rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja

What it claims

Rikugan is a chat agent that opens inside IDA Pro 9.0+ (with Hex-Rays) or Binary Ninja (UI mode) with Ctrl+Shift+I. It analyses, annotates and, experimentally, patches binaries. The author says it was "vibecoded" with Claude Code: the first version took one night, it supported both hosts within two days, and it reached its current form in about three days. The author calls it a work in progress.

How it works

Each user message starts a generator-based cycle. The LLM response streams token by token, tool calls are intercepted and dispatched in-process, and the loop repeats. The loop supports error recovery, mid-run questions to the user, message queuing and a plan mode for multi-step work.

The 60+ tools cover navigation, decompiler output, disassembly, cross-references, strings, annotations, types, scripting, and host-specific IL and microcode manipulation. The agent asks permission before running scripts and never executes the target binary.

flowchart LR
  O[Orchestrator maps imports, exports, strings, key functions] --> A[Subagent 1]
  O --> B[Subagent 2]
  O --> C[Subagent N]
  A --> S[Orchestrator synthesis]
  B --> S
  C --> S

Other features:

• /modify (experimental) takes a plain-English change request and applies patches. The demo makes a maze game let the player pass through walls.
• /deobfuscation (experimental, Binary Ninja only) uses plan mode and IL read/write to remove control flow flattening, opaque predicates, MBA expressions and junk code.
• Findings persist across sessions in RIKUGAN.md, which sits next to the database.
• It ships 12 built-in skills, accepts custom skills, and can also use MCP servers. It can reuse skills and MCP servers from Claude Code and Codex.
• Profiles limit which data the LLM can read and which tools it may call, and they can add custom filtering rules.

Evidence

The only measured claim is for deobfuscation: about 3x faster than the original manual workflow, which took about 4:30 minutes. No sample or setup is given. Model comparisons are the author's informal notes from local tests.

Both Anthropic models use prompt caching. For them, the author recommends a Claude Pro/Max plan with OAuth over API billing.

How to use it

The installer detects IDA Pro, Binary Ninja or both.

curl -fsSL https://raw.githubusercontent.com/buzzer-re/Rikugan/main/install.sh | bash

irm https://raw.githubusercontent.com/buzzer-re/Rikugan/main/install.ps1 | iex

Requirements are Python 3.10+, at least one LLM provider, and Windows, macOS or Linux. Windows users need the latest Microsoft Visual C++ Redistributable 2015-2022 x64. Rikugan uses IDA's bundled PySide6/Shiboken, and an outdated runtime can crash it at startup. Manual setup and configuration are in the project docs.

Limits

• With IDA Pro on Python 3.14 or later, Shiboken has a known use-after-free bug. Rikugan includes a workaround, but the author says Python 3.10 is the safest choice.
• Patching and deobfuscation are marked experimental, and deobfuscation works only in Binary Ninja.
• Binary Ninja headless mode is not supported, since the requirement is UI mode.
• The README states no licence.
• The install method pipes a remote script straight into a shell, so the script should be reviewed first.