AI powered reverse engineering software - Open Source

File intelligence,
instantly decoded.

Transform compiled binaries, black-box ML checkpoints, internal relational databases, and obscure configuration structures into immediate structural telemetry and clear human insights.

Download and Install
fabx --stream --local-inference
Initializing local reverse engineering pipeline pipeline...
[READY] Monitoring file ingestion channels...
01 // Architecture Vision

The Engineering Goal

FABX bridges the gap between opaque application files and the engineers analyzing them. By parsing absolute structures statically and supplying unified data matrices to isolated local LLM instances (Ollama), it replaces classical brute force hex inspection with actionable structural logs.

Telemetry Extraction

Automatically isolates internal layers, schemas, compiled symbols, and metadata records without relying on remote network pipelines.

Topographical Layouts

Transforms raw relationship maps and code execution channels into cleanly mapped interactive NetworkX visualizations.

Local LLM Synthesis

Uses localized Llama models via Ollama to generate behavioral reports, security indicators, and best-effort pseudo-code logic.

02 // Data Coverage

Supported File Formats

FABX identifies structural headers natively to match target file streams to custom parsing modules.

Application Binaries

Deep file header decomposition and structural analysis.

.exe.dll.elf.so.bin

Machine Learning Models

Extracts layer weights, shapes, and node properties.

.onnx.pt.pth.pkl.joblib

Storage & Config Trees

Parses schemas, keys, and hierarchical arrays.

.db.sqlite.json.yaml.toml
03 // Core Topography

Overall System Pipeline

A continuous stream from ingestion to interactive visualization and local semantic interpretation.

CORE INTERNALS ENGINE PIPELINE
flowchart LR File[Uploaded Asset] --> Detector[FABX Structural Detector] Detector --> Route{Module Router} Route --> Exe[Executable Engine] Route --> ML[ML Model Parser] Route --> DB[DB Schema Engine] Route --> Struct[Config Struct Parser] Exe & ML & DB & Struct --> Block[Unified Telemetry Block] Block --> Vis[NetworkX Graphics Map] Block --> Prompt[Compact Prompt Builder] Prompt --> Ollama[Ollama Inference Core] Vis & Ollama --> UI[NiceGUI Web Portal View]
04 // Domain Processing

Analytical Lifecycles

Toggle through deep parsing mechanics built for each dedicated domain ecosystem pipeline.

Processes cross-compiled executables using headless Rizin engines to capture instructions prior to localized AI behavior profiling.

flowchart TD A[Binary File] --> B[Headless Rizin Core Engine] B --> C{Target View State} C -->|Decompiler| D[Decompiled C Code] C -->|Asm Assembly| E[ASM Opcode Strings] C -->|Raw Maps| F[HEX Data Array] D & E & F --> G[Ollama Prompt Evaluator] G --> H[Anomalous Signal Logs / Best-Effort Code Reconstruction]

Extracts neural matrix layer shapes, operator chains, and parameters while enforcing strict validation thresholds.

flowchart TD A[Model Framework File] --> B[Structural Graph Operator Engine] B --> C[Layer Names & Activation Shapes] B --> D[Tensor Weight Counts] B --> E[Pickle Opcodes Safety Verification] C & D & E --> F[Plotly/NetworkX Model Visualization] F --> G[Ollama Architectural Summary Generation]

Opens isolated relational storage in explicit read-only configuration modes to map logical database design layout entities.

flowchart LR DBFile[SQLite Binary] --> Conn[Isolated Read-Only Channel] Conn --> Meta[Schema Metadata / View Keys Extraction] Meta --> ER[Entity-Relationship Topographical Map] Meta --> AI[AI Context Behavioral Summary]

Maps hierarchical property nodes to track element structural layout limits, leaf keys, and array constraints.

flowchart LR Config[JSON / TOML Asset] --> Parser[Matrix Tree Structural Engine] Parser --> Metrics[Nested Depth & Node Count Calculations] Metrics --> Render[Plotly Interface Property Tree Graph]
05 // Orchestration

Deployment & Setup

Core Platform Execution

# Create runtime virtual ecosystem shell
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate

# Apply required technical application packages
pip install -r requirements.txt

# Fire up local NiceGUI graphical server portal
python app.py

Ollama Model Runner Integration

# Fire up background inference engine host daemon
ollama serve

# Fetch target model execution weight block
ollama pull llama3.1

Command-Line Interface Controls

# Direct terminal testing run command execution
python backend/analyzer.py test_files/test.json

# Process specialized ML targets using deeper load parameters
python backend/analyzer.py path/to/model.pkl --unsafe-load

CRITICAL DESERIALIZATION WARNING

Enabling custom deserialization parsing blocks like Pickle, Joblib, or unchecked PyTorch states without isolated virtualization layers can introduce clear arbitrary code vulnerabilities. Use --unsafe-load exclusively on verifiable, trusted files.

06 // Technical Reference

Frequently Asked Inquiries

No. FABX functions completely locally. File extraction filters, processing systems, network diagram generations, and LLM inference tasks (via Ollama) happen inside your device limits, ensuring complete data sovereignty.

Reconstructions use best-effort structural evaluations. Because standard compilation engines strip syntax attributes, human variable labels, and type definitions, the generated pseudo-code blocks represent an approximate behavioral mapping rather than a line-by-line mirror of the original source.

No, FABX functions as a rapid multi-format triage suite. It quickly processes varied file groups (binaries, databases, machine learning model weights) to generate automated documentation and interactive visual charts, allowing teams to gain initial structural context before performing deep manual analysis.

07 // Future Roadmap

Future Horizons

Phase 1: Deep Call Graph Tracing

Integrating native interactive assembly control-flow block visuals and system-call paths directly inside the NiceGUI dashboard viewport layout.

Phase 2: Virtual Bytecode Analyzers

Expanding the pipeline to natively parse frozen python execution distributions, Java archive layout dependencies, and browser web bundles.

Phase 3: Sandbox Runtime Isolation

Deploying micro-sandboxing runtimes to safely run and evaluate suspicious model checkpoints without risking host security.

08 // Community Governance

Contributing & Open Source Compliance

Collaboration is highly encouraged. Developers are welcome to submit pull requests to implement new domain logic modules, add dynamic UI components, or fine-tune local prompt templates.

This project is licensed under the terms of the GNU Affero General Public License v3.0.