JoasASantos / Malvex

# Malvex
**Reverse engineer malware with agents, from packed droppers down to memory-resident payloads.**
Malvex is a local-first orchestration harness that connects AI agents to 126 reverse-engineering and malware-analysis tools through MCP (Model Context Protocol). Point it at a binary, a memory dump, a document, or a packet capture. Malvex triages the sample, fans out parallel agents over IDA, Ghidra, radare2, Frida, volatility3, YARA, and dozens of other backends, and returns evidence-grounded findings — IOCs, MITRE ATT&CK mappings, detection rules, and attack-chain graphs — without uploading anything.
Analysis runs locally. Results include the evidence and limitations behind each conclusion.
> **Important rule:** LLM output is not evidence.
> The model may propose hypotheses, likely function names, algorithm matches, or ATT&CK mappings.
> Malvex treats those as analyst leads until they are tied to static or runtime evidence.
## What it analyzes
| Target | What Malvex recovers | Backends |
|---|---|---|
| **Native binaries** (PE, ELF, Mach-O, FAT) | Pseudocode, call graphs, xrefs, imports, strings, resources, compiler/packer ID | IDA, Ghidra, radare2, rizin, Binary Ninja, Cutter, otool, readelf, objdump, nm, lief |
| **Packed / obfuscated** | OEP recovery, unpacked payload, decoded strings, API hash resolution, de-virtualized control flow | UPX, DIE, PEiD, capa, FLOSS, unicorn, angr, VMProtect/Themida stub analysis |
| **Memory dumps** | Injected regions, hollowed processes, decrypted config, loaded modules, handle tables, process trees | volatility3, rekall, custom RWX scanners |
| **Documents** (Office, PDF, RTF, HTA) | Macros, embedded objects, exploit payloads, PowerShell stages, VBA deobfuscation | oletools (olevba/oleid), pdf-parser, peepdf, rtfobj |
| **Network captures** (pcap, HAR) | DNS, HTTP(S), TLS fingerprints, C2 beaconing, DGA, exfiltration patterns | tshark, tcpdump, mitmproxy, zeek, suricata |
| **Android / Mobile** (APK, DEX) | Manifest, decompiled methods, class references, permissions, native libs | apktool, jadx, androguard, adb |
| **Firmware** | Binary extraction, region analysis, embedded filesystem carving | binwalk, unblob, foremost, bulk\_extractor |
| **Shellcode** | Disassembly, emulation, payload staging, C2 config extraction | capstone, unicorn, speakeasy, keystone |
| **.NET assemblies** | IL disassembly, metadata, obfuscation layer identification | de4dot, dnSpy, ILSpy, monodis |
| **Scripts** (PowerShell, VBS, JS, Python) | Deobfuscation chains, encoded payloads, dropped artifacts | AST analysis, string decoding, regex extraction |
## Quick start
 [code] 
## Commands
| Command | Purpose |
|---|---|
| `malvex setup [--commercial]` | One-shot: install tools + MCP servers |
| `malvex doctor [--json] [--install]` | Detect tools + MCP servers; install missing open-source ones |
| `malvex mcp-setup [--install] [--commercial]` | Install + register RE MCP servers with your AI agent |
| `malvex run [--dry-run] [--stag