PseudoNote

An AI-powered IDA Pro plugin for malware reverse engineering.

What is PseudoNote?

PseudoNote is an IDA Pro plugin that brings AI assistance directly into your reverse engineering workflow. It is designed for malware analysts who want to move faster during malware analysis which automatically renaming unknown sub_ functions, explaining what code does, generating readable C rewrites, spotting malicious indicators, producing full HTML forensic reports and more!

Everything PseudoNote generates like notes, renamed symbols, AI analysis, chat history - is saved directly into the IDB file, so your work is never lost between sessions.

Feature Overview

Feature	Description
PseudoNote Pane
Readable C	Generate AI-rewritten, human-readable C code for the current function; saved to IDB
Function Details	View callers, callees, API references, and string references for the current function
Analyst Notes	Integrated Markdown editor with live preview and formatting toolbar; saved to IDB
Custom Prompt	Interactively define per-function AI prompts with assembly/pseudocode context
Execution Flow	AI-generated plain-English execution flow graph showing branches and intent
Renaming
Rename Function	AI-powered rename of the current function (Code or Malware mode)
Rename Variables	AI suggests meaningful local variable names and applies them
Bulk Function Renamer	Batch-rename hundreds of functions with AI using queued workers
Bulk Variable Renamer	Batch-rename local variables across many functions
Commenting
Add Comments	Inline comments added to pseudocode, synced to IDA-view
Section Comments	Block-level comments on disassembly sections
Analysis
Ask Chat (AI)	Persistent dockable chat about the currently open function
Bulk Function Analyzer	Tag and classify functions by malware behavior categories
Deep Analyzer	Full recursive bottom-up analysis pipeline with HTML forensic report
Function Chain Summarizer	Map-Reduce style AI execution flow summaries across a call graph
FLOSS Strings Discovery	Discover stack strings, tight strings, and decoded strings
Shellcode Analysis	Static analysis of selected shellcode bytes/disassembly
Function Prototype	AI infers and applies C calling conventions and prototypes
Struct Editor	AI infers struct layout from variable field access patterns
Utilities
Call Highlighter	Highlight function calls in pseudocode and disassembly views
Call Tree	Interactive dnSpy-style lazy-loaded tree viewer for recursive code references and API tracking
Search Utilities	Search bytes/strings in VirusTotal, Google, GitHub, MSDN, CyberChef
Hex View	Alternative hex viewer for IDA Pro with several useful features
Vftable List	Scans vftables and lists every virtual method, its direct callers, and functions referencing the table
Advance copy	Copy bytes to assist YARA rules creation

Installation

1. Copy the Plugin Files

Copy these two items into your IDA plugins/ directory:

PseudoNote.py file
pseudonote/ folder

<IDA install dir>/
└── plugins/
    ├── PseudoNote.py
    └── pseudonote/
        ├── plugin.py
        ├── handlers.py
        ├── ai_client.py
        ├── config.py
        ├── view.py
        ├── renamer.py
        ├── var_renamer.py
        ├── analyzer.py
        ├── deep_analyzer.py
        ├── report_generator.py
        ├── floss_strings.py
        ├── chat.py
        ├── idb_storage.py
        ├── highlight.py
        ├── api_taxonomy.py
        ├── malware_api_tags.json
        ├── qt_compat.py
        └── ...

2. Install Python Dependencies

Run the following in your terminal using the same Python that IDA uses:

pip install openai httpx PySide6

Optional, to use Anthropic (Claude) or Google Gemini providers:

pip install anthropic google-generativeai

Here is the complete section with detailed commands for both the apt method and setting up a local virtual environment (.venv), formatted inside a Markdown block so you can directly copy and paste it into your README.md.

2. Install Python Dependencies

Run the following in your terminal using the same Python that IDA uses:

pip install openai httpx PySide6

Linux installation

Because IDA uses a central system-wide Python environment by default, package management depends on your OS configuration.

Method A: Install via pip (Universal & Recommended)
This is the most reliable method for specialized VMs (like REMnux) or standard distributions.

pip install openai httpx PySide6 --break-system-packages

Why --break-system-packages? Modern Python environments (3.11+) block system-wide pip installs to prevent conflicts with OS package managers. Since IDA natively uses the system Python, appending this flag safely overrides the block so IDA can load the plugin's dependencies. Note: You must have an active internet connection to run this!

Method B: Install via APT (Debian/Ubuntu)
If you prefer not to use pip, some recent Debian/Ubuntu versions provide these packages directly:

sudo apt update
sudo apt install python3-httpx python3-openai python3-pyside6.qtcore python3-pyside6.qtgui python3-pyside6.qtwidgets

(If apt says "Unable to locate package", your OS repository does not carry them. You must fall back to Method A).

Optional: Install additional providers (Anthropic / Google Gemini)

pip install anthropic google-generativeai

3. Configure your AI Provider

Open the settings dialog:

Right-Click anywhere in Pseudocode or IDA-View > PseudoNote > Configure Settings...

Or via the menu: Edit > Plugins > PseudoNote > Configure Settings...

Enter your API key, select your provider and model, then click Test Connection before saving.

If IDA is installed in Program Files and cannot write there, the config will be automatically saved to ~/.pseudonote.ini. You will be notified when this happens.

Configuration & AI Providers

PseudoNote supports six AI providers:

Provider	Status	Notes
OpenAI	Fully tested	GPT-4, GPT-4o, etc. Recommended for best results
LM Studio	Fully tested	Local models via OpenAI-compatible endpoint
OpenAI-Compatible	Fully tested	Any endpoint speaking the OpenAI API spec
DeepSeek	Not fully tested	Compatible with OpenAI endpoint format
Anthropic (Claude)	Not fully tested	Requires `anthropic` Python package
Google Gemini	Not fully tested	Requires `google-generativeai` Python package
Ollama	Not fully tested	Local models via `http://localhost:11434/v1`

If your provider speaks the OpenAI API spec, use the OpenAI-Compatible tab and enter your custom base URL and model name. This works for most self-hosted or alternative providers.

Quick Start

Open a binary in IDA Pro and let IDA finish auto-analysis.
Navigate to a function in the pseudocode view.
Right-click > PseudoNote > pick an action.
Or use a hotkey from the table below.

Pseudocode right click menu:

IDA view' right click menu:

All Actions & Hotkeys

Action	Hotkey	Availability
Show PseudoNote Panes	`Ctrl+Alt+G`	Both
View Saved Notes	`Ctrl+Alt+L`	Both
Configure Settings	menu only	Both
Rename Function (Code)	`Ctrl+Alt+N`	Both
Rename Function (Malware)	`Ctrl+Alt+M`	Both
Rename Variables	`Ctrl+Alt+R`	Both
Function Prototype	`Ctrl+Alt+S`	Pseudocode
Add Comments (Pseudocode)	`Ctrl+Alt+C`	Pseudocode
Add Section Comments (IDA-View)	menu only	Disassembly
Delete Comments (Pseudocode)	`Ctrl+Alt+D`	Pseudocode
Delete Comments (IDA-View)	menu only	Disassembly
Ask Chat (AI)	`Ctrl+Alt+A`	Both
Bulk Function Renamer	`Ctrl+Shift+R`	Both
Bulk Variable Renamer	`Ctrl+Shift+V`	Both
Bulk Function Analyzer	`Ctrl+Shift+A`	Both
Deep Analyzer	`Ctrl+Shift+S`	Both
Function Chain Summarizer	menu only	Both
FLOSS Strings Discovery	`Ctrl+Shift+F`	Both
Shellcode Analysis (Static)	menu only	Disassembly
Toggle Call Highlight (Pseudocode)	`Ctrl+Alt+H`	Pseudocode
Toggle Call Highlight (Graph/Linear)	menu only	Disassembly
Interactive Call Hierarchy	`Ctrl+Alt+X`	Both
Struct Editor	`Ctrl+Alt+E`	Pseudocode
Search Bytes in VirusTotal	right-click, select bytes	Disassembly
Add Bytes to CyberChef	right-click, select bytes	Disassembly
Search String in VirusTotal	right-click, highlight text	Both
Search String in Google	right-click, highlight text	Both
Search String in GitHub	right-click, highlight text	Both
Search String (WinAPI) in MSDN	right-click, highlight text	Both
Add String to CyberChef	right-click, highlight text	Both

Features In Depth

PseudoNote Pane

The main dockable side panel. Open it with Ctrl+Alt+G.

The pane contains seven tabs, each serving a distinct purpose during analysis.

Readable Code

Displays AI-generated, human-readable C code for the currently active function. When you click Generate, the plugin decompiles the function using Hex-Rays, sends the output to the AI, and receives a cleaned-up, well-commented version of the code.

Key behaviours:

You can request a rewrite in a different language (Python, Rust, Go, etc.) by selecting the target language before generating.
The generated code is shown in a syntax-highlighted editor.
The result is saved to the IDB automatically keyed to the function address, so it is restored the next time you open the same function.
You can regenerate at any time to get an updated result after renaming or modifying the function.

Markdown Notes

A full Markdown editor integrated directly into IDA. Use it to write and organize your analysis findings for each function.

Key features:

Live preview — toggle between the raw Markdown editor and a rendered preview at any time
Formatting toolbar — one-click buttons for bold, italic, headings, code blocks, bullet lists, and horizontal rules
Auto-save to IDB — notes are saved directly into the IDB file keyed to the function address; no external files needed
Per-function scope — each function has its own note. Notes are restored automatically when you navigate to a function.
Export — notes can be copied as plain Markdown for use in external reports

Typical use cases: documenting what a function does, logging IOCs found, noting questions for later, tracking renamed items.

Custom Prompt

Located within the Analyst Notes section, the Custom Prompt sub-tab allows you to query the AI with entirely custom, ad-hoc instructions for the selected function.

Key features:

Toggle switches to automatically include Pseudocode and/or raw Assembly Context alongside your query.
Responses and prompts are automatically persisted per-function within the IDB so you can revisit your custom analysis.

Function Explain

Explain what does the current function do.

Tree Graph

Displays a text-based, high-level execution flow graph for the current function, generated by AI.

Unlike a raw call graph, this is a narrative representation of how execution moves through the function — showing decision branches, loops, and the intent behind each block in plain English.

Example output:

├─ Attempt to enable debug privileges
│  └─ If enabling debug privileges succeeds
│     ├─ Retrieve the explorer process ID
│     │  └─ If explorer process ID is valid
│     │     ├─ Open the explorer process with required access rights
│     │     │  └─ If process handle is valid
│     │     │     ├─ Obtain the primary token of the explorer process
│     │     │     │  └─ If token retrieval succeeds
│     │     │     │     ├─ Impersonate the logged-on user associated with the token
│     │     │     │     │  └─ If impersonation succeeds
│     │     │     │     │     ├─ Close the token handle
│     │     │     │     │     ├─ Close the process handle
│     │     │     │     │     └─ Return success (1)
│     │     │     │     └─ If impersonation fails
│     │     │     │        ├─ Close the token handle if valid
│     │     │     │        └─ Close the process handle if valid
│     │     │     └─ If token retrieval fails
│     │     │        ├─ Close the process handle if valid
│     │     │        └─ Proceed to failure path
│     │     └─ If process handle is invalid
│     │        └─ Proceed to failure path
│     └─ If explorer process ID is invalid
│        └─ Proceed to failure path
└─ If enabling debug privileges fails
 └─ Return failure (0)

This tab is especially useful when the pseudocode is dense or heavily obfuscated and a plain-language summary of the control flow helps orient the analysis.

Function Details

Displays contextual metadata gathered from IDA about the currently active function without any AI call.

Shown information:

Callers — functions that call this function, with their addresses
Callees (API / Library) — external API and library functions called from this function (e.g., CreateFileW, VirtualAlloc)
Callees (Internal) — other user-defined functions called from this function
String references — string literals referenced by instructions in this function
and more

This tab is useful for quick context gathering before deciding whether to run a deeper AI action.

Rename Function

Hotkeys: Ctrl+Alt+N (Code mode) · Ctrl+Alt+M (Malware mode)

Sends the current function's decompiled pseudocode to the AI and asks for a meaningful name based on what the code actually does.

Code mode — General-purpose. Focused on the logic and behaviour of the code.
Malware mode — Adds a malware analysis context to the prompt. The AI is aware of TTPs, C2 patterns, evasion techniques, and common malware patterns.

A confirmation dialog appears with the suggested name, confidence score, and a brief rationale. You can accept, edit, or reject the suggestion.

The rename prefix (fn_ by default) and an optional address suffix can be configured in Settings.

Rename Variables

Hotkey: Ctrl+Alt+R

Sends the decompiled code to the AI, which returns a mapping of old variable names to new semantic names (e.g., v3 -> socket_fd, v12 -> encrypted_buffer).

The plugin applies all renames directly to the Hex-Rays decompiler using ida_hexrays.rename_lvar(). A fallback verification step is used if a rename returns False due to stale decompiler caches.

Add Comments (Pseudocode)

Hotkey: Ctrl+Alt+C

The AI reads the decompiled code and adds inline comments at key logic points. Comments are written as Hex-Rays user comments and are also synced with the disassembly view as repeatable comments.

Add Section Comments (IDA-View)

Menu: Edit > Plugins > PseudoNote > Add Section Comments (IDA-View)

Works in the disassembly view. The AI groups instructions into logical sections and provides a short plain-English label for each (e.g., init stack frame, validate argument, call export resolver).

This action also works on a selection. Highlight a range of instructions in IDA-View, then trigger the action — only the selected range is sent to the AI. This is particularly useful for analysing embedded shellcode blobs within a larger function.

Function Prototype

Hotkey: Ctrl+Alt+S

The AI infers the function's calling convention, parameter names, parameter types, and return type, then applies the result directly to IDA using idc.apply_type(). The generated prototype can be reviewed before applying.

Struct Editor

Access: Right-click on a variable name in pseudocode > PseudoNote > Struct editor

Opens a dialog with a blank struct template. Click AI Suggestion to have the AI infer the structure layout by analysing all field accesses in the current function and its callers (e.g., ptr + 0x18, v5->field_20).

You can optionally provide the exact total size of the struct so the AI can calculate padding precisely. After generation you can:

Edit the definition manually in the code editor
Copy to Clipboard
Apply to IDA — parses and imports it into Local Types (Shift+F1), then asks if you want to apply the type to the variable

Ask Chat (AI)

Hotkey: Ctrl+Alt+A

Opens a dockable chat window contextualised to the current function. The AI is pre-loaded with the function's decompiled code so you can ask targeted questions:

"What API does this function use to achieve persistence?"
"What does v7 represent here?"
"Is this a known decryption algorithm?"
"Rewrite this in Python."

Chat history is persisted to the IDB per function. When you return to a function, the history is automatically restored. When you navigate to a different function, the chat seamlessly switches context with a notification.

Bulk Function Renamer

Hotkey: Ctrl+Shift+R

A batch-renaming tool that can rename hundreds of functions in one session.

Key features:

Function list with checkboxes to include or exclude specific functions
Filter to show only unnamed (sub_*) functions and hide system/library functions
Queue system — functions are categorised into high, medium, low priority based on complexity
Configurable batch size and number of parallel workers
Preview before apply — review all suggested renames before committing
Configurable rate-limit cooldown between API batches
Prefix and address suffix naming style (e.g., fn_my_function_401000)

The AI is strictly constrained: it does not invent names without evidence. Functions that only call sub_* with no strings or known API evidence receive a wrap_<offset> name with a confidence of 30% or below.

Bulk Variable Renamer

Hotkey: Ctrl+Shift+V

Same batch architecture as the function renamer, but for local variables across many functions.

Processes functions in configurable batch sizes
Sends each function's decompiled code to the AI and receives a {old_name: new_name} mapping
Applies renames via ida_hexrays.rename_lvar() with a verification fallback
Shows per-function rename counts and failures in the results table
Results are stored in the IDB for review after the session

Bulk Function Analyzer

Hotkey: Ctrl+Shift+A

A fast triage tool that classifies every function with a malware behaviour tag and confidence percentage, without deep per-function analysis.

Tags include: malicious, suspicious, benign, with sub-categories such as networking, encryption, injection, persistence, file_ops, evasion, and others.

The analyzer uses:

Static heuristics — API taxonomy lookup against malware_api_tags.json for known-malicious Windows API patterns
AI classification — sends decompiled code, strings, and API call list to the AI for a verdict
Entropy and complexity scoring — factors in byte entropy and CFG branch count as additional signals
Combination rules — detects dangerous API combinations (e.g., VirtualAlloc + WriteProcessMemory + CreateRemoteThread = process injection)

Results are displayed in a sortable, filterable table. You can filter by tag or double-click to navigate to a function.

Function Chain Summarizer

Menu: Right-click in Disassembly/Pseudocode > PseudoNote > Function Chain Summarizer

A specialized, lightweight alternative to to the Deep Analyzer. Instead of renaming symbols and outputting massive HTML reports, this tool builds a functional Map-Reduce text summary of exactly what an execution chain does.

Key Features:

Call Graph Mapping: Discovers up to your configured node limit (e.g. 150 functions) natively without polluting the IDB with premature renames.
Smart Filtering: Bypasses libraries, API thunks, and trivially small noise/padding functions automatically.
Map-Reduce Architecture: Breaks the massive graph of targeted functions into safe chunks, asks the AI to analyze them securely without token overflow, and synthesizes a final cohesive Markdown report representing the top-down logic.
Persistence: Generated summaries are persistently stored in the IDB netnode. Opening the Summarizer on a previously analyzed chain instantly loads the saved Map-Reduced report!

Deep Analyzer

Hotkey: Ctrl+Shift+S

The most powerful feature in PseudoNote. A full recursive, multi-stage analysis pipeline that:

Builds a complete call graph from your chosen entry point
Renames all functions and variables bottom-up, starting from leaf functions
Performs deep per-function AI analysis
Uses caller context to upgrade or downgrade risk assessments
Generates a comprehensive HTML forensic report

See the Deep Analyzer Pipeline section below for the full stage-by-stage breakdown.

HTML Report Example on PhantomNet sample analysis

FLOSS Strings Discovery

Hotkey: Ctrl+Shift+F

Integrates FLOSS (FLARE Obfuscated String Solver) directly into IDA.

FLOSS finds strings that do not appear in normal string scans because they are:

Stack strings — built character-by-character on the stack
Tight strings — constructed in tight loops
Decoded strings — decrypted or deobfuscated at runtime

Setup: Install FLOSS and configure its full path in Settings > External Tools > FLOSS Path.

Results are shown in a tabbed IDA chooser with columns for Type, String value, and Function address. Clicking a result navigates to the relevant function. Results are persisted to the IDB so you do not need to re-run FLOSS every session.

Bytes/Instruction/Shellcode Analysis

Menu: Edit > Plugins > PseudoNote > Bytes/Instruction/Shellcode Analysis)

Opens a static analysis dialog for selected Bytes/Instruction/Shellcode. Select a byte range in IDA-View before launching — the selected bytes and disassembly are pre-loaded into the dialog. The AI provides a high-level analysis of the Bytes/Instruction/Shellcode's likely purpose, technique, and target platform.

Tested primarily with msfvenom-generated shellcode.

Call Highlighter

Menu: Edit > Plugins > PseudoNote > Toggle Call Highlight (Pseudocode / Graph/Linear)

Highlights function calls visually:

In pseudocode — highlights any line containing a function call with a light lavender background
In disassembly — highlights call and jmp instructions with the same colour

Also highlights any function with a fn_, wrap_, or sub_ prefix, making it easy to identify which calls have already been renamed versus which are still unknown.

Call Tree

Hotkey: Ctrl+Alt+X

A dedicated, floating interactive tree viewer (inspired by tools like dnSpy) for browsing function cross-references (Used By) and dependencies (Uses).

This acts as a massively upgraded replacement for IDA's native Alt+X cross-references window:

Recursive Expansion: Lazily load sub-functions infinitely by expanding graph leaf nodes, letting you visually trace execution pathways without losing your UI context.
API Highlighting: Optionally resolve .idata thunks and extern pointers to their visible API string names natively inline (e.g., __imp_LoadLibraryA).
Live Search Filtering: Includes a top-docked text filter that dynamically prunes the hierarchy down to exactly the functions or APIs you are searching for.
Navigation: Double-click on any element in the tree to automatically snap your IDB to the calling instruction.

Search Utilities

Available from the right-click context menu in Disassembly or Pseudocode views.

Action	How to trigger	What it does
Search Bytes in VirusTotal	Select bytes in IDA-View, right-click	Opens VT content search for the selected hex bytes
Add Bytes to CyberChef	Select bytes in IDA-View, right-click	Base64-encodes and opens CyberChef with bytes as input
Search String in VirusTotal	Highlight text, right-click	Searches the string as file content in VT
Search String in Google	Highlight text, right-click	Exact-phrase Google search
Search String in GitHub	Highlight text, right-click	Code search on GitHub
Search String (WinAPI) in MSDN	Highlight text, right-click	MSDN Documentation search
Add String to CyberChef	Highlight text, right-click	Opens CyberChef with the string as input

If no text is highlighted when triggering a string search, a prompt dialog appears asking you to type the search term manually.

IDA View Advance Copy

Menu: Right-click in IDA-View (Disassembly) > PseudoNote > IDA View Advance copy

Highly optimized copy formats designed for malware reporting and signature development. This utility extracts raw bytes and opcodes directly from the current selection and converts them into various ready-to-use formats.

Format	Description
YARA Raw	Raw hex bytes formatted for YARA rules (e.g., `{ 55 8B EC 83 EC 10 }`)
YARA Mask	Auto-generates wildcards (`??`) for immediate offsets and relative jumps
YARA No Imm	Masks all immediate values, useful for finding similar functions with different constants
YARA Opcodes	Extracts only the opcodes and prefixes, ignoring operands entirely
YARA Rule	Generates a complete, valid YARA rule template for the selected code
Python	Formats bytes as a Python byte string: `b"\x55\x8b\xec..."`
C Array	Formats bytes as a C hex array: `unsigned char data[] = { 0x55, 0x8B, ... };`
Disassembly	Copies the clean disassembly text without the address/offset prefixes

Typical use cases: Creating YARA signatures for malicious functions, extracting shellcode for a Python emulator, or copying clean code logic into a technical report.

Hex Viewer

The PseudoNote Hex Viewer is a custom dockable pane that provides a clean and simple hex editor view of the entire loaded binary. It is designed as a companion to the IDA-View and Pseudocode panes for tasks that require working directly with raw bytes.

Opening the Hex Viewer

Method	Action
Hotkey	`Ctrl+Alt+B`
Right-click menu	`PseudoNote > Hex Viewer`
Plugin menu	`Edit > Plugins > PseudoNote > Hex Viewer`

Layout

The viewer is divided into three columns:

Address gutter — absolute EA for each row in hex.
Hex bytes — 16 bytes per row, grouped in sets of 8. Non-loaded bytes display as ...
ASCII — printable characters rendered inline; non-printable bytes shown as ·.

The view automatically adapts to IDA's current color theme (light or dark) by reading Qt's palette directly from the embedded widget at paint time.

Cursor Sync

When Auto-follow cursor is enabled (default), the Hex Viewer scrolls to and marks the currently selected byte in IDA-View or Pseudocode with a red rectangle. Uncheck the box or use Sync Now to control syncing manually.

Navigating the Binary

The viewer loads the entire binary memory map (all segments) on open. Use the Jump to EA input field in the toolbar to navigate directly to any address:

Type or paste a hex address into the field.
Press Enter or click Go.

Selecting Bytes

Action	Result
Left-click	Set selection start at byte
Left-click + drag	Select a contiguous byte range
Shift + Click	Extend existing selection to clicked byte
Shift + Scroll Up	Scroll view up and extend selection to top-visible row
Shift + Scroll Down	Scroll view down and extend selection to bottom-visible row

The status bar at the bottom shows the current EA, selected range, and byte value in hex, decimal, and ASCII.

Copying Selected Bytes

Right-click any selection to open the copy menu:

Format	Output Example
Hex Bytes	`55 8B EC 83 EC 10`
YARA pattern	`{ 55 8B EC 83 EC 10 }`
Python literal	`b"\x55\x8b\xec\x83\xec\x10"`
C/C++ array	`unsigned char data[6] = { 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x10 };`
Base64	Standard base64-encoded string

Highlighting Byte Ranges

Multiple byte ranges can be highlighted simultaneously with distinct colors, useful for annotating protocol fields, shellcode stages, or suspicious sequences during manual analysis.

Select a byte range by clicking and dragging (or using Shift+Click / Shift+Scroll for large ranges).
Right-click and choose Highlight selection...
Set a label (optional) and pick a color from the dialog.
Click OK — the range is immediately highlighted in both the hex and ASCII columns.

To remove a highlight, right-click any highlighted byte and choose Remove highlight: label. To remove all, choose Clear all highlights.

Highlights are rendered as flat, seamless color fills matching the style of most professional hex editors — no per-byte boxes or borders.

Bulk Analyzer vs Deep Analyzer

Aspect	Bulk Function Analyzer	Deep Analyzer
Purpose	Fast triage — tag and classify every function	Full forensic analysis from a chosen entry point
Scope	Flat list of all functions in the binary	Recursive call graph from your chosen root function
Analysis depth	Single-pass AI per function batch	Multi-stage pipeline (7 stages)
Call graph	No	Yes, full bottom-up traversal
Variable renaming	No	Yes, per-function bottom-up
Readable C generation	No	Yes
Output	Tag and confidence in UI table; saved to IDB	IDB renames + full HTML report + disk artifacts
Speed	Fast (parallelised batches)	Slow (thorough; configurable stages)
Best for	Initial triage of an unknown binary	Deep dive into a specific execution path

Recommended workflow:

Run Bulk Function Analyzer first to get a bird's-eye view and identify suspicious functions.
Pick an interesting malicious-tagged function as the entry point for the Deep Analyzer.
Use Ask Chat to investigate specific functions in detail.

Deep Analyzer Pipeline

The Deep Analyzer runs in two major phases across 7 stages.

PHASE 1: Discovery & Preparation

Stage 1 — Environment Setup

Initialises workspace directories alongside the IDB, detects the binary path from IDA, validates that the AI is configured, and checks all dependencies. A workspace folder named DeepAnalyzer_{EntryFunction}_{Filename}_{Timestamp} is created next to the IDB file.

Stage 2 — Recursive Call Graph Discovery

Starting from your chosen entry function, the analyser recursively traverses all callees using IDA's cross-reference engine. It builds a complete FuncNode graph with:

Caller and callee relationships
Function depth from the entry point
Library and thunk detection (excluded from deep analysis by default)
Configurable limits: max nodes, max depth, max callees per node, max queue size

Stage 3 — Initial Function & Variable Renaming

Eliminates sub_XXXXXX names before the deep analysis begins. Uses a bottom-up approach (leaf functions first) so that by the time a caller is analysed, its callees already have meaningful names.

Variable rename via the Bulk Variable Renamer pipeline
Function rename using the same AI prompts as the standalone rename actions
Configurable prefix (da_ by default) and optional address suffix

PHASE 2: Deep Malicious Code Analysis

Stage 4 — Initial Code Analysis + Readable C Generation

For each function in the call graph, the AI:

Rewrites the decompiled code into clean, readable C
Performs a baseline threat assessment (encryption, networking, file I/O, process injection, etc.)
Assigns an initial risk tag (malicious, suspicious, benign)
Identifies technical indicators

Generated readable C is saved to <workspace>/readable/ on disk.

Stage 5 — Contextual Code Analysis Refinement

Re-analyses each function with caller context. The AI now knows why a function is being called. This allows:

Upgrading benign-looking utility functions when called from a malicious context
Downgrading false positives when the caller context shows legitimate usage
Propagating behavioural intent up and down the call chain

Stage 6 — Report Data Generation

Synthesises all collected analysis data:

Executive summary
IOC extraction (IPs, domains, registry keys, file paths, mutex names)
String categorisation
MITRE ATT&CK technique mapping
Mermaid call graph rendering
Function-level risk heat map

Stage 7 — HTML Report Generation

Generates a self-contained styled HTML report saved to <workspace>/report.html. The report includes:

Executive summary with overall risk assessment
MITRE ATT&CK coverage table
Per-function analysis cards with readable C, indicators, and risk badges
IOC table
String analysis section
Interactive call graph (Mermaid diagram)

Bulk Function Analyzer Pipeline

Load all functions — scans every defined function in the binary
Filter — optionally skip system/library functions and functions with no code
Static pre-tagging — applies the malware API taxonomy without any LLM call; fast heuristic based on API names seen in each function
Batch AI classification — groups functions into configurable batches, sends decompiled pseudocode, strings, and API call list to the AI
Result application — updates the tag, confidence, and reason in the UI table and saves to IDB
Retry logic — failed batches are automatically queued for retry

Data Persistence

PseudoNote stores everything inside the IDA database (IDB file) using IDA's native NetNode mechanism.

AI analysis, renamed symbols, notes, and chat history survive IDA restarts
Sharing the IDB with teammates means they see all your annotations
No external database or server is required for core functionality

Data	Storage Location	IDB Tag
Readable C (per function)	IDB NetNode `$ pseudonote:readable_c`	tag 0
Chat history (per function)	IDB NetNode (same node)	tag 90
Variable rename results	IDB NetNode (same node)	tag 91
Analyzer results (tag/confidence)	IDB NetNode (same node)	tag 90
FLOSS string results	IDB NetNode `$ pseudonote:floss_results`	—
Analyst notes (Markdown)	IDB NetNode	—
Function Chain Summary	IDB NetNode (same node)	tag 90
Custom Prompts	IDB NetNode (same node)	tag 92

Deep Analyzer disk artifacts are saved alongside the IDB:

<idb_directory>/
└── <binary_name>_pseudonote/
    ├── decomp/          <- raw Hex-Rays decompiled code
    ├── readable/        <- AI-generated readable C
    ├── exec_flow/       <- execution flow text graphs
    └── report.html      <- full forensic HTML report

Configuration File Reference

The config is stored at PseudoNote.ini in the plugin folder, or ~/.pseudonote.ini if the plugin folder is not writable.

Section	Key	Default	Description
`[PseudoNote]`	`PROVIDER`	`openai`	Active AI provider
`[Analysis]`	`BULK_BATCH_SIZE`	`10`	Functions per batch (Bulk Renamer)
`[Analysis]`	`BULK_WORKERS`	`5`	Parallel worker threads (Bulk Renamer)
`[Analysis]`	`BULK_COOLDOWN`	`22`	Seconds between batches
`[Analysis]`	`VAR_BATCH_SIZE`	`5`	Functions per batch (Var Renamer)
`[Analysis]`	`DEEP_MAX_LINES`	`200`	Max decompiled lines per function (Deep Analyzer)
`[Analysis]`	`MAX_GRAPH_NODES`	`500`	Max call graph nodes (Deep Analyzer)
`[Analysis]`	`MAX_GRAPH_DEPTH`	`15`	Max call graph depth (Deep Analyzer)
`[Analysis]`	`DEEP_VAR_RENAME`	`True`	Enable variable rename in Deep Analyzer
`[Analysis]`	`DEEP_FUNC_COMMENT`	`True`	Enable function commenting in Deep Analyzer
`[Analysis]`	`DEEP_REFINEMENT`	`True`	Enable Stage 5 contextual refinement
`[ExternalTools]`	`FLOSS_PATH`	(empty)	Full path to the floss executable
`[Fonts]`	`CODE_FONT`	`Consolas`	Font for code display areas

Start with Bulk Analyzer for orientation

Before jumping into Deep Analyzer, run the Bulk Analyzer to map which functions are suspicious. This helps you choose a good entry point for the deep analysis.

Use "Rename Function (Malware)" for malware samples

The malware-specific prompt gives the AI additional context about TTPs. This often produces more accurate names for functions like loaders, injectors, and C2 communication routines.

Select shellcode bytes before using Section Comments

In IDA-View, select a byte range then trigger Section Comments. Only the selected range is sent to the AI — ideal for analysing embedded shellcode blobs within a larger function.

Chat is your interactive companion

Use Ask Chat when you are unsure about a specific piece of code. The AI already has the decompiled code as context — ask precise questions like "What is v5 on line 23?" without pasting any code manually.

Tune batch sizes for your rate limits

If you hit API rate limits, reduce BULK_WORKERS and increase BULK_COOLDOWN in settings. For local models (Ollama, LM Studio), you can set BULK_COOLDOWN=0 and increase workers freely.

FLOSS results persist

Once you run FLOSS Strings Discovery, the results are saved to the IDB. Subsequent sessions load from the IDB instantly without re-running FLOSS.

Troubleshooting

Problem	Likely Cause	Fix
Plugin does not load	Missing `openai` or `httpx` package	Run `pip install openai httpx` with IDA's Python
"AI Provider not configured"	No API key saved	Open Settings, enter key, click Save
AI requests time out	Network issue or proxy needed	Set proxy in Settings > PseudoNote tab
Variable rename shows failures	Hex-Rays stale decompiler cache	Normal for some variables; a fallback verification step is built in
Deep Analyzer crashes on large binaries	Call graph too large	Reduce `MAX_GRAPH_NODES` and `MAX_GRAPH_DEPTH` in Settings
FLOSS produces no results	Wrong FLOSS path configured	Verify the `floss` executable path in Settings > External Tools
Config not saving	Permission denied on Program Files	Config auto-falls back to `~/.pseudonote.ini`
"Hex-Rays not available" on startup	Hex-Rays decompiler not licensed	Features requiring pseudocode (rename, comments) need a Hex-Rays licence

All AI-generated results should be treated as assistance, not ground truth. Always verify critical findings manually.

Name		Name	Last commit message	Last commit date
pseudonote		pseudonote
PseudoNote.py		PseudoNote.py
README.md		README.md
deep_analyzer_example_report.html		deep_analyzer_example_report.html
install_changed_files_ida83.bat		install_changed_files_ida83.bat

Latest commit

History

Folders and files

Repository files navigation

PseudoNote

Table of Contents

What is PseudoNote?

Feature Overview

Installation

1. Copy the Plugin Files

2. Install Python Dependencies

2. Install Python Dependencies

Linux installation

Optional: Install additional providers (Anthropic / Google Gemini)

3. Configure your AI Provider

Configuration & AI Providers

Quick Start

All Actions & Hotkeys

Features In Depth

PseudoNote Pane

Readable Code

Markdown Notes

Custom Prompt

Function Explain

Tree Graph

Function Details

Rename Function

Rename Variables

Add Comments (Pseudocode)

Add Section Comments (IDA-View)

Function Prototype

Struct Editor

Ask Chat (AI)

Bulk Function Renamer

Bulk Variable Renamer

Bulk Function Analyzer

Function Chain Summarizer

Deep Analyzer

HTML Report Example on PhantomNet sample analysis

FLOSS Strings Discovery

Bytes/Instruction/Shellcode Analysis

Call Highlighter

Call Tree

Search Utilities

IDA View Advance Copy

Hex Viewer

Bulk Analyzer vs Deep Analyzer

Deep Analyzer Pipeline

PHASE 1: Discovery & Preparation

Stage 1 — Environment Setup

Stage 2 — Recursive Call Graph Discovery

Stage 3 — Initial Function & Variable Renaming

PHASE 2: Deep Malicious Code Analysis

Stage 4 — Initial Code Analysis + Readable C Generation

Stage 5 — Contextual Code Analysis Refinement

Stage 6 — Report Data Generation

Stage 7 — HTML Report Generation

Bulk Function Analyzer Pipeline

Data Persistence

Configuration File Reference

Troubleshooting

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages