I’ve tried a few plugins that use LLMs to clean up Hex-Rays pseudocode, but none of them really fit my workflow, so I started building my own.
My main focus is Windows kernel driver analysis, so this one is tuned for that use case.
Left: raw Hex-Rays output
Right: output from my plugin
Current features:
- Uses a WDK-header-based kernel API profile for functions, enums, structs, and macros
- Reconstructs common kernel patterns like LIST_ENTRY traversal, CONTAINING_RECORD, critical regions, and pool alloc/free
- Converts numeric literals into symbolic names for NTSTATUS, pool flags, pool tags, etc.
- Simplifies noisy Hex-Rays casts and pointer arithmetic into struct fields and kernel macros
- Renames cleanup, failfast, and error labels into meaningful control-flow targets
- Combines deterministic rules with LLM assistance instead of relying only on the model
If there’s interest, I’ll share more soon.