Reverse engineering, rebuilt for AI agents.
A pure Rust engine your agent drives over MCP. Blazing fast, with no Ghidra underneath.
$ curl -fsSL https://borer.lol/install | shWhy borer
Other tools put a bridge in front of a GUI decompiler. borer is the decompiler, written for agents from the first line.
Blazing fast
Ready to answer in 0.1 s. Ghidra 12.1.4 takes 115 s cold, 5 s warm.
$ borer load_binary path="notepad.exe"path: C:\Windows\System32\notepad.exesize: 360448 bytesformat: PE arch: x86-64 (64-bit)base: 0x140000000 entry: 0x1400019c0sections (8): name va vsize file_off size rwx entropy .text 0x140001000 0x267e2 0x1000 0x27000 r-x 6.24 fothk 0x140028000 0x1000 0x28000 0x1000 r-x 0.02 .rdata 0x140029000 0xa6c8 0x29000 0xb000 r-- 5.58 .data 0x140034000 0x2740 0x34000 0x1000 rw- 1.62
Checked, not guessed
Every block of pseudo-C is replayed in an emulator and compared with the machine code. You see the score.
// checked vs binary: statements as emitted, 51/51 blocks x3 states; unchecked: C spelling, later text passesmemset(&local_c8, 0, 92);var2 = sub_14001e9b0(var1, L"lfEscapement", local_c0);var3 = sub_14001e9b0(local_d8, L"lfOrientation", local_bc);var4 = sub_14001e9b0(local_d8, L"lfWeight", local_b8);var5 = sub_14001e9b0(local_d8, L"lfItalic", 0);var6 = sub_14001e9b0(local_d8, L"lfUnderline", 0);var7 = sub_14001e9b0(local_d8, L"lfStrikeOut", 0);
Made for context windows
Answers are filtered and paged on the server. Ask again with since= and get only what changed.
$ borer find_function_by_string filter="Software\Microsoft\Notepad" limit=5# showing 5 of 7 rows: 8 function/string pairs match 'Software\Microsoft\Notepad' across 3 strings in 7 functions# strings: 1=L"Software\Microsoft\Notepad" 2=L"Software\Microsoft\Notepad\DefaultFonts"# entry name: string numbers0x14000aac4 sub_14000aac4: 10x14000b3e4 sub_14000b3e4: 10x140012a2c sub_140012a2c: 1 20x14001ea18 sub_14001ea18: 10x14001eee0 sub_14001eee0: 1# 2 more rows; offset=5 for the next page
Milliseconds per function
One decompile takes 2-7 ms. Ghidra 12.1.4 takes 220-260 ms.
Pure Rust, nothing in between
No Java, no Python bridge, no host program. One binary that speaks MCP to your agent and reads the file itself.
Its own engine
Loader, lifter, emulator and decompiler, written from scratch. No Ghidra, IDA or Binary Ninja inside.
Safe on any input
Bounds-checked reads, capped scans, fuel-limited walks. A broken file gets an error, never a crash. Same input, same answer.
Never touches the binary
Renames and comments start as dry runs and live in a separate project file.
Deep analysis, one query
Taint, emulation, solving, devirtualization and unpacking are 57 borer:// resources. Ask by URI, get one paged answer.
- whyWhat is at an address and how borer knows
- taintFollow a value forward through its function
- emulateRun code and read the result
- solveFind an argument value that makes a check answer differently
- devirtRun a virtualized function and recover the program it executes
- unpackRun a packer's bootstrap and report the code it decrypts into memory
- diffCompare the loaded binary against another version at {path} and report which functions changed
- grepPseudo-C lines program-wide containing the text
Benchmarked against Ghidra 12.1.4
0.1 s
Ready to answer, sqlite3 DLL (1,900 functions)
Ghidra 12.1.4: 115 s cold, 5 s warm
2-7 ms
One decompile, median
Ghidra 12.1.4: 220-260 ms
359 / 420
Recompiled output gives the source's answer
Ghidra 12.1.4: 308 / 420
Measured on 60 known C functions built seven ways (x64 ELF and PE at O0/Od/O2/Os, arm64 at O0/O2), plus findstr, notepad, msvcrt and sqlite. Each decompiled function was compiled again and run against its source. Ghidra still prints fewer gotos and fewer width casts on large optimized functions.
Built with Claude
borer was built end to end with Claude, working in Claude Code. A reverse-engineering engine for AI agents, written with one.
- The engineLoader, lifter, emulator and decompiler, in Rust
- The serverEvery MCP tool and borer:// resource
- The checksTests, benchmarks and the gate CI runs
- This sitePages, drawings, motion, the mark and the videos
Give your agent a reverse engineer.
$ curl -fsSL https://borer.lol/install | sh