DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to triage an unknown binary in one desktop session with Recurse

Open a sample and read its hashes, hardening flags, libraries and function counts before deeper work.

Authorization notice. Recurse is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Reverse engineering. Only analyze samples you are authorized to examine, and handle malware inside an isolated environment.

Who it is forA malware analyst or security engineer who receives an unknown ELF, PE or Mach-O file and needs a fast first look.

The problemGetting basic facts about a binary (hashes, protections, linked libraries, size of the function set) usually means switching between several tools.

The outcomeA clear first-pass summary of the binary that tells you whether it is worth deeper analysis.

What you need first

  • Node.js 20 or newer and npm 10 or newer
  • Rust 1.77 or newer with cargo, installed through rustup
  • Linux system packages for Tauri (libwebkit2gtk-4.1-dev and the others listed in the README) if you build the desktop app on Debian or Ubuntu
  • A binary you are allowed to analyze
  • An OpenAI-compatible API key (for example OPENROUTER_API_KEY) if you want the chat agent to run

Steps

  1. Clone the repository and run just dev from the repo root to start the desktop app.
  2. Open the binary in the app. It works on live analysis sessions for any binary, including files with no extension.
  3. Open the Recon page and note the MD5, SHA1, SHA256 and CRC32 hashes, the entropy value and the linked libraries.
  4. Read the hardening report for RELRO, PIE, NX, canary, FORTIFY and RPATH.
  5. Check the analysis counts, then use the function list and the imports tab to pick functions to examine.

Prompt for your agent

Use the Recurse repo at <repo path> to triage the binary at <target path>. Report the SHA256, the hardening flags and the linked libraries from the Recon page. Expected output: a short written summary. Verify that the SHA256 matches a local sha256sum of the file.

Caveat. The Recon page is a built-in view, so you need the desktop app running, and the README does not describe a command line triage mode.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page