MCP Agent Malanalyzer

基于AI Agent的自动化恶意程序分析平台 / AI Agent-Based Automated Malware Analysis Platform

English | 中文

中文版本

📋 项目简介

本项目是一个基于AI Agent的自动化恶意程序分析平台，通过结合IDA Pro静态分析工具和AI大语言模型（支持DeepSeek和阿里云百炼），实现对二进制恶意程序的智能分析和报告生成。

💡 项目背景与设计理念

应急响应中的痛点

在实际的应急响应过程中，恶意样本分析几乎是绕不开的一环。无论是服务器被植入后门、终端出现可疑进程，还是在溯源阶段拿到的未知二进制文件，最终都会回到同一个问题：

这个样本到底在干什么？危害有多大？是否需要立即处置？

但现实情况往往并不理想。在真实的应急场景中，我们经常会遇到：

• 样本数量多、时间紧，分析窗口被严重压缩
• 需要人工使用 IDA / Ghidra 一点点翻函数、追调用链，过程非常耗时
• 真正有价值、能反映恶意行为的函数，可能只占整个程序的极小一部分
• 却不得不在大量"无意义 / 干扰性代码"中反复跳转、验证、排除

在应急响应中，时间本身就是成本。很多时候，分析不是不会，而是来不及。

MCP 带来的新可能

最近一段时间，MCP（Model Context Protocol）在 AI Agent 圈子里逐渐火了起来。

MCP 的核心思想并不是"再做一个聊天机器人"，而是：

让大模型通过统一协议，真正参与到工具级、流程级的分析过程中。

也就是说，AI 不再只是"你问我答"，而是可以读取工具输出、调用分析能力、参与决策路径选择。

这让我产生了一个想法：

能不能把 IDA 的静态分析能力，通过 MCP 接入 AI Agent，让 AI 像一个"自动化逆向分析助手"，帮我们在第一时间筛选关键函数、判断行为方向、给出分析结论？

如果这个思路成立，那么在应急响应中，AI 至少可以帮我们完成三件事：

1. 快速缩小分析范围 - 把注意力集中到真正"像恶意代码"的位置
2. 智能决策路径 - AI 自主选择需要深入分析的函数和调用链
3. 输出可读结论 - 生成一份可读、可复盘的初步分析结论

一次完整的尝试

基于这个想法，我做了一次完整的实践尝试：

• 使用 IDA Pro + MCP Server，将反汇编与反编译能力以协议形式暴露
• 结合 AI Agent 的多阶段决策流程，而不是一次性"全丢给 AI"
• 从应急响应视角出发，设计一个偏向实战的自动化恶意程序分析平台

下面简单介绍一下这个平台的整体分析原理和流程。

🖼️ 界面预览

Web界面效果图

界面1

界面2

界面3

界面4

界面5

界面6

界面7

界面8

🔬 项目原理

运行原理图

                    ┌─────────────────────┐
                    │   分析入口           │
                    │ 二进制文件上传/启动  │
                    └──────────┬──────────┘
                               │
                ┌──────────────┼──────────────┐
                │              │              │
        ┌───────▼──────┐ ┌────▼────┐ ┌──────▼──────┐
        │ 设置文件路径  │ │连接MCP  │ │初始化AI客户端│
        │ Set Binary   │ │Connect  │ │Init AI      │
        └───────┬──────┘ └────┬────┘ └──────┬──────┘
                │              │              │
                └──────────────┼──────────────┘
                               │
                    ┌──────────▼──────────┐
                    │  Stage 0: 威胁信号检测 │
                    │  ThreatSignalGate    │
                    └──────────┬──────────┘
                               │
            ┌───────────────────┼───────────────────┐
            │                   │                   │
    ┌───────▼──────┐   ┌───────▼──────┐   ┌───────▼──────┐
    │ 提取字符串    │   │ 提取导入表    │   │ 检测高熵区域  │
    │ Extract      │   │ Extract      │   │ Detect High  │
    │ Strings      │   │ Imports      │   │ Entropy      │
    └───────┬──────┘   └───────┬──────┘   └───────┬──────┘
            │                   │                   │
            └───────────────────┼───────────────────┘
                               │
                    ┌──────────▼──────────┐
                    │  开始循环分析       │
                    │ Iterative Analysis │
                    └──────────┬──────────┘
                               │
        ┌───────────────────────┼───────────────────────┐
        │                       │                       │
┌───────▼────────┐    ┌─────────▼─────────┐   ┌─────────▼─────────┐
│ Stage 1:       │    │ Stage 2:          │   │ Stage 3:         │
│ 候选函数定位    │    │ 行为评分          │   │ AI解释           │
│ Candidate      │───▶│ Behavior         │───▶│ AI               │
│ Locator        │    │ Scorer           │   │ Interpreter      │
└───────┬────────┘    └─────────┬─────────┘   └─────────┬─────────┘
        │                       │                       │
        │  ┌────────────────────┼────────────────────┐  │
        │  │                    │                    │  │
        ▼  ▼                    ▼                    ▼  ▼
    ┌──────┐  ┌──────────┐  ┌──────────┐  ┌──────────────┐
    │入口点 │  │交叉引用  │  │API分析   │  │Top-N筛选     │
    │Entry │  │Xref      │  │API       │  │Top-N Filter │
    └──────┘  └──────────┘  └──────────┘  └──────────────┘
        │                       │                       │
        └───────────────────────┼───────────────────────┘
                                │
                    ┌───────────▼───────────┐
                    │   路径展开            │
                    │   Path Expansion      │
                    └───────────┬───────────┘
                                │
                    ┌───────────▼───────────┐
                    │   检查停机条件        │
                    │   Check Stop          │
                    │   Conditions          │
                    └───────────┬───────────┘
                                │
                    ┌───────────▼───────────┐
                    │   生成最终报告        │
                    │   Generate Final      │
                    │   Report              │
                    └───────────────────────┘

分析流程

本平台采用多阶段分析架构，结合传统静态分析和AI智能决策：

1. Stage 0: 威胁信号检测（ThreatSignalGate）

- 基于字符串模式匹配检测可疑字符串 - 分析导入表（Import Table）识别可疑API调用 - 检测高熵区域（加密/压缩代码） - ⚠️ 已知问题：Stage 0阶段的恶意字符统计功能存在bug，统计结果一直为0。经过测试发现，让AI自主分析的效果更好，因此此bug未修复。

1. Stage 1: 候选函数定位（CandidateLocator）

- AI辅助定位高价值分析目标 - 从入口点（Entry Points）出发，通过交叉引用（Xrefs）追踪函数调用链 - 智能选择需要深入分析的函数

1. Stage 2: 行为评分（BehaviorScorer）

- 对每个候选函数进行行为评分 - 基于API调用、字符串引用、反编译失败等特征计算威胁分数 - 生成行为标签（如：网络通信、文件操作、进程注入等）

1. Stage 3: AI解释（AI Interpreter）

- AI对Top-N高价值函数进行深度解释 - 识别函数角色（如：C2通信、载荷加载器、持久化等） - 评估恶意性和置信度

1. 最终报告生成

- 综合所有分析结果生成完整的Markdown格式分析报告 - 包含行为链分析、威胁评估、防护建议等

技术架构

• 前端：Vue 3 + TypeScript + Vite
• 后端：FastAPI + SQLAlchemy + WebSocket
• 分析引擎：IDA Pro + MCP (Model Context Protocol)
• AI模型：DeepSeek / 阿里云百炼（DashScope）
• 容器化：Docker（推荐）

📁 项目目录结构

Analysis_platform/
├── backend/                    # 后端服务
│   ├── app/
│   │   ├── api/               # API路由
│   │   │   ├── auth.py        # 认证相关
│   │   │   ├── config.py      # 配置管理
│   │   │   ├── reports.py     # 报告管理
│   │   │   ├── tasks.py       # 任务管理
│   │   │   └── users.py       # 用户管理
│   │   ├── services/          # 业务逻辑服务
│   │   │   ├── analysis_service.py    # 分析服务
│   │   │   ├── config_service.py     # 配置服务
│   │   │   ├── file_service.py       # 文件服务
│   │   │   ├── queue_service.py      # 队列服务
│   │   │   └── report_service.py     # 报告服务
│   │   ├── main.py            # FastAPI应用入口
│   │   ├── models.py          # 数据库模型
│   │   ├── schemas.py         # Pydantic模式
│   │   ├── database.py        # 数据库配置
│   │   ├── config.py          # 后端配置
│   │   ├── websocket.py       # WebSocket处理
│   │   └── websocket_routes.py # WebSocket路由
│   ├── static/                # 前端构建产物
│   ├── uploads/               # 上传文件目录
│   ├── reports/                # 分析报告目录
│   ├── logs/                  # 日志目录
│   ├── database.db            # SQLite数据库
│   └── create_admin.py         # 创建管理员用户脚本
├── frontend/                   # 前端应用
│   ├── src/
│   │   ├── api/               # API客户端
│   │   ├── components/       # Vue组件
│   │   ├── views/            # 页面视图
│   │   ├── stores/           # Pinia状态管理
│   │   └── router/           # 路由配置
│   ├── package.json
│   └── vite.config.ts
├── ida-docker/                 # Docker相关文件
│   ├── docker-compose.yml     # Docker Compose配置
│   ├── Dockerfile             # Docker镜像构建文件
│   ├── ida-base.tar           # IDA Pro Docker镜像（已构建）
│   └── headless-ida-mcp-server/ # IDA MCP服务器
├── main.py                     # 命令行分析入口
├── analyzer.py                 # 分析器主模块
├── ai_client.py               # AI客户端
├── mcp_client.py              # MCP客户端
├── config.py                  # 全局配置
├── behavior_scorer.py         # 行为评分器
├── threat_signal_gate.py      # 威胁信号门控器（Stage 0）
├── candidate_locator.py       # 候选函数定位器（Stage 1）
├── stop_condition_checker.py  # 停机条件检查器
├── requirements.txt           # Python依赖
├── start.sh                   # 统一启动脚本
├── start_backend.sh           # 后端启动脚本
├── build.sh                   # 前端构建脚本
└── README.md                  # 本文件

⚙️ 配置文件说明

环境变量配置

主要配置项通过环境变量设置，也可以在 config.py 中直接修改：

# IDA MCP服务器地址
export IDA_MCP_SERVER_URL="http://127.0.0.1:8888"

# Docker模式开关（True=容器模式，False=本地模式）
export USE_DOCKER="True"

# Docker镜像名称
export DOCKER_IMAGE="ida-base:latest"

# AI API提供商选择（deepseek 或 dashscope）
export API_PROVIDER="deepseek"

# DeepSeek API配置
export DEEPSEEK_API_KEY="your_deepseek_api_key"
export DEEPSEEK_MODEL="deepseek-chat"

# 阿里云百炼API配置
export DASHSCOPE_API_KEY="your_dashscope_api_key"
export DASHSCOPE_BASE_URL="https://dashscope.aliyuncs.com/compatible-mode/v1"
export DASHSCOPE_MODEL="qwen-plus"

# 分析配置
export MAX_ANALYSIS_ITERATIONS=10        # 最大分析迭代次数
export MAX_DECOMPILED_FUNCTIONS=50      # 最大反编译函数数量
export ALLOW_SAME_MD5_REANALYSIS="True" # 是否允许相同MD5文件重新分析

# 后端配置
export DATABASE_URL="sqlite:///./backend/database.db"
export SECRET_KEY="your-secret-key-change-in-production"
export CORS_ORIGINS="http://localhost:5173"

配置文件位置

• 全局配置：config.py
• 后端配置：backend/app/config.py
• 前端配置：frontend/vite.config.ts

🚀 启动方法

方式一：容器版本（推荐）

容器版本已预配置IDA Pro环境，无需手动安装IDA。

1. 加载Docker镜像

ida-base.tar下载地址:通过网盘分享的文件：MCP-Agent-MalAnalyzer 链接: https://pan.baidu.com/s/1EW4162yvoiC283Ar1Tutmg?pwd=hkrd 提取码: hkrd

# 加载预构建的IDA Pro Docker镜像
docker load -i ida-docker/ida-base.tar

2. 验证镜像

docker images | grep ida-base

应该能看到 ida-base:latest 镜像。

3. 配置环境变量

# 设置AI API密钥（选择其中一个）
export DEEPSEEK_API_KEY="your_deepseek_api_key"
# 或
export DASHSCOPE_API_KEY="your_dashscope_api_key"
export API_PROVIDER="dashscope"  # 或 "deepseek"

# 确保使用Docker模式
export USE_DOCKER="True"

4. 安装Python依赖

pip install -r requirements.txt

5. 启动服务

Web界面模式（推荐）：

./start_backend.sh

服务将在 http://localhost:8000 启动。

命令行模式：

# 设置要分析的文件路径
export BINARY_FILE_PATH="/path/to/your/binary.exe"

# 运行分析
python3 main.py

方式二：非容器版本（需要自己安装IDA）

非容器版本需要手动安装IDA Pro并配置MCP服务器。

1. 安装IDA Pro

• 下载并安装IDA Pro（需要有效的许可证）
• 确保 idat 可执行文件在系统PATH中

2. 配置IDA MCP服务器

cd headless-ida-mcp-server
pip install -r requirements.txt
python3 server.py

MCP服务器默认运行在 http://127.0.0.1:8888

3. 配置环境变量

# 禁用Docker模式
export USE_DOCKER="False"

# 设置IDA MCP服务器地址
export IDA_MCP_SERVER_URL="http://127.0.0.1:8888"

# 设置AI API密钥
export DEEPSEEK_API_KEY="your_deepseek_api_key"

4. 安装Python依赖

pip install -r requirements.txt

5. 启动服务

同容器版本的步骤5。

👤 创建管理员用户

首次使用创建管理员用户(可选)：

cd backend
python3 create_admin.py

📝 使用说明

Web界面使用

1. 访问 http://localhost:8000
2. 使用账号登录
3. 在"上传"页面上传要分析的二进制文件
4. 在"任务"页面查看分析进度
5. 分析完成后在"报告"页面查看详细报告

命令行使用

# 设置文件路径
export BINARY_FILE_PATH="/path/to/binary.exe"

# 运行分析
python3 main.py

分析报告将保存为 analysis_report_*.txt 文件。

🔧 故障排除

Docker相关问题

• 镜像加载失败：确保有足够的磁盘空间，检查tar文件完整性
• 容器启动失败：检查端口8888是否被占用
• 分析超时：增加 MAX_ANALYSIS_ITERATIONS 和 MAX_DECOMPILED_FUNCTIONS

IDA相关问题

• MCP服务器连接失败：检查IDA是否正常运行，端口是否正确
• 反编译失败：某些混淆代码可能无法反编译，系统会自动切换到反汇编模式

AI API相关问题

• API调用失败：检查API密钥是否正确，账户余额是否充足
• 响应超时：检查网络连接，或尝试切换API提供商

📄 许可证

本项目禁止商用，但允许二次开发。

本项目仅供学习和研究使用，不得用于商业用途。您可以基于本项目进行二次开发。

English Version

📋 Project Introduction

This project is an AI Agent-based automated malware analysis platform that combines IDA Pro static analysis tools with AI large language models (supporting DeepSeek and Alibaba Cloud DashScope) to intelligently analyze binary malware and generate reports.

💡 Project Background and Design Philosophy

Pain Points in Incident Response

In real-world incident response scenarios, malware sample analysis is almost unavoidable. Whether it's a backdoor implanted on a server, suspicious processes on endpoints, or unknown binary files obtained during attribution, it all comes down to the same question:

What is this sample actually doing? How severe is the threat? Does it require immediate action?

However, reality is often far from ideal. In real incident response scenarios, we frequently encounter:

• Multiple samples with tight deadlines - analysis windows are severely compressed
• Manual analysis using IDA / Ghidra, going through functions one by one and tracing call chains, which is extremely time-consuming
• Functions that truly reflect malicious behavior may only account for a tiny fraction of the entire program
• Yet we must repeatedly jump, verify, and exclude through large amounts of "meaningless / distracting code"

In incident response, time itself is a cost. Often, the issue isn't that we can't analyze, but that we don't have time.

New Possibilities with MCP

Recently, MCP (Model Context Protocol) has been gaining traction in the AI Agent community.

The core idea of MCP is not to "create another chatbot," but rather:

Enable large language models to truly participate in tool-level and process-level analysis through a unified protocol.

In other words, AI is no longer just "you ask, I answer," but can read tool outputs, invoke analysis capabilities, and participate in decision path selection.

This led to an idea:

Could we integrate IDA's static analysis capabilities with AI Agent through MCP, making AI act like an "automated reverse engineering assistant" that helps us quickly filter key functions, determine behavioral directions, and provide analysis conclusions?

If this approach works, then in incident response, AI could at least help us accomplish three things:

1. Rapidly narrow the analysis scope - Focus attention on locations that truly "look like malicious code"
2. Intelligent decision paths - AI autonomously selects functions and call chains that need in-depth analysis
3. Readable conclusions - Generate a readable, reviewable preliminary analysis report

A Complete Attempt

Based on this idea, I made a complete practical attempt:

• Use IDA Pro + MCP Server to expose disassembly and decompilation capabilities in protocol form
• Combine multi-stage decision processes of AI Agent, rather than throwing everything to AI at once
• Design an automated malware analysis platform focused on practical incident response scenarios

Below is a brief introduction to the overall analysis principles and workflow of this platform.

🖼️ Interface Preview

Web Interface Screenshots

Interface 1

Interface 2

Interface 3

Interface 4

Interface 5

Interface 6

Interface 7

Interface 8

🔬 Project Principles

Runtime Architecture Diagram

                    ┌─────────────────────┐
                    │   Analysis Entry    │
                    │ Binary File Upload │
                    └──────────┬──────────┘
                               │
                ┌──────────────┼──────────────┐
                │              │              │
        ┌───────▼──────┐ ┌────▼────┐ ┌──────▼──────┐
        │ Set Binary   │ │Connect  │ │Init AI      │
        │ Path         │ │MCP      │ │Client       │
        └───────┬──────┘ └────┬────┘ └──────┬──────┘
                │              │              │
                └──────────────┼──────────────┘
                               │
                    ┌──────────▼──────────┐
                    │ Stage 0: Threat     │
                    │ Signal Detection    │
                    └──────────┬──────────┘
                               │
            ┌───────────────────┼───────────────────┐
            │                   │                   │
    ┌───────▼──────┐   ┌───────▼──────┐   ┌───────▼──────┐
    │ Extract      │   │ Extract      │   │ Detect High │
    │ Strings      │   │ Imports      │   │ Entropy      │
    └───────┬──────┘   └───────┬──────┘   └───────┬──────┘
            │                   │                   │
            └───────────────────┼───────────────────┘
                               │
                    ┌──────────▼──────────┐
                    │ Iterative Analysis │
                    └──────────┬──────────┘
                               │
        ┌───────────────────────┼───────────────────────┐
        │                       │                       │
┌───────▼────────┐    ┌─────────▼─────────┐   ┌─────────▼─────────┐
│ Stage 1:       │    │ Stage 2:          │   │ Stage 3:         │
│ Candidate      │───▶│ Behavior         │───▶│ AI               │
│ Locator        │    │ Scorer           │   │ Interpreter      │
└───────┬────────┘    └─────────┬─────────┘   └─────────┬─────────┘
        │                       │                       │
        │  ┌────────────────────┼────────────────────┐  │
        │  │                    │                    │  │
        ▼  ▼                    ▼                    ▼  ▼
    ┌──────┐  ┌──────────┐  ┌──────────┐  ┌──────────────┐
    │Entry │  │Cross-Ref │  │API       │  │Top-N Filter  │
    │Points│  │Xref      │  │Analysis  │  │              │
    └──────┘  └──────────┘  └──────────┘  └──────────────┘
        │                       │                       │
        └───────────────────────┼───────────────────────┘
                                │
                    ┌───────────▼───────────┐
                    │   Path Expansion     │
                    └───────────┬───────────┘
                                │
                    ┌───────────▼───────────┐
                    │  Check Stop            │
                    │  Conditions            │
                    └───────────┬───────────┘
                                │
                    ┌───────────▼───────────┐
                    │  Generate Final       │
                    │  Report               │
                    └───────────────────────┘

Analysis Workflow

The platform adopts a multi-stage analysis architecture, combining traditional static analysis with AI intelligent decision-making:

1. Stage 0: Threat Signal Detection (ThreatSignalGate)

- Detects suspicious strings based on pattern matching - Analyzes Import Table to identify suspicious API calls - Detects high-entropy regions (encrypted/compressed code) - ⚠️ Known Issue: The malicious character statistics feature in Stage 0 has a bug where the count always remains 0. Testing has shown that letting AI analyze autonomously produces better results, so this bug has not been fixed.

1. Stage 1: Candidate Function Location (CandidateLocator)

- AI-assisted location of high-value analysis targets - Starts from entry points and tracks function call chains through cross-references (Xrefs) - Intelligently selects functions that need in-depth analysis

1. Stage 2: Behavior Scoring (BehaviorScorer)

- Scores behavior for each candidate function - Calculates threat scores based on API calls, string references, decompilation failures, etc. - Generates behavior tags (e.g., network communication, file operations, process injection)

1. Stage 3: AI Interpretation (AI Interpreter)

- AI provides deep interpretation of Top-N high-value functions - Identifies function roles (e.g., C2 communication, payload loader, persistence) - Evaluates maliciousness and confidence level

1. Final Report Generation

- Generates comprehensive Markdown-format analysis reports integrating all analysis results - Includes behavior chain analysis, threat assessment, protection recommendations, etc.

Technical Architecture

• Frontend: Vue 3 + TypeScript + Vite
• Backend: FastAPI + SQLAlchemy + WebSocket
• Analysis Engine: IDA Pro + MCP (Model Context Protocol)
• AI Models: DeepSeek / Alibaba Cloud DashScope
• Containerization: Docker (Recommended)

📁 Project Directory Structure

Analysis_platform/
├── backend/                    # Backend service
│   ├── app/
│   │   ├── api/               # API routes
│   │   │   ├── auth.py        # Authentication
│   │   │   ├── config.py      # Configuration management
│   │   │   ├── reports.py     # Report management
│   │   │   ├── tasks.py       # Task management
│   │   │   └── users.py       # User management
│   │   ├── services/          # Business logic services
│   │   │   ├── analysis_service.py    # Analysis service
│   │   │   ├── config_service.py     # Configuration service
│   │   │   ├── file_service.py       # File service
│   │   │   ├── queue_service.py      # Queue service
│   │   │   └── report_service.py     # Report service
│   │   ├── main.py            # FastAPI application entry
│   │   ├── models.py          # Database models
│   │   ├── schemas.py         # Pydantic schemas
│   │   ├── database.py        # Database configuration
│   │   ├── config.py          # Backend configuration
│   │   ├── websocket.py       # WebSocket handling
│   │   └── websocket_routes.py # WebSocket routes
│   ├── static/                # Frontend build artifacts
│   ├── uploads/               # Upload directory
│   ├── reports/                # Analysis reports directory
│   ├── logs/                  # Log directory
│   ├── database.db            # SQLite database
│   └── create_admin.py         # Admin user creation script
├── frontend/                   # Frontend application
│   ├── src/
│   │   ├── api/               # API client
│   │   ├── components/       # Vue components
│   │   ├── views/            # Page views
│   │   ├── stores/           # Pinia state management
│   │   └── router/           # Route configuration
│   ├── package.json
│   └── vite.config.ts
├── ida-docker/                 # Docker-related files
│   ├── docker-compose.yml     # Docker Compose configuration
│   ├── Dockerfile             # Docker image build file
│   ├── ida-base.tar           # IDA Pro Docker image (pre-built)
│   └── headless-ida-mcp-server/ # IDA MCP server
├── main.py                     # Command-line analysis entry
├── analyzer.py                 # Analyzer main module
├── ai_client.py               # AI client
├── mcp_client.py              # MCP client
├── config.py                  # Global configuration
├── behavior_scorer.py         # Behavior scorer
├── threat_signal_gate.py      # Threat signal gate (Stage 0)
├── candidate_locator.py       # Candidate function locator (Stage 1)
├── stop_condition_checker.py  # Stop condition checker
├── requirements.txt           # Python dependencies
├── start.sh                   # Unified startup script
├── start_backend.sh           # Backend startup script
├── build.sh                   # Frontend build script
└── README.md                  # This file

⚙️ Configuration

Environment Variables

Main configuration items are set through environment variables, or can be modified directly in config.py:

# IDA MCP server address
export IDA_MCP_SERVER_URL="http://127.0.0.1:8888"

# Docker mode switch (True=container mode, False=local mode)
export USE_DOCKER="True"

# Docker image name
export DOCKER_IMAGE="ida-base:latest"

# AI API provider selection (deepseek or dashscope)
export API_PROVIDER="deepseek"

# DeepSeek API configuration
export DEEPSEEK_API_KEY="your_deepseek_api_key"
export DEEPSEEK_MODEL="deepseek-chat"

# Alibaba Cloud DashScope API configuration
export DASHSCOPE_API_KEY="your_dashscope_api_key"
export DASHSCOPE_BASE_URL="https://dashscope.aliyuncs.com/compatible-mode/v1"
export DASHSCOPE_MODEL="qwen-plus"

# Analysis configuration
export MAX_ANALYSIS_ITERATIONS=10        # Maximum analysis iterations
export MAX_DECOMPILED_FUNCTIONS=50      # Maximum decompiled functions
export ALLOW_SAME_MD5_REANALYSIS="True" # Allow reanalysis of same MD5 files

# Backend configuration
export DATABASE_URL="sqlite:///./backend/database.db"
export SECRET_KEY="your-secret-key-change-in-production"
export CORS_ORIGINS="http://localhost:5173"

Configuration File Locations

• Global Configuration: config.py
• Backend Configuration: backend/app/config.py
• Frontend Configuration: frontend/vite.config.ts

🚀 Getting Started

Method 1: Container Version (Recommended)

The container version comes with a pre-configured IDA Pro environment, no manual IDA installation required.

1. Load Docker Image

Download address for ida-base.tar:

通过网盘分享的文件：MCP-Agent-MalAnalyzer 链接: https://pan.baidu.com/s/1EW4162yvoiC283Ar1Tutmg?pwd=hkrd 提取码: hkrd

# Load the pre-built IDA Pro Docker image
docker load -i ida-docker/ida-base.tar

2. Verify Image

docker images | grep ida-base

You should see the ida-base:latest image.

3. Configure Environment Variables

# Set AI API key (choose one)
export DEEPSEEK_API_KEY="your_deepseek_api_key"
# or
export DASHSCOPE_API_KEY="your_dashscope_api_key"
export API_PROVIDER="dashscope"  # or "deepseek"

# Ensure Docker mode is enabled
export USE_DOCKER="True"

4. Install Python Dependencies

pip install -r requirements.txt

5. Start Service

Web Interface Mode (Recommended):

./start_backend.sh

The service will start at http://localhost:8000.

Command Line Mode:

# Set the file path to analyze
export BINARY_FILE_PATH="/path/to/your/binary.exe"

# Run analysis
python3 main.py

Method 2: Non-Container Version (Requires Manual IDA Installation)

The non-container version requires manual installation of IDA Pro and MCP server configuration.

1. Install IDA Pro

• Download and install IDA Pro (requires valid license)
• Ensure the idat executable is in the system PATH

2. Configure IDA MCP Server

cd headless-ida-mcp-server
pip install -r requirements.txt
python3 server.py

The MCP server runs on http://127.0.0.1:8888 by default.

3. Configure Environment Variables

# Disable Docker mode
export USE_DOCKER="False"

# Set IDA MCP server address
export IDA_MCP_SERVER_URL="http://127.0.0.1:8888"

# Set AI API key
export DEEPSEEK_API_KEY="your_deepseek_api_key"

4. Install Python Dependencies

pip install -r requirements.txt

5. Start Service

Same as Method 1, Step 5.

👤 Create Admin User

Create an admin user on first use (optional):

cd backend
python3 create_admin.py

📝 Usage

Web Interface

1. Visit http://localhost:8000
2. Log in with your credentials
3. Upload binary files to analyze on the "Upload" page
4. Check analysis progress on the "Tasks" page
5. View detailed reports on the "Reports" page after analysis completes

Command Line

# Set file path
export BINARY_FILE_PATH="/path/to/binary.exe"

# Run analysis
python3 main.py

Analysis reports will be saved as analysis_report_*.txt files.

🔧 Troubleshooting

Docker Issues

• Image load failure: Ensure sufficient disk space, check tar file integrity
• Container startup failure: Check if port 8888 is occupied
• Analysis timeout: Increase MAX_ANALYSIS_ITERATIONS and MAX_DECOMPILED_FUNCTIONS

IDA Issues

• MCP server connection failure: Check if IDA is running properly, verify port is correct
• Decompilation failure: Some obfuscated code may not decompile; the system will automatically switch to disassembly mode

AI API Issues

• API call failure: Check if API key is correct, verify account balance
• Response timeout: Check network connection, or try switching API provider

📄 License

This project is prohibited from commercial use but allows secondary development.

This project is for learning and research purposes only and may not be used for commercial purposes. You may develop based on this project.