Zfinix/eleven

Eleven

An agent-first reverse-engineering app for macOS, Windows and Linux.

Eleven is a reverse-engineering app built around agents. Drop in an app, a binary, an Android APK, a GPU kernel, a shader or a model and ask what it does. Any agent that speaks the Agent Client Protocol can read the code, follow references, rename functions, leave notes and suggest patches, while you watch and approve in the same window.

Native code is read by Ghidra through REA, or by Rizin when you want files to open in seconds. Android apps are read by jadx. The UI is React rendered natively on GPUI by GPUIX.

Features

• Bring your own agent. Aster, Claude, Codex, Gemini, Cursor, Copilot, OpenCode and any other ACP agent. Run several on the same project, each in its own chat.
• Agents drive the window. Eleven serves its own MCP tools so an agent can open a function, switch views, rename, add notes, change types and propose patches.
• Ask about any code. Select lines in pseudocode, assembly or a source file and ask, explain or copy them. The answer opens under the lines, and a suggested rename arrives as a card you accept or decline.
• You stay in control. Every change by you or an agent is logged with its author and can be undone. Byte patches from agents arrive as suggestions you accept or decline.
• Mach-O, ELF and PE. Functions, pseudocode, assembly, control-flow graph, cross-references, strings, segments and hex. Change a line's type (code, procedure, data, string) and number format with Hopper's keys.
• Android apps. APKs open with Java from jadx, smali from apktool when it's installed, string resources, and the manifest, res, assets and native libraries in a Resources list. Split bundles (.xapk, .apks) open with every split in place.
• Source files. Eleven finds the source files a binary was built from, reads Swift types straight from the binary, and has your agent recreate a whole file, with each function linked back to its address.
• Rewrite in any language. Show a function's pseudocode rewritten by your agent in C, C++, Rust, Go, Swift, Python, TypeScript, Java, C# or Zig.
• GPU kernels. CUDA and HIP fat binaries open as highlighted PTX, with notes beside each block and rewrites in CUDA C++, HIP C++ or Metal.
• Shaders, models and GPU profiles. Metal shaders and ML model files (GGUF, safetensors, PyTorch, ONNX) open in the workbench, linked to the code that loads them. Profile with Instruments.
• Projects. A project is one app or binary and holds its chats, agents, renames, bookmarks, notes and patches. Press ⌘S to save it as a single .eleven file you can share. Nothing is written there until you do.
• Patching. Edit bytes at an address and write a patched copy. The original is never touched.
• Diffing. Compare two builds by function and read the changes like a code review.
• Debugging. Run a program under LLDB, break on the function you are looking at, step and read locals.
• Playbooks. Built-in skills such as first look, name functions, trace a feature and network map work with any agent.
• Export. Pseudocode, assembly, control-flow graphs as PDF and Objective-C class inventories.

Install

macOS 14 or later on Apple Silicon:

curl -fsSL https://eleven.chizi.app/install.sh | bash

This installs Eleven.app into /Applications. Builds are not notarized yet, so the installer clears the download quarantine for you.

Windows x64, in PowerShell:

irm https://eleven.chizi.app/install.ps1 | iex

Linux x64: download the AppImage or the .tar.gz from the latest release.

On first run Eleven walks you through picking an engine and an agent, and installs what's missing for you:

• Rizin opens most apps in seconds.
• Ghidra 12.x with Java 21 is slower and gives the clearest pseudocode. Eleven downloads both, or uses copies it finds in ~/.local/share, ~/Applications or GHIDRA_INSTALL_DIR.
• An agent. Eleven installs ACP adapters when they are needed.

Android apps also need jadx. apktool is optional and adds smali.

Build from source

You need Bun, Node 20 or newer, Ghidra and a JDK as above, and a checkout of REA 6.x next to this repo (../rea), or ELEVEN_REA pointing at one.

git clone https://github.com/Zfinix/eleven
git clone https://github.com/Zfinix/rea
cd eleven/app
bun install
bun run dev

| Command | What it does | | --- | --- | | bun run dev [file] | Runs the app with hot reload, optionally opening a file | | bunx tsc --noEmit --noUnusedLocals | Typechecks the app, tests and scripts | | ./script/test | Runs the test suite one file at a time | | ./script/bundle-macos | Builds build/Eleven.app | | ./script/bundle-windows, ./script/bundle-linux | Builds the Windows and Linux apps on those systems | | ./script/package | Builds, signs and zips a release |

Environment

All of these are optional. Eleven finds the usual install spots on its own.

| Variable | Use | | --- | --- | | GHIDRA_INSTALL_DIR | Ghidra install to use | | JAVA_HOME | JDK to run Ghidra with | | ELEVEN_REA | REA to use instead of the bundled one | | ELEVEN_RIZIN | Rizin to use | | ELEVEN_JADX | jadx to use for Android apps | | ELEVEN_APKTOOL | apktool to use for smali | | ELEVEN_LLDB_DAP | lldb-dap for the debugger | | ELEVEN_SUPPORT | Where Eleven keeps projects and settings | | ELEVEN_CACHE | Where Eleven caches decompiled code | | ELEVEN_PROJECTS_DIR | Where the save dialog starts (default ~/Documents/Eleven) | | ELEVEN_EXPORT_DIR | Where exports and patched copies go (default ~/Downloads/Eleven) | | ELEVEN_SIGN_IDENTITY | Code-signing identity for ./script/package |

Documentation

• MCP tools: every tool agents get in Eleven, what each one takes and returns, permissions and privacy.
• Skills: the built-in playbooks and how to write your own.

Repository

• app/ is the app: React and TypeScript on GPUIX.
• crates/ is an earlier Rust prototype, kept for reference. The app does not use it.
• launch/ is the launch video, made with Remotion.
• install.sh is the installer.

See AGENTS.md for how the code is laid out and the rules it follows.

License

Eleven is released under the Apache License 2.0. Bundled third-party code is listed in THIRD_PARTY_NOTICES.md. Agent logos belong to their owners and appear only to identify those agents.