DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to triage an unknown binary with an agent in one window with Eleven

Open a Mach-O, ELF or PE file and have an agent map its functions, strings and purpose.

Authorization notice. Eleven is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Reverse engineering. Only analyze binaries you own or are authorized to examine, since disassembly of third-party software can break license terms or law in some places.

Who it is forA security analyst or developer who has received an unfamiliar binary and needs a fast first read before deciding what to do with it.

The problemReading a stripped binary by hand is slow, and it is hard to know which functions matter first.

The outcomeA short written map of the binary's main functions, notable strings and likely behavior, with the agent's notes saved in the project.

What you need first

  • A supported OS: macOS 14 or later on Apple Silicon, Windows x64, or Linux x64
  • An ACP-compatible agent (Eleven installs ACP adapters when they are needed)
  • Rizin for fast opening, or Ghidra 12.x with Java 21 for the clearest pseudocode
  • jadx if you plan to open Android APK files
  • A binary, APK, GPU kernel, shader or model file you have the right to analyze

Steps

  1. Run curl -fsSL https://eleven.chizi.app/install.sh | bash on macOS, or irm https://eleven.chizi.app/install.ps1 | iex in PowerShell on Windows, or download the AppImage on Linux.
  2. Open Eleven and pick Rizin for quick opening, or Ghidra for clearer pseudocode, when the first-run setup asks.
  3. Choose an ACP agent in the setup, then open your binary in a new project.
  4. Start the built-in first look playbook with your agent and let it open the main functions.
  5. Read the agent's notes beside each function and accept or decline any suggested renames.

Prompt for your agent

Using the Eleven app in the Zfinix/eleven repo, open the binary at <path-to-binary>, run the first look playbook, and report the main functions, notable strings and likely purpose. Verify that each claim links to a function address in the window.

Caveat. Eleven says Ghidra is slower but gives the clearest pseudocode, so expect a wait on first open when you choose it.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page