ai-native reverse engineering + offensive security workspace. one place to load a binary, disassemble / decompile / emulate it, debug it live, crack open its network traffic, and drive the whole thing in plain english, all behind one typed tool layer (~286 tools) you reach from the ui, from an ai copilot baked into the app, from claude code / cursor (over mcp), or from a lil rhai script.
macos apple silicon. tauri v2: rust core (src-tauri/) + react/ts ui (src/).
static analysis. load pe / elf / mach-o and recover functions + xrefs, disassemble
x86 / x64 / arm64 (capstone), and browse it like an ide: a linear listing, a per-function
view, call graphs, cross-references, strings (+ ioc / url / path extraction), imports /
exports / symbols / sections, and format-specific tables (pe headers/imports/resources/
tls, elf segments/dynamic/plt, mach-o load commands / GOT / chained fixups). fat mach-o,
.app bundles, and .ipa archives all just open (cicada pulls out the real inner binary).
decompilation. cicada bundles its own ghidra and warms a decompile server per program: C pseudocode, rich function prototypes, recovered data types, and the full function list ghidra finds on stripped binaries (way more than the symbol pass). while it runs you get a loading screen showing exactly which phase its on.
dynamic. a real lldb-backed debugger (breakpoints, stepping, registers, memory, watchpoints, threads, backtraces), a unicorn emulator (run / step / per-instruction register trace / memory maps), and a full frida engine (spawn/attach, hook, objc method swizzle, ssl-pinning + anti-debug bypass, memory scan/read/write, stalker, module/export enumeration).
offensive web + recon. an intercepting tls-mitm proxy that only decrypts in-scope hosts (http / websocket / dns capture, timing waterfall, match-and-replace, request park/resolve), a repeater + fuzzer + evidence-only scanner (reflection / redirect / cors / traversal / secrets / graphql / ...), recon (dns, whois, port scan, subdomains via crt.sh, wayback, httpx-style probes), jwt decode/verify, and driving real chrome (via the mantis crate) to capture what a page actually loads.
crypto + exploit dev. findcrypt-style constant scanning, entropy maps, embedded key / cert extraction, hashing + encrypt/decrypt, a cyberchef-style encode pipeline; plus rop / jop gadget search, rop-chain building, cyclic patterns, badchars, format-string payload builders, and a clang-backed shellcode assembler.
mobile / ios. open an .ipa straight (it unpacks the app's main mach-o), read the
bundle (Info.plist, entitlements, provisioning, frameworks, plugins, url schemes), and
re-sign a mach-o with get-task-allow so a hardened app is debuggable / frida-injectable.
flags FairPlay-encrypted binaries honestly (an app-store binary's __TEXT is ciphertext,
nothing disassembles that without a decrypted dump).
macos platform. checksec / code-signature / entitlement parsing, process listing, SIP status, TCC.db (needs full disk access), launchd / xpc / sandbox-profile / keychain / dyld-shared-cache inspection. privileged stuff surfaces the requirement plainly and never suggests turning a protection off.
reverse-electron. if the binary is an electron app, cicada cracks the app.asar and
shows the real bundled js/ts in an ide-style source browser (monaco editor, file tree,
filter, extract-all) instead of the meaningless native launcher stub.
patching + workspace. in-place byte / assembly patching (writes to a new file, never the original), notes / bookmarks / renames persisted per program, a C type system you define + apply, projects that group binaries, and a scope gate that keeps every active (outbound / side-effecting) tool pointed only at targets you added on purpose.
needs the rust toolchain, node + pnpm, and (for emulation) brew install unicorn pkgconf.
decompilation uses a bundled ghidra (or set GHIDRA_INSTALL_DIR). frida spawn/attach into a
hardened app needs SIP off + the right boot-args — cicada tells you when.
pnpm install
pnpm tauri devor drive it from an mcp client (json-rpc over stdio):
cargo build --release --bin cicada-mcp
claude mcp add cicada -- ./src-tauri/target/release/cicada-mcp