Automated reconnaissance, triage, and intelligence framework for reverse engineering. Analyze a binary before you open a disassembler. Drop a file. Get intelligence.
REVcon performs deep static and dynamic reconnaissance on ELF, PE, and Mach-O binaries and shared libraries. It constructs a structured, color-coded intelligence report grouped into 11 distinct attack surfaces designed to guide your first moves in a disassembler (Ghidra, IDA Pro, Binary Ninja, Cutter).
Instead of dumping raw metadata, REVcon behaves as a reverse-engineering assistant by ranking internal functions, tracing relationship structures, reconstructing obfuscated constants, resolving environment variables, and flagging dynamic payload loaders.
git clone https://github.com/l4zz3rj0d/REVcon.git
cd REVcon
chmod +x install.sh
./install.shpip install .revcon <binary> [options]
| Flag | Short | Default | Description |
|---|---|---|---|
--quick |
-q |
off | Skip Capstone disassembly heuristics and entropy analysis |
--verbose |
-v |
off | Show all internal logs and display hidden compiler boilerplate symbols |
--json |
-j |
off | Output full findings as raw JSON to stdout |
--flag-format |
-F |
None | Search for a flag format across strings, symbols, and base64 candidates. Example: "FLAG{}" |
# Standard static reconnaissance
revcon chall.bin
# Run with dynamic analysis tracer (DANGEROUS EXECUTION)
revcon chall.bin -D
# Export JSON report for external parsers
revcon target.exe -j > intel.json
# Scan for custom flag formats
revcon challenge -F "FLAG{}"Crawl symbol tables, dynamic symbols, PLT/imports, and discovered call targets recursively to map all internal subroutines. Automatically filters out compiler-generated boilerplate noise (e.g. _start, frame_dummy, _init, _fini) by default to keep the focus purely on user-defined code.
Scores functions based on logic complexity and high-interest API calls. Ranks subroutines dynamically to surface target validation loops, crypto, dynamic loaders, and debugger bypass points. Score metrics:
- mmap/mprotect/VirtualAlloc: +45
- ptrace/anti-debug: +45
- crypt/decrypt/aes/rc4: +40
- dlopen/dlsym: +35
- getenv: +30
- strcmp/memcmp: +25
Static argument backtracking scans registers and offset parameters preceding getenv calls to extract required environment variable names (e.g. SAT_PROD_ENVIRONMENT). Extracted names are automatically exported to the runtime execution environment.
Traces dynamic memory mappings and permissions. Highlights execution blocks allocating PROT_EXEC (7) space or invoking writes into executable segments (suspicious self-modifying code or unpacked runtime payloads).
Provides deep triage for library files (.so, .dll, .dylib), exposing non-boilerplate exports, suspicious exports, and likely entry points. A visual relationship tree diagrams import/export linkages.
Traces function dependency trees starting from main or custom library export targets, hiding boilerplate code execution paths.
Reconstructs stack-constructed strings and single-byte cipher arrays (XOR/ADD/SUB). Utilizes heuristic entropy and repetition filtering to drop padding-based false positives.
Presents professional reverse-engineering guidance under each surface to detail the threat significance of findings and guide analysts to their next debug actions.
- Python 3.11+
colorama,capstone,pyelftools,pefile,macholib
- Fork the repository.
- Create a feature branch:
git checkout -b feature/new-detector. - Write modular, typed Python with docstrings.
- Verify output with
python3 revcon.py <target>. - Submit a Pull Request.
For authorized security research and education only.
