User manual

Development status: RHEXA is not yet published as a package. It is installed from source. The command and the MCP server are called rhexa.

Concepts

Target: The artefact under examination: a native program, a library, an app, a web page, a capture. RHEXA identifies it by its SHA-256 hash.
Session: open_binary opens a target; the Rhexa Engine starts on the first analysis call and keeps the analysed program until close_binary.
Engine and providers: Deep static analysis is done by the Rhexa Engine. For a transition period RHEXA supports further providers (Hopper, IDA) that the roadmap removes.
Evidence: Every result is evidence with artefact identity, tool, parameters, engine version and location. Observations, inferences, hypotheses and open questions stay separate; missing coverage is reported.
Unknowns: What cannot be backed by evidence is recorded as unknown instead of guessed.

Working with the agent

Ask concrete questions with path and goal, such as "Which function writes file X?" or "What changes between version 1 and 2?".
Ask explicitly for evidence; the agent then cites addresses, functions and locations.
With many tools, the agent loads their descriptions on demand (ToolSearch), which keeps the context small.
For program functions the agent opens the target with open_binary first; without an open target the analysis tools answer with target_unavailable.

Key tools

Tool	Purpose
`open_binary`, `close_binary`	open a target or close the session, optionally with a snapshot
`binary_overview`	format, architecture, segments, number of functions and strings
`list_procedures`, `search_strings`, `list_strings`	search inventories
`analyze_function`, `procedure_pseudo_code`	function dossier or pseudocode
`read_bytes`, `inspect_native_instruction`	memory contents and single instructions
`disassemble_range`	listing of a section or address range; data stays data
`run_engine_script`	curated engine scripts: `raw_strings`, `instruction_search`, `function_graph`, `cpp_classes`
`inspect_object_file`	header, sections, symbols, relocations and DWARF line tables of ELF, PE and Mach-O as the file states them
`capture_process_scenario`	run and observe a program under control (runtime)

The agent itself or rhexa --help shows the complete list.

Command line

rhexa providers --json                            # available analysis providers
rhexa analyze  <target> --provider ghidra --json   # overview
rhexa search   <target> "text" --provider ghidra --json
rhexa function <target> <name|address> --provider ghidra --json
rhexa decompile <target> <address> --provider ghidra --json
rhexa xrefs    <target> <address> --provider ghidra --json
rhexa trace    <target> "text" --provider ghidra --json

Without --json a readable summary is printed. The exit code is 0 on success and non-zero on a typed error, whose code and remedy appear in the output.

Snapshots and evidence

When closing a session, a snapshot can be written that contains target, analysis profile and all evidence:

close_binary  snapshot_path=/path/investigation.snapshot.json

On the command line, commands load a saved snapshot with --snapshot, so the analysis does not have to be repeated. Evidence can also be exported as a bundle, imported and compared.

Runtime observation

Where static analysis is not enough, RHEXA can start and observe processes under control, use Frida sessions or observe web pages in a browser. These tools execute code and are marked accordingly in the tool contract.

Limits

Platform verification runs for macOS and Windows are still pending.
Analysis projects do not yet survive the session (planned for phase 3).
Some formats need optional third-party tools until the engine covers them.