Tools / Interfaces

Choose your interface

Use the desktop for exploration, the CLI for artifact production, and the SDK or service for revisioned workflows.

Desktop workbench#

hydir connects the function browser to disassembly, CFG, P-code, native IR, typed C, Types, Evidence, Region Studio, Frida sessions, and a docked Triton console. Start with the checked-in PRISM ELF, or inspect the stripped password fixture.

cargo run --locked --bin hydir -- --open-local demo/hydir-prism.elf hydir_stage_decision

Quick start · PRISM workflow · Workbench reference

Command-line tools#

hydirctl doctor checks relevant runtime prerequisites. Native commands include discover, lift, decompile, coverage, and address explanations. The ghidra, ghidra-project, and ghidra-snapshot groups handle managed analysis, saved snapshots, tracing, and LLVM.

cargo run --locked --bin hydirctl -- doctor
cargo run --locked --bin hydirctl -- discover demo/hydir-prism.elf
cargo run --locked --bin hydirctl -- model init demo/hydir-prism.elf --output model.json
cargo run --locked --bin hydirctl -- model verify demo/hydir-prism.elf model.json

Use model and local for typed facts; replay, capture, snapshot, solve, and recipe for the bounded investigation workflow. frida-worker status and frida-worker install manage the packaged Windows observer. Supported arguments and command scope are documented with each workflow below.

Python SDK and authenticated service#

hydird stores projects, immutable binary revisions, analyst facts, and content-addressed artifacts. The Python SDK negotiates v3 then v2/v1 and checks returned revisions, media types, schema versions, and SHA-256 digests. v3 exposes native jobs, Ghidra worker operations, typed model edits, and per-stage artifacts; the remote CLI covers established v1/v2 operations.

Projects have viewer, analyst, operator, and admin roles. Plaintext transport is loopback-only; non-loopback connections require TLS. Durable jobs support cancellation and sequenced event replay. Upload is explicit, mutations require the expected revision, and the service does not execute uploaded ELF files.

Python SDK reference · Service and authorization guide · Remote setup and revision checks

Integration runtimes#

Ghidra: managed pinned worker or local 12.1.4 installation; raw P-code is the semantic input.
Triton: optional Python dependency selected with HYDIR_TRITON_PYTHON; bounded symbolic exploration.
Frida: optional Linux observer, or packaged WSL2 worker on Windows; argv/file inputs.
Replay and capture: Linux x86-64, Bubblewrap isolation probes, and GDB for captured-state workflows.
LLVM: optional export and restricted experiments/rebuilds; toolchain prerequisites vary by workflow.

On-site technical manuals#

Read the technical documentation index for full command and artifact references, including native IR, typed C, replay, Ghidra, and the Python SDK.

Repository documentation#

On-site guides cover the supported workflows. These source references provide implementation and contribution context. Planning documents describe intended work; they are not feature completion claims.