70:T152c,# Rikugan v1.0.0 — First Release **A reverse-engineering agent for IDA Pro and Binary Ninja.** Rikugan is an LLM-powered agent that lives inside your disassembler. It has its own agentic loop, 60+ tools, streaming UI, and treats your binary like a codebase — reading, analyzing, renaming, and patching it through natural language. ## Highlights ### Agent Architecture - **Generator-based agent loop** with streaming LLM responses, tool interception, and automatic error recovery - **60+ tools** across navigation, decompilation, disassembly, cross-references, strings, annotations, types, IL read/write, and scripting - **Multi-provider support** — Anthropic (Claude), OpenAI, Google Gemini, MiniMax, Ollama, and any OpenAI-compatible endpoint - **Prompt caching** for Anthropic models to reduce token spend - **Context window management** with automatic compaction at 80% usage ### Dual-Host Support - **IDA Pro 9.0+** with Hex-Rays decompiler — 56 tools including 6 microcode-specific tools - **Binary Ninja** — 63 tools including 13 IL-specific tools for reading, analyzing, and transforming LLIL/MLIL/HLIL ### Modes | Mode | Command | What it does | |------|---------|--------------| | **Normal** | Any message | Stream → tool → repeat | | **Plan** | `/plan` | Generate step-by-step plan → approve/reject → execute | | **Exploration** | `/explore` | Autonomous read-only investigation with subagents | | **Modify** | `/modify` | 4-phase: Explore → Plan → Execute → Save (natural language binary patching) | ### Exploration & Subagents - Main orchestrator maps the binary (imports, exports, strings, key functions), then spawns isolated subagents for focused analysis tasks - Subagents run in their own context with zero knowledge of the parent session - Findings are synthesized back into the orchestrator for deeper, faster analysis ### Natural Language Binary Patching (Experimental) - `/modify make the maze game easy` — the agent explores the binary, builds a patch plan, and applies it - Runs through a full explore → plan → execute → save pipeline - User approves/rejects each phase before the agent proceeds ### Skills System - **12 built-in skills**: malware analysis, linux malware, deobfuscation, vulnerability audit, driver analysis, CTF, generic RE, IDA scripting, Binary Ninja scripting, modify, smart-patch (IDA), smart-patch (Binary Ninja) - **Custom skills** — drop a `SKILL.md` in your host config directory - Autocomplete with `/` in the chat input ### Deobfuscation (Experimental, Binary Ninja) - IL read/write primitives for control flow flattening, opaque predicates, MBA obfuscation, and dead code removal - Plan mode ensures you review the deobfuscation strategy before patches are applied ### UI - **Multi-tab chat** with independent sessions per tab - **Session persistence** — conversations auto-save per file and restore on reopen - **Session fork** — right-click a tab to branch the conversation - **Chat export** to Markdown with syntax-highlighted tool calls - **Message queuing** — send follow-ups while the agent is working - **Mutation log** with undo support - **Streaming Markdown** rendering with collapsible thinking blocks - **Context bar** showing token usage and model info ### MCP Client - Connect external MCP servers via `mcp.json` config - Tools from MCP servers appear alongside built-in tools with the prefix `mcp__` - Built on the official `mcp` Python SDK ### Persistent Memory - Agent saves important findings to `RIKUGAN.md` next to your binary - Memory is loaded into the system prompt on every future session - Cross-session context that builds over time ## Security ### Approval Gates - **Script approval** — `execute_python` always shows a full code preview and requires Allow/Deny - **Plan approval** — `/plan` and `/modify` disable text input; the user must click Approve or Reject buttons - **Plan rejection** — rejecting a plan offers Regenerate (with optional feedback) or Cancel, instead of silently aborting - Blocked patterns (subprocess, os.system, etc.) are rejected before reaching the approval step - The agent never executes the target binary ### Prompt Injection Mitigation Rikugan analyzes untrusted binaries whose content flows into LLM prompts. A malicious binary could embed adversarial text to manipulate the agent. Defense-in-depth mitigations: - **Delimiter quoting** — all untrusted data (tool results, binary context, MCP output, memory, skills) is wrapped in XML-like tags (``, ``, ``, ``, ``) - **Injection marker stripping** — removes LLM role markers (`[SYSTEM]`, `<|im_start|>`, `<>`) and instruction override patterns from all untrusted data - **Length capping** — truncates data to configurable limits per source type - **Model awareness** — system prompt includes `DATA_INTEGRITY_SECTION` instructing the model to treat delimited content as data, not instructions - **Memory write sanitization** — `save_memory` strips markers before writing to `RIKUGAN.md` ## Requirements - IDA Pro 9.0+ with Hex-Rays decompiler **or** Binary Ninja (UI mode) - Python 3.9+ (Python 3.10 recommended for IDA Pro — see Shiboken UAF note) - At least one LLM provider API key - Windows, macOS, or Linux55:["$","$L6c",null,{"entries":[{"key":["platform",{"userId":"anon"},"repo","releases",{"owner":"buzzer-re","repo":"Rikugan"},"detail","1.0"],"data":{"id":"121598","version":"1.0","channel":"stable","title":"First release - v1.0","publishedAt":"2026-03-05T23:19:28Z","summary":"# Rikugan v1.0.0 — First Release","notesMarkdown":"$70","attachments":[],"htmlUrl":"https://trylle.com/buzzer-re/Rikugan/releases/tag/1.0","target":"main","commitSha":"13c59b49dad9184bf63e2a8df2e942e6daa55bca","publisher":{"id":-1,"login":"Ghost"},"zipballUrl":"/v1/repositories/buzzer-re/Rikugan/archive?ref=1.0&format=zip","tarballUrl":"/v1/repositories/buzzer-re/Rikugan/archive?ref=1.0&format=tar.gz","isDraft":false,"isPrerelease":false},"fetchedAt":1793418974652}],"children":"$L71"}]