Chimera

Reverse-engineering platform for desktop and mobile binaries. Many backends, one interface.

Chimera is a unified wrapper around Ghidra, radare2, jadx, Frida, capa, YARA and a growing set of platform-specific tools. It analyzes Windows PE / .NET, Linux ELF, macOS Mach-O, Android APKs and iOS IPAs through one CLI, one project store and one HTTP API — no LLM required — and exposes an MCP server so Claude or any compatible model can drive the pipeline.

Features

Cross-platform static analysis — PE / .NET, ELF, Mach-O, APK, IPA, WASM and firmware: triage → decompile → annotate → patch → export.
Desktop / native RE — r2 and Ghidra decompilers, a FLIRT-style library-function matcher, persistent renames/comments/types, byte-level patching with anti-debug recipes, UPX auto-unpack, packer detection, and a gdb symbol bridge.
Mobile RE — APK/IPA pipeline, manifest/NSC hardening findings, protection detection (root/jailbreak/Frida/debugger/packer), Frida instrumentation, and Flutter (B(l)utter) / React Native (Hermes) extraction.
Solving primitives — symbolic execution (angr), emulation (unicorn), CFG deflattening, dispatch-table recovery, crypto/RSA/AES helpers, YARA solving.
Binary exploitation — checksec, GOT/PLT extraction, ROP gadget finder (14 presets), vulnerability pattern detection (18 patterns), mutation fuzzer, crash analysis with De Bruijn offsets, GDB-based AppCall, heap analysis.
Malware analysis — IoC extraction, CobaltStrike beacon config parsing, .NET RAT config extraction (XWorm/AsyncRAT/Warzone), API hash resolution (DJB2/CRC32/ROR13), shellcode triage, YARA rule generation, anti-analysis detection, multi-layer script deobfuscation, packer detection, DLL sideload detection.
Memory & firmware — Volatility memory triage, UEFI firmware carving, ELF core-dump triage, Docker/OCI container extraction.
Sibling tools — mantis SAST integration (RE→SAST bridge with native C/C++ rules), centurion mobile toolkit bridge (42 tools for Android/iOS analysis).
AI-assisted (optional, opt-in) — LLM-backed decompiler refinement and naming, VarBERT variable recovery, and the EMBER malware classifier. None of this runs on the default analyze path.

Install

Chimera runs on bare metal. Requires Python 3.12+. External tools (radare2, jadx, Ghidra, Frida, …) are discovered on PATH and skipped gracefully when absent.

git clone https://github.com/TyrusRC/chimera.git
cd chimera
scripts/setup.sh          # full install: venv + all pip deps + apt tools + sibling projects
scripts/setup.sh --check  # dry-run: show what's installed and what's missing
scripts/setup.sh --yes    # non-interactive: install everything including apt packages

The setup script installs the full toolkit by default: RE (radare2, jadx, gdb), exploit (pwntools, ropper, frida, keystone), malware analysis (yara, capa, floss), and sibling projects (mantis SAST, centurion mobile) when found alongside chimera. Use --minimal for just the venv + core Python deps.

chimera doctor          # external-tool + environment health check, with install hints
chimera analyze app.apk
chimera install         # register chimera with your MCP agent hosts

Docker (isolation sandbox)

For reversing an untrusted target in a disposable environment. The image bundles pinned radare2, jadx and Ghidra:

docker compose up -d
docker run --rm -v "$PWD:/projects" chimera:latest analyze /projects/app.apk

Usage

chimera analyze app.apk                    # full pipeline (PE/ELF/Mach-O/APK/IPA)
chimera analyze app.ipa --ghidra-home /opt/ghidra
chimera detect-protections app.apk         # root/jailbreak/Frida/debugger/packer
chimera manifest app.apk --format json     # Android manifest + NSC findings
chimera diff <sha-a> <sha-b>               # compare two analyses
chimera sdks app.apk                        # third-party SDKs
chimera patch target.exe --nop 0x401000    # byte/asm patching (dry-run by default)

Run chimera --help for the full command set.

MCP (133 tools)

Chimera exposes an MCP server so an agent (Claude Code or any MCP client) can drive the whole pipeline. Register it with chimera install.

Module	Tools	Purpose
session	5	analyze, status, multi-binary session
query	17	functions, strings, imports, sections, callgraph, disasm, diff
detection	13	protections, framework, SDKs, protocols, capa, FLOSS, YARA
annotate	7	rename, comment, type, classify, note, batch
exploit	18	checksec, GOT/PLT, ROP, vuln scan, fuzzer, crash, AppCall, heap
solving	22	decompile, symexec, emulate, patch, crypto, cfg, pathfind
unpacking	14	PyInstaller, Docker, Node, Tauri, Flutter, .NET, WASM, firmware
dynamic	11	AFL++, dotnet-trace, emulate, Wine, sandbox, breakpoints, QEMU
external	3	mantis SAST, centurion mobile (list + run)
frida	7	spawn, attach, exec, load script, messages
devices	7	adb connect, packages, logcat, proxy, pull
vm	7	QEMU VM lifecycle (snapshot, revert, start, stop, exec)
skills	2	list + get chimera workflow skills

12 workflow skills ship with chimera: re-workflow, exploit-workflow, malware-triage, desktop-re, mobile-re, dynamic-analysis, crypto-re, sandbox, sast-bridge, sast-workflow, python-bytecode, gpu-acceleration.

Dependencies

scripts/setup.sh installs everything — no optional tools. Run chimera doctor for the health check.

License

Apache License 2.0.

chimera ★ 3