Hey there.
Ask anything. I can search the web, read your documents, run Python, and generate images.
🎨 Image generator
Top-tier local image generation (Z-Image-Turbo). Generating an image briefly pauses the chat model while it uses the GPU, then hands it back.
Negative prompt (optional)
✨ Artifacts
Interactive apps and 3D models the assistant builds for you. Just ask — e.g. "build me a mortgage calculator" or "model a drone frame I can 3D-print."
🔬 C Decompiler
Upload a compiled binary. We run Ghidra, refine it with LLM4Decompile, then have the model rewrite it into clean, commented, compilable C — every result is verified with gcc. The chat model pauses briefly to borrow the GPU.
🛡️ Hardware Backdoor Hunter
An autonomous agent that reverse-engineers a chip's undocumented behavior — hidden debug modes, secret-leaking registers, unlock sequences — from black-box probing. Give it a datasheet and access to the device's bus (never the netlist); it hunts for behavior the datasheet never mentions, reconstructs the trigger, and reports it.
Paste a Verilog module and a short datasheet of its documented behavior. The agent probes it black-box (via Icarus Verilog) for behavior the datasheet doesn't mention — hidden registers, undocumented opcodes, unlock sequences — and reports the exact trigger.
One agent, five mechanism classes, plus real Verilog
Each device plants a different backdoor with a randomized, sealed trigger. Success is objective: recover a trigger that makes the device emit the sealed secret. "Probes" = simulated device cycles, counted identically for the LLM strategist and the blind baseline.
| Mechanism class | Result | Cracked by | LLM probes | Blind probes |
|---|---|---|---|---|
| Hidden addressread a reserved address → secret | ✓ solved | LLM | 10 | 6 |
| Knock sequencereserved reads in order unlock a leak | ✓ solved | LLM | 5 | 3,478 |
| Undocumented opcodea reserved command dumps a secret | ✓ solved | LLM | 2 | 3 |
| Counter time-bombN repeats trip a leak — no datasheet cue | ✓ solved | blind fallback | — | 2,674 |
| Factory-region hintknock in a 256-addr space; datasheet flags 0xF0–0xFF | ✓ solved | LLM | 7,637 | 95,710 |
| Real Verilog devicecfgblk.v, simulated by Icarus Verilog | ✓ solved | LLM | 6 | — |
Hybrid: 6/6. Blind pipeline alone: 5/5 (it also cracks the hint device — by tiling the whole address space). LLM alone: 4/5 (it misses the no-cue time-bomb). Clean control devices: 0 findings.
The LLM isn't magic — it's a query-efficiency & targeting win
For a known, small set of mechanism classes a well-built blind pipeline solves everything — an LLM isn't required for coverage. What the LLM buys is real: it reads the datasheet and searches the right region instead of exhaustively sweeping (13× fewer probes on the hint device, ~700× on the knock). Where the datasheet gives no cue — the time-bomb — the exhaustive sweep is what saves the run. Neither half is complete; the hybrid is.
How it works
Drives the device through its bus, returns outputs only, counts every cycle. Backs onto pyrtl or a real RTL simulator.
Every output is compared to a datasheet reference. Documented behavior collapses to "OK"; only true deviations surface.
Reads the datasheet for where backdoors hide (reserved ranges, undefined opcodes, factory regions) and proposes the next experiment + a tight input alphabet.
Directed probing, active automata learning (L*) to reconstruct a hidden state machine, and repeat-sweeps for counters.
Replay the trigger from a clean reset; only a reproduced leak is reported. Out comes a pentest-style findings report.
🔬 We red-teamed our own claims — and corrected them
An adversarial review of this pipeline found three real integrity issues; all fixed before publishing these numbers. The honest result is what's shown above.
- Overstated baseline — an earlier claim said "no blind pipeline can crack the hint device." A blind pipeline that tiles the space cracks it too. FIXED — claim is now "LLM is 13× cheaper," not "only the LLM can."
- Inconsistent cost accounting — automata-learning runs weren't counting the equivalence-oracle's simulation steps. FIXED — every cycle counted, both solvers.
- Non-reproducible RNG — the learner's random walk was unseeded. FIXED — seeded.
📡 Signal Leakage Miner
Undirected discovery of information-leakage side channels. It probes every internal signal over a randomized campaign, measures the statistical association (mutual information) between all of them, then goes down the ranked list and writes off the understood couplings — the documented datapath, shared clock/reset, internal buffers. Whatever survives is an undocumented dependency: a secret correlated with a signal it shouldn't touch.
Paste a Verilog module and name the sensitive signal (a key/secret). The miner drives it with a randomized campaign, probes every internal wire via a VCD dump, and reports which signals carry information about your secret — where it leaks — with the model separating expected datapath couplings from suspicious ones (an observable port exposing the key).
🧩 Symbolic Binary Solver
Upload a compiled binary and say what you want. The model reads its strings and imports, plans a solve, and angr symbolically explores the program's paths to compute a concrete input that reaches your goal — a crackme's password, a license key, an input that reaches a target branch. The binary is never executed (angr emulates it), so it's safe on untrusted uploads.
🎯 IterionFuzz — Fuzz Harness Synthesizer
Upload a stripped shared library (.so) with no headers or
source. IterionFuzz recovers its attack surface with Ghidra, infers each parser's ABI
from the decompiled pseudo-C, and the local model synthesizes a ready-to-compile
binary-only fuzz harness targeting the attacker-reachable parse entry — the reverse
engineering that normally costs hours. You get a dlopen harness that fuzzes the stripped
.so directly (AFL++ Frida coverage + libdislocator + valgrind — no source), plus a
source-build variant. The upload is analyzed statically and never executed on our server.
.so — libexif, libpng, a vendor blob… up to 20 MB
.so for you inside an isolated
bwrap sandbox (no network, no host filesystem, no devices) and report real crashes,
confirmed with valgrind — ~2–3 min.
.so. To actually fuzz, compile
the synthesized harness against an AddressSanitizer build of the target (the exact commands are printed
with your result), then run AFL++. Validated end-to-end on libexif and stb_image, where the synthesized
harness found real memory-safety bugs.
🛰️ Cyber Situational Awareness
Loading…
💬 Team Board
Share notes with the team under your username — good for keeping everyone in sync.
⚙️ RTL Design & Verify Copilot
Describe a hardware module in plain English. The model writes synthesizable Verilog, an auto-generated self-checking testbench verifies it in Icarus Verilog, failures are repaired automatically, and yosys confirms it synthesizes and reports the gate count. You get HDL that actually compiles, passes its tests, and synthesizes — not just plausible-looking code.