Ablation-Tool / ablation

Ablation is a self-contained reverse engineering framework.
It depends on neither legacy tools nor an MCP server, which removes the attack surface associated with MCP.
When used with Codex or Claude Code, it operates as an autonomous reverse engineering system.
---
 Claude Code Setup & Configuration 
### Quick Start
#### 1. Launch Session
 [code] 
#### 2. Set Model
 [code] 
or
 [code] 
#### 3. Define Objective
 [code] 
#### 4. Check Effort Level
Not sure what effort level to be set on? Ask inline without interrupting the main context:
 [code] 
---
### Recommended Configuration (`/config`)
 [code] 
---
## Capabilities
 Core analysis engine 
| Capability | Code | |
|:---|:---|:---|
| **On-Demand Analysis** | 1 | Cached binary context and targeted function analysis; retain symbols, imports, cross-references and analyst names between sessions. |
| **Binary Lifting** | 1 | Native instructions to pseudo-C using architecture-specific register state and calling conventions; support varies by backend. |
| **Semantic Code Search** | 1 | Search functions by behavioral descriptions; normalize assembly, embed descriptions and rank semantic similarity. |
| **Hypothesis Engine** | 1 | Persist competing explanations, collect evidence, rank probes and update confidence. |
| **DAG Adapter Language** | 1 | Define fixed-width instruction bitfields, round-trip encodings, semantic operations and dataflow edges through EncodingDAG. |
| **Entropy Mapper** | 1 | Sliding-window Shannon entropy, region classification and transition detection to guide unpacking and analysis. |
 Learning and continuity 
| Capability | Code | |
|:---|:---|:---|
| **The Flywheel** | 1 2 | Replay stored confirmed finding descriptions and successful semantic queries against later binaries. |
| **Cross-Target Learning** | 1 2 | Persist transferable finding descriptions, embeddings and search patterns for reuse across products and vendors. |
| **KASAN-Oracle** | 1 | Workflow for deriving candidates from instrumented/debug builds and checking corresponding production code; includes instrumentation-aware decoding. |
 Vulnerability discovery and validation 
| Capability | Code | |
|:---|:---|:---|
| **Network Sink Finder** | 1 | BFS callgraph reachability from network sources (recv/read/fgets/accept) crossed with SinkArgClassifier results. Turns the 50-line HACMP-003 pattern into 3 lines because depth-N reachability and SAC cross-reference were previously separate manual steps. |
| **Taint Analysis** | 1 2 | Source-to-sink register/dataflow tracking, with architecture-specific intraprocedural, interprocedural and flow-sensitive implementations. |
| **Cross-Library Analysis** | 1 2 | Resolve imports and exports across a firmware library set and propagate supported argument taint across library boundaries. |
| **Pre-Authentication Exposure** | 1 | Recover supported Flatui route/auth-wrapper structures, associate handlers and identify pre-authentication handlers with sensitive sinks. |
| **Sink Arg Clas