I wanted to share some background on the latest phase of my journey contributing to the reverse engineering tool landscape. If you’ve spent time doing reverse engineering or security research, you’ve probably run into some version of the same friction points I kept hitting: * the work is time-intensive * it’s hard to share or reuse * and a lot of insight disappears into private notes or one-off analyses At the same time, the tools I rely on, like Ghidra, Binary Ninja, and IDA Pro, are incredibly powerful. But they’re still largely built for **individual workflows**, with limited support for persisting high-level understanding across analyses. That led to an earlier phase of work where I built the GhidrAssist, BinAssist, and IDAssist AI plugins, along with their MCP server companions. Those helped a lot with efficiency and knowledge distillation, but they didn’t fully address the problem of sharing and accumulating symbols and higher-level intelligence over time. So I started building something to explore a different approach. **SymGraph** is an attempt to make reverse engineering more *persistent* and *collaborative*: * representing binaries as structured graphs instead of just disassembly * using AI to help annotate and connect insights * and making it easier to carry knowledge from one analysis to the next The workflow is simple. You analyze a binary in your existing tool, sync it through a plugin, and let SymGraph and the community build and enrich a shared representation that you can revisit and build on over time. It’s not meant to replace tools like Binary Ninja, Ghidra, or IDA Pro. The goal is to sit alongside them via plugins and gradually build a reusable layer of understanding across analyses. Something that can be shared easily, regardless of which tool someone prefers. SymGraph includes its own AI-enabled reverse engineering service based on the same **ReAct** architecture used in the plugins that is capable of analyzing modern binaries, identifying core functionality, generating accurate symbol names, identifying core functionality and producing detailed reports. So you can upload binaries directly to SymGraph and it will automatically analyse them and produce Vulnerability Reports, Malware Analysis Reports, etc. while you continue to work on other things - it takes on the drudgery so you can focus on the bigger picture. I’m trying to be deliberate about how AI is used. This isn’t about adding AI for its own sake. The goal is to use it pragmatically, leaning on it where it’s strong, like pattern recognition, annotation, and linking context, while keeping the analyst and the distilled knowledge front and center. I think of it as a force multiplier, not a replacement. It boosts your analytic speed and effectiveness but keeps you in the driver's seat. As underlying AI models improve, the system improves with them. Annotations get better, connections get clearer, and work becomes more valuable over time. It’s still early, and there’s a lot to figure out, especially around how, and if, shared intelligence in this space actually works in practice. But even in its current form, it’s already been useful in my own workflow, which feels like a good starting point. If you’re working in reverse engineering, malware analysis, or low-level security and this resonates, I’d be interested to hear how you’re approaching similar problems. In the meantime, why not give it a try? https://symgraph.ai/

SymGraph

Building the Knowledge Layer for Binary Reverse Engineering

Building the Knowledge Layer for Binary Reverse Engineering