English Français العربية

Corvus

Registre officiel Sécurité

Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.

Code source Site web Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

NUGET package CorvusRE
Claude Code 
claude mcp add corvus -- dnx CorvusRE@2.7.0 --yes
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "corvus": {
            "command": "dnx",
            "args": [
                "CorvusRE@2.7.0",
                "--yes"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. Corvus
  2. Quick start
  3. How it works
  4. What you can analyze
  5. Showcases
  6. Why Corvus
  7. Documentation
  8. Responsible use
  9. Star history

Corvus

Reverse engineering for AI agents. Corvus is an MCP server that lets your agent read, trace, compare and patch compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries. One self-contained binary, no runtime to install, nothing uploaded; by default nothing it reads is executed.

[!NOTE] Corvus is under active development. Tools, parameters and output can change between releases; breaking changes are listed in the release notes. Bug reports and feedback are welcome in issues. If Corvus is useful to you, a star helps other people find it.

Quick start · How it works · What you can analyze · Showcases · Why Corvus · Documentation

Quick start

Windows (PowerShell):

irm https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.ps1 | iex

Linux / macOS:

curl -fsSL https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.sh | sh

The installer verifies the download against the release's SHA256SUMS and registers Corvus with the MCP clients it finds. As a plugin (server and skill; needs the .NET 10 SDK): /plugin install corvus --marketplace Albasha0x0/Corvus in Claude Code, codex plugin marketplace add Albasha0x0/Corvus then corvus in /plugins in Codex (installation). Restart your client and ask:

Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.

From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).

How it works

Your agent calls Corvus over MCP. Corvus answers with bounded, structured results: every list pages, every error names the next step, and long results are kept for read_result. The agent follows calls and references, explains the behaviour, and can patch a copy and save it.

Native code is analyzed by Corvus's own engine (x86, x64, ARM32, ARM64), with IDA or Ghidra as optional decompilers when installed. Their databases and output are kept, so the second question about a binary is fast.

What you can analyze

TargetWhat you getNeeds
.NET assembliesC# decompilation, IL, references, call graphs, build comparison, C# and IL patching, savingnothing
Unity and Il2Cpp gamesmetadata, addresses, string literals, IDA / Ghidra scripts, C++ bindingsnothing
Native binaries (PE, ELF, Mach-O)functions, disassembly, CFG, cross-references, values, RTTI, PDB types, similar functionsnothing
Native pseudocodedecompilation, engine types, frames, scriptingIDA 9 (idalib) or Ghidra 12
NativeAOT and ReadyToRunmethod names, MethodTables, strings, precompiled codenothing
Native patchingnames, comments, byte and assembly patches, patched copies, carried to new buildsnothing
Containerssingle-file bundles, NuGet, APK, ASAR, Unity WebGL, HAR captures, installers (MSI, NSIS, Inno Setup, WiX Burn), frozen Python programs, firmware images; CycloneDX SBOM, YARA-X matchesnothing
Android packagesmanifest, resources, DEX, smali, Java (JADX), JNI bindings, devices over adbJADX for Java, adb for devices
Crash dumpsWindows minidumps, Linux and macOS core dumps, .NET exceptions, stacks, heap; crash textnothing
Running programssessions with stop points, call recording, code coverage, activity traces, snapshots and child processes on Windows, Linux and macOSFrida 17.24.3 or newer 17.x; off by default

Full list: features and the tool reference (165 tools, 15 prompts).

Showcases

  • Decompile, rebuild, run: an assembly exported as a C# project that builds with warnings as errors, runs with the same output, and is measured against the original.
  • Inside a single-file app: a .NET single-file executable extracted without running it, its assemblies extracted byte for byte.
  • Where SQLite makes its random numbers: a crypto constant in a native SQLite build traced to sqlite3_randomness and its callers, recorded as an evidence bundle and re-verified.
  • A Json.NET error traced to its code: "Self referencing loop detected" followed from the message to the deciding setting and every caller, with the evidence re-verified.

Each step in the showcases and guides is checked by a test.

Why Corvus

  • Works with nothing installed. Native analysis, .NET decompilation, containers and dumps are built in.
  • Fast. Results come from saved indexes and engine databases; warm calls answer in milliseconds.
  • Sized for agents. Every result fits a token budget per part, with paging and kept results.
  • Edits, not just reads. Patch .NET and native code in memory, review the diff, save a verified copy, and carry names and patches to the next build.
  • Every platform. Windows, Linux (glibc and musl) and macOS, x64 and arm64: win-x64, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64 and osx-arm64.

Supported clients: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, VS Code Insiders, VSCodium, Cline, Roo Code, Kilo Code, Visual Studio, Codex, Gemini CLI, Qwen Code, GitHub Copilot CLI, OpenCode, Crush, Zed, LM Studio, Amazon Q, Kiro, Antigravity, Devin, Command Code, Grok Build, OMP and Pi. Any other client: corvus config.

Documentation

Installation · Configuration · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes · All pages

Guides: first session · decode and patch · new build.

Responsible use

Analyze software you own or are permitted to analyze. Decompiling, patching or redistributing third-party code can be restricted by its license and by law where you live.

Contributing · Security · MIT license

Star history

Questions fréquentes

Qu'est-ce que Corvus ?

Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.

Comment installer Corvus ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add corvus -- dnx CorvusRE@2.7.0 --yes. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour Corvus ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

Corvus est-il open source ?

Oui. Son code est sur GitHub sous licence Apache-2.0.

Qui maintient Corvus ?

Il est publié par Albasha0x0. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.