reverify 0.1.0__tar.gz

reverify-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Reverify contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

reverify-0.1.0/PKG-INFO

@@ -0,0 +1,139 @@
+Metadata-Version: 2.4
+Name: reverify
+Version: 0.1.0
+Summary: Verified reverse engineering: AI RE grounded on deterministic tools — claims checked against the binary, not hallucinated.
+Author: 2akouwu
+License: MIT
+Project-URL: Homepage, https://github.com/2akouwu/reverify
+Project-URL: Repository, https://github.com/2akouwu/reverify
+Project-URL: Issues, https://github.com/2akouwu/reverify/issues
+Keywords: reverse-engineering,binary-analysis,disassembler,frida,protobuf,mcp,ai-agents,malware-analysis,ctf
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Disassemblers
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: capstone
+Requires-Dist: capstone>=5.0; extra == "capstone"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+<h1 align="center">Reverify</h1>
+
+<p align="center">
+  <strong>Reverse engineering you can trust.</strong><br>
+  An AI-assisted RE toolkit whose findings are checked against the binary — not hallucinated.
+</p>
+
+## The problem
+
+Language models are great at reading code and unreliable at reverse engineering. Ask a
+model to reconstruct a struct or an algorithm from a binary and it will confidently invent
+offsets, sizes, and behavior. In binary analysis this hallucination problem is far worse
+than in source code, and *"did the model just make that up?"* is the single biggest blocker
+to using AI for real RE.
+
+## What Reverify does
+
+Reverify pairs a language model with a **deterministic, pure-Python RE toolkit** and makes the
+toolkit the judge. The model proposes; the tools verify. A hypothesis about a structure or an
+algorithm is only reported once it has been **checked against the actual bytes** — disassembled,
+pattern-matched, or executed in the emulator — so the output is grounded in the binary instead
+of the model's imagination.
+
+- **Deterministic core** — PE32/PE32+ parsing, x86/x64 disassembly, AOB pattern scanning,
+  CPU micro-emulation, Protobuf/TLV dissection, Frida hook generation. Pure Python, no Ghidra,
+  no heavy install.
+- **Grounded, not guessed** — structural claims are verified against the binary by the tools.
+- **Agent-native** — ships as an MCP server, so Claude Code, Cursor, and other agents can call
+  the tools directly; also a plain CLI.
+
+> Reverify is for **authorized** reverse engineering — malware analysis, CTF, interoperability
+> research, and software you own or are permitted to analyze. See [SECURITY.md](SECURITY.md).
+
+## Quick start
+
+```bash
+# From a checkout — pure standard library, nothing to install:
+python reverify/cli.py auto sample.bin --json
+python reverify/cli.py parse-pe sample.exe --json
+python reverify/cli.py disasm 90505831C0C3 --arch x86_64
+
+# Or install the CLI + MCP server:
+pip install -e .            # optional: pip install -e ".[capstone]" for full disassembly
+reverify auto sample.bin --json
+```
+
+## The verification loop
+
+This is what the name is about. A **claim** is any hypothesis about the binary; the
+deterministic tools are the judge and hand back `VERIFIED`, `REFUTED`, or
+`INCONCLUSIVE` together with the bytes they actually observed:
+
+```bash
+reverify verify sample.bin --claim '{
+  "kind": "instructions", "offset": 4096,
+  "mnemonics": ["push", "mov", "sub"], "note": "function prologue"
+}'
+```
+
+```bash
+# Check a reconstructed routine actually computes what the model claimed:
+reverify verify - --claim '{
+  "kind": "emulate_result", "code": "b805000000b90300000001c8c3",
+  "arch": "x86", "expect_registers": {"eax": 8}
+}'
+```
+
+Claims can be batched from a JSON file (`--claims-file claims.json`); the CLI exits
+non-zero if **anything** is refuted, so an agent or CI job can gate on a grounded
+reconstruction. Supported claim kinds: `bytes_at`, `pattern_present`,
+`string_present`, `instructions`, `emulate_result`, `protobuf_field`, `pe_import`.
+
+## The toolkit
+
+| Command | What it does |
+|---|---|
+| `verify` | **Check a claim about the binary against the tools — VERIFIED / REFUTED / INCONCLUSIVE** |
+| `auto` | Auto-triage: detect format, architecture, sections, top strings |
+| `parse-pe` | PE32/PE32+ headers, imports, exports |
+| `disasm` | x86/x64 disassembly of hex or a section |
+| `pattern-scan` | AOB scan with `??` wildcards |
+| `strings` | ASCII + UTF-16LE extraction with offsets |
+| `emulate` | CPU register/stack micro-emulation |
+| `decode-protobuf` / `decode-tlv` | schema-less wire-format dissection |
+| `gen-hook` | Frida interceptor script generation |
+| `hexdump` | aligned hex dump |
+| `diff-patch` | binary diff / patch generation |
+| `audit-boundary` | defensive filesystem/SSRF boundary audit |
+
+## MCP server
+
+Reverify exposes the toolkit to AI agents over the Model Context Protocol:
+
+```bash
+python reverify/mcp_server.py
+```
+
+Point Claude Code or Cursor at it and the agent can parse, disassemble, and scan binaries
+directly — with the deterministic tools as ground truth. The `re_verify_claim` tool exposes
+the verification loop, so an agent can have its own hypotheses judged against the bytes
+before it reports them.
+
+## Status
+
+**v0.1.0 — the verification core is in.** The deterministic toolkit, CLI, and MCP server are
+here and tested (68 unit tests). The tool-grounded judge — a claim about the binary is
+checked against the actual bytes and returned as `VERIFIED` / `REFUTED` / `INCONCLUSIVE` with
+observed evidence — now ships as `reverify verify` and the `re_verify_claim` MCP tool. Next
+milestone: the closed agent loop that drives the judge automatically — model proposes, tools
+verify, iterate until the reconstruction is fully grounded.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

reverify-0.1.0/README.md

@@ -0,0 +1,114 @@
+<h1 align="center">Reverify</h1>
+
+<p align="center">
+  <strong>Reverse engineering you can trust.</strong><br>
+  An AI-assisted RE toolkit whose findings are checked against the binary — not hallucinated.
+</p>
+
+## The problem
+
+Language models are great at reading code and unreliable at reverse engineering. Ask a
+model to reconstruct a struct or an algorithm from a binary and it will confidently invent
+offsets, sizes, and behavior. In binary analysis this hallucination problem is far worse
+than in source code, and *"did the model just make that up?"* is the single biggest blocker
+to using AI for real RE.
+
+## What Reverify does
+
+Reverify pairs a language model with a **deterministic, pure-Python RE toolkit** and makes the
+toolkit the judge. The model proposes; the tools verify. A hypothesis about a structure or an
+algorithm is only reported once it has been **checked against the actual bytes** — disassembled,
+pattern-matched, or executed in the emulator — so the output is grounded in the binary instead
+of the model's imagination.
+
+- **Deterministic core** — PE32/PE32+ parsing, x86/x64 disassembly, AOB pattern scanning,
+  CPU micro-emulation, Protobuf/TLV dissection, Frida hook generation. Pure Python, no Ghidra,
+  no heavy install.
+- **Grounded, not guessed** — structural claims are verified against the binary by the tools.
+- **Agent-native** — ships as an MCP server, so Claude Code, Cursor, and other agents can call
+  the tools directly; also a plain CLI.
+
+> Reverify is for **authorized** reverse engineering — malware analysis, CTF, interoperability
+> research, and software you own or are permitted to analyze. See [SECURITY.md](SECURITY.md).
+
+## Quick start
+
+```bash
+# From a checkout — pure standard library, nothing to install:
+python reverify/cli.py auto sample.bin --json
+python reverify/cli.py parse-pe sample.exe --json
+python reverify/cli.py disasm 90505831C0C3 --arch x86_64
+
+# Or install the CLI + MCP server:
+pip install -e .            # optional: pip install -e ".[capstone]" for full disassembly
+reverify auto sample.bin --json
+```
+
+## The verification loop
+
+This is what the name is about. A **claim** is any hypothesis about the binary; the
+deterministic tools are the judge and hand back `VERIFIED`, `REFUTED`, or
+`INCONCLUSIVE` together with the bytes they actually observed:
+
+```bash
+reverify verify sample.bin --claim '{
+  "kind": "instructions", "offset": 4096,
+  "mnemonics": ["push", "mov", "sub"], "note": "function prologue"
+}'
+```
+
+```bash
+# Check a reconstructed routine actually computes what the model claimed:
+reverify verify - --claim '{
+  "kind": "emulate_result", "code": "b805000000b90300000001c8c3",
+  "arch": "x86", "expect_registers": {"eax": 8}
+}'
+```
+
+Claims can be batched from a JSON file (`--claims-file claims.json`); the CLI exits
+non-zero if **anything** is refuted, so an agent or CI job can gate on a grounded
+reconstruction. Supported claim kinds: `bytes_at`, `pattern_present`,
+`string_present`, `instructions`, `emulate_result`, `protobuf_field`, `pe_import`.
+
+## The toolkit
+
+| Command | What it does |
+|---|---|
+| `verify` | **Check a claim about the binary against the tools — VERIFIED / REFUTED / INCONCLUSIVE** |
+| `auto` | Auto-triage: detect format, architecture, sections, top strings |
+| `parse-pe` | PE32/PE32+ headers, imports, exports |
+| `disasm` | x86/x64 disassembly of hex or a section |
+| `pattern-scan` | AOB scan with `??` wildcards |
+| `strings` | ASCII + UTF-16LE extraction with offsets |
+| `emulate` | CPU register/stack micro-emulation |
+| `decode-protobuf` / `decode-tlv` | schema-less wire-format dissection |
+| `gen-hook` | Frida interceptor script generation |
+| `hexdump` | aligned hex dump |
+| `diff-patch` | binary diff / patch generation |
+| `audit-boundary` | defensive filesystem/SSRF boundary audit |
+
+## MCP server
+
+Reverify exposes the toolkit to AI agents over the Model Context Protocol:
+
+```bash
+python reverify/mcp_server.py
+```
+
+Point Claude Code or Cursor at it and the agent can parse, disassemble, and scan binaries
+directly — with the deterministic tools as ground truth. The `re_verify_claim` tool exposes
+the verification loop, so an agent can have its own hypotheses judged against the bytes
+before it reports them.
+
+## Status
+
+**v0.1.0 — the verification core is in.** The deterministic toolkit, CLI, and MCP server are
+here and tested (68 unit tests). The tool-grounded judge — a claim about the binary is
+checked against the actual bytes and returned as `VERIFIED` / `REFUTED` / `INCONCLUSIVE` with
+observed evidence — now ships as `reverify verify` and the `re_verify_claim` MCP tool. Next
+milestone: the closed agent loop that drives the judge automatically — model proposes, tools
+verify, iterate until the reconstruction is fully grounded.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

reverify-0.1.0/pyproject.toml

@@ -0,0 +1,45 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "reverify"
+version = "0.1.0"
+description = "Verified reverse engineering: AI RE grounded on deterministic tools — claims checked against the binary, not hallucinated."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "2akouwu" }]
+keywords = [
+    "reverse-engineering", "binary-analysis", "disassembler", "frida",
+    "protobuf", "mcp", "ai-agents", "malware-analysis", "ctf",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Topic :: Software Development :: Disassemblers",
+]
+dependencies = []
+
+[project.optional-dependencies]
+# Capstone upgrades the pure-Python decoder to a full-fidelity disassembler.
+capstone = ["capstone>=5.0"]
+dev = ["pytest>=7.0"]
+
+[project.urls]
+Homepage = "https://github.com/2akouwu/reverify"
+Repository = "https://github.com/2akouwu/reverify"
+Issues = "https://github.com/2akouwu/reverify/issues"
+
+[project.scripts]
+reverify = "reverify.cli:main"
+reverify-mcp = "reverify.mcp_server:run_mcp_server"
+
+[tool.setuptools]
+packages = ["reverify"]
+
+[tool.setuptools.package-data]
+reverify = ["py.typed"]

reverify-0.1.0/reverify/__init__.py

@@ -0,0 +1,31 @@
+"""Reverse Engineering, Protocol Dissection, and Dynamic Instrumentation Toolkit."""
+
+from .pe_parser import PEParser, BinaryParseError
+from .disasm import Disassembler, Instruction, pattern_scan, create_patch
+from .emulator import MicroEmulator, EmulatorError
+from .protocol_parser import ProtobufDissector, TLVDissector, format_hexdump, decode_varint, encode_varint
+from .frida_bridge import FridaScriptGenerator
+from .verifier import Verifier, Claim, verify_claims, VERIFIED, REFUTED, INCONCLUSIVE
+
+__all__ = [
+    "PEParser",
+    "BinaryParseError",
+    "Disassembler",
+    "Instruction",
+    "pattern_scan",
+    "create_patch",
+    "MicroEmulator",
+    "EmulatorError",
+    "ProtobufDissector",
+    "TLVDissector",
+    "format_hexdump",
+    "decode_varint",
+    "encode_varint",
+    "FridaScriptGenerator",
+    "Verifier",
+    "Claim",
+    "verify_claims",
+    "VERIFIED",
+    "REFUTED",
+    "INCONCLUSIVE",
+]