnalysisConfig — enable/disable individual passes (functions, xrefs, strings, type propagation)
• Progress reporting — stage-aware callbacks for UI feedback
• Platform-aware type libraries — linux_x86_64, windows_x86_64, macos_arm64

New GUI views

• Cross-references view — dual panel (callers/callees) with function context, type display, filtering, and click-to-navigate
• Signature manager — load/save/create signature databases, scan binary, display matches
• Entropy view — heatmap with legend and statistics
• Diff view — function-level and instruction-level comparison

UI improvements

• Responsive layout — improved tab-based navigation across 13 analysis views
• Auto-save — 5-minute interval for project state
• Graph view — hierarchical/compact layout modes, back-edge loop detection, zoom controls, minimap
• Theme management — dynamic theme switching with syntax color updates

Scripting (Rhai)

• rename(address, name) — rename function or label
• set_comment(address, text) — add or update comments
• goto(address) — navigate to address
• println(msg) — output to script console
• Full access to project functions, strings, comments, and architecture info

Global variable resolution

• Automatic detection — resolves global data references from disassembly
• Named globals — integrates with symbol table and debug info

Performance

• Binary loading pipeline — moved to shared async pipeline for faster startup
• UI responsiveness — reduced blocking on analysis-heavy operations

v0.1.0-alpha

sleuthre v0.1.0-alpha

Open-source reverse engineering desktop application built from scratch in Rust.

Features

Binary analysis

• Format support — ELF, PE, Mach-O, and raw binaries with automatic detection
• Disassembly — x86, x86_64, ARM, ARM64, MIPS, MIPS64 via Capstone
• Function discovery — entry point analysis, prologue pattern matching, recursive descent
• Control flow graphs — basic block construction, edge classification, back-edge detection
• Cross-references — call, jump, data read/write with bidirectional indexing
• String extraction — ASCII, UTF-16LE, UTF-16BE with configurable minimum length
• Constant detection — CRC32 tables, AES S-boxes, pointer tables
• Signature matching — FLIRT-like byte pattern database with wildcards

Decompiler

• Pseudo-C output — structured decompilation with if/while/for/switch recovery
• Three-tier IL — LLIL → MLIL → HLIL pipeline
• Architecture lifters — x86/x86_64, ARM64, MIPS instruction lifting
• Type propagation — parameter detection, return type inference, stack variable recovery

Desktop GUI (re-gui)

• 9 analysis views — disassembly, CFG graph, hex dump, strings, decompiler, imports, exports, structures, call graph
• Command bar — fuzzy search across functions, imports, exports, strings (Ctrl+G)
• Navigation band — visual memory map with color-coded segments and functions
• Annotations — function renaming (N), comments (;), bookmarks (Ctrl+D)
• Hex patching — click-to-edit byte modification
• Undo/redo — full command history with Ctrl+Z / Ctrl+Shift+Z
• Keyboard shortcuts — F5 decompile, Space CFG, X xrefs
• Dark/light theme — toggle via menu

MCP server (re-mcp)

• 20 tools — binary loading, disassembly, CFG, decompilation, xrefs, strings, pattern matching, annotations, bookmarks
• 7 resource endpoints — project state queries via sleuthre://project/*
• AI approval queue — review and approve AI-suggested renames and comments

CLI (re-cli)

• Batch analysis — headless binary analysis with JSON output

Persistence

• SQLite database — save/load full analysis state (functions, xrefs, strings, comments, bookmarks, types)