# AI use cases for Eleven (Zfinix/eleven)

Repo: [Zfinix/eleven](https://github.com/Zfinix/eleven) | Use cases: 4 | Page: https://dedupedai.com/use-cases/zfinix-eleven/

Eleven is an agent-first reverse-engineering app for macOS, Windows and Linux that lets any ACP agent read, rename, annotate and suggest patches for binaries, Android apps and GPU kernels.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Triage an unknown binary with an agent in one window: https://dedupedai.com/use-cases/zfinix-eleven/triage-unknown-binary-with-agent/
- Explain an Android APK's code and resources with an agent: https://dedupedai.com/use-cases/zfinix-eleven/explain-android-apk-with-agent/
- Rename functions and add notes with agent changes you approve: https://dedupedai.com/use-cases/zfinix-eleven/rename-and-annotate-functions-with-review/
- Compare two builds of a binary by function changes: https://dedupedai.com/use-cases/zfinix-eleven/compare-two-builds-by-function/

## How to triage an unknown binary with an agent in one window with Eleven

Repo: [Zfinix/eleven](https://github.com/Zfinix/eleven) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Open a Mach-O, ELF or PE file and have an agent map its functions, strings and purpose.

**Who it is for:** A security analyst or developer who has received an unfamiliar binary and needs a fast first read before deciding what to do with it.

**The problem:** Reading a stripped binary by hand is slow, and it is hard to know which functions matter first.

**The outcome:** A short written map of the binary's main functions, notable strings and likely behavior, with the agent's notes saved in the project.

### Steps

1. Run `curl -fsSL https://eleven.chizi.app/install.sh | bash` on macOS, or `irm https://eleven.chizi.app/install.ps1 | iex` in PowerShell on Windows, or download the AppImage on Linux.
2. Open Eleven and pick Rizin for quick opening, or Ghidra for clearer pseudocode, when the first-run setup asks.
3. Choose an ACP agent in the setup, then open your binary in a new project.
4. Start the built-in first look playbook with your agent and let it open the main functions.
5. Read the agent's notes beside each function and accept or decline any suggested renames.

### Prompt to paste into your agent

```text
Using the Eleven app in the Zfinix/eleven repo, open the binary at <path-to-binary>, run the first look playbook, and report the main functions, notable strings and likely purpose. Verify that each claim links to a function address in the window.
```

### Caveat

Eleven says Ghidra is slower but gives the clearest pseudocode, so expect a wait on first open when you choose it.

Risk, reverse engineering: Only analyze binaries you own or are authorized to examine, since disassembly of third-party software can break license terms or law in some places.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/zfinix-eleven/triage-unknown-binary-with-agent/

## How to explain an Android APK's code and resources with an agent with Eleven

Repo: [Zfinix/eleven](https://github.com/Zfinix/eleven) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README

Open an APK with jadx Java output and let an agent trace its manifest, resources and native libraries.

**Who it is for:** A mobile developer or security reviewer who needs to understand what an Android app does without the original source.

**The problem:** Decompiled Android code is large, and the manifest, resources and native libraries are spread across different views.

**The outcome:** A summary of the app's components, permissions, notable classes and native libraries, with the agent pointing to the relevant Java and resource entries.

### Steps

1. Install jadx and note its install path, since Eleven needs it for Android apps.
2. Set `ELEVEN_JADX` to the jadx executable if Eleven does not find it on its own. (inferred, check the README)
3. Open the `.apk` file in Eleven; for split bundles, open the `.xapk` or `.apks` file so every split loads.
4. Ask your agent to read the manifest and the Resources list, then to follow references from the main activity.
5. Check the agent's claims against the Java view and the string resources before you rely on them.

### Prompt to paste into your agent

```text
In the Zfinix/eleven repo, open the APK at <path-to-apk> and ask the agent to summarize its manifest, permissions, main components and native libraries. Expected output is a list with a Java class or resource path for each item; verify two of them in the Java view.
```

### Caveat

Eleven needs jadx for APK files, and apktool is optional and only adds smali output.

Risk, reverse engineering: Decompiling an app you did not write may breach its license or terms, so limit this to apps you are allowed to inspect.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/zfinix-eleven/explain-android-apk-with-agent/

## How to rename functions and add notes with agent changes you approve with Eleven

Repo: [Zfinix/eleven](https://github.com/Zfinix/eleven) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Let an agent rename functions and leave notes while you accept each change and keep an undo trail.

**Who it is for:** A reverse engineer working through a large binary who wants an agent to do routine naming while keeping final say.

**The problem:** Generic function names make a binary hard to follow, and manual renaming takes time that agents could handle.

**The outcome:** Clearer function names and notes in the project, each change logged with its author and available to undo.

### Steps

1. Open a binary in an existing Eleven project and select the agent you want to use.
2. Select a function in pseudocode and ask the agent to suggest a name and explain it.
3. Review the suggested rename card and accept or decline it.
4. Ask the agent to add notes to the functions it has examined.
5. Review the change log for the project and undo any change you do not want to keep.

### Prompt to paste into your agent

```text
In the Zfinix/eleven app, open the project for <target-binary>, ask the agent to rename the functions it can explain with confidence, and add a note to each. Expected output is a list of accepted and declined renames; verify that each change appears in the change log with the agent as its author.
```

### Caveat

Eleven's README says agents can rename, add notes and change types, but it does not say how accurate those suggestions are, so review each one.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/zfinix-eleven/rename-and-annotate-functions-with-review/

## How to compare two builds of a binary by function changes with Eleven

Repo: [Zfinix/eleven](https://github.com/Zfinix/eleven) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Diff two versions of a program function by function and read the changes like a code review.

**Who it is for:** A security reviewer or release engineer who needs to see what changed between two builds of the same program.

**The problem:** Comparing two binaries byte by byte shows little, so it is hard to tell which behavior actually changed.

**The outcome:** A function-level list of changes between the two builds that you can read like a code review, with an agent summary of what matters.

### Steps

1. Open the first build in Eleven and create a project for it.
2. Open the second build in Eleven as a separate project or in the same project, following the diffing workflow in the app.
3. Run the diff view to see the functions that changed.
4. Ask your agent to summarize the most important changes and the functions they affect.
5. Save the project with ⌘S if you want to share the comparison as a `.eleven` file.

### Prompt to paste into your agent

```text
Using the Zfinix/eleven app, diff the builds at <path-to-old-build> and <path-to-new-build>, then ask the agent to list the five most important changed functions with a one-line reason each. Verify that each function name exists in both builds.
```

### Caveat

The README describes diffing by function but does not give the exact menu steps, so check the app for how to start a diff.

Risk, reverse engineering: Comparing builds of software you do not own may conflict with its license, so use builds you are authorized to analyze.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/zfinix-eleven/compare-two-builds-by-function/