kernullist/pseudoforge

PseudoForge is a plugin for IDA Pro, a professional tool used by security researchers and reverse engineers to analyze compiled software. When IDA Pro decompiles a binary, turning raw machine code back into something resembling readable C code, the output is often messy: variable names are generic placeholders, structure fields appear as raw byte offsets, and important constants show up as unlabeled numbers. PseudoForge takes that output and applies a structured cleanup pass to make it easier to read and analyze. The plugin follows a deterministic-first design, meaning it does not let an AI model rewrite arbitrary code and call it a day. Instead, it builds a validated plan from pattern-matching rules it knows are correct, then optionally adds rename suggestions from a language model, but only if those suggestions also pass the same validator. Nothing changes in your IDA project file until you explicitly approve it after reviewing a preview. The cleanup covers several categories of Windows kernel driver patterns. It recognizes NTSTATUS error codes and replaces hex literals like 0xC0000005 with their human-readable names. It detects linked-list traversal patterns from the Windows kernel, decodes memory pool tags stored as four-byte constants, and handles IOCTL dispatch tables including the decoded control codes in switch-case comments. It also annotates ERESOURCE locks, object reference counting calls, and pool allocation patterns with context that would otherwise require manual lookup. Output appears as a side-by-side preview inside IDA using a custom viewer, and as a set of files written next to the analyzed binary: cleaned pseudocode, a rename map, a switch-case outline, and a flow report. The actual IDA database is only modified if you trigger the rename action after reviewing the plan, so the plugin cannot make any changes without your explicit sign-off. The plugin requires IDA Pro 9.x or newer with the Hex-Rays decompiler license. An offline command-line path is also included for smoke testing without a running IDA instance. The project is at version 0.1.0 and the core engine, deterministic rules, interactive preview, and export workflow are all validated. Optional AI-assisted renaming is available through multiple providers but remains an add-on, not the primary mechanism.