ablation-tool 2.93.2

Ablation's GUIAI unifies GUI with your AI Agent in one native window. The standard Ablation installation includes GUIAI by default; choose the separate CLI-only prompt only if you do not want the workbench.

Install both with the Installation Prompt, or use the platform-specific prompts for Linux, MacOS, and Windows.

Launch with your agent:

guiai desktop /path/to/target --session /path/to/session --agent kimi
# Also: --agent claude, --agent codex, or --agent-command 'your-agent-cli --flag'

Installation Prompt · Platform prompts · CLI only · Workbench guide · Native packages

Copy this prompt into your AI Agent to install the standard Ablation CLI and GUIAI with their dependencies:

Install the standard Ablation CLI and GUIAI, then launch GUIAI with you—the AI Agent I am currently using—embedded in its terminal.

Check my operating system and Python first. Native Windows requires Python 3.11 x64 with Tcl/Tk; macOS and Linux require Python 3.10 or newer with Tkinter. If a prerequisite is missing, explain what is needed and ask before making system changes.

Download and review this installer:
https://github.com/Ablation-Tool/ablation/releases/latest/download/forall.py

Run it with the checked Python. It selects the correct native package, verifies SHA256, and installs the standard Ablation CLI and GUIAI with their required dependencies. GUIAI's wheels install offline; standard Ablation dependencies are downloaded from PyPI. It verifies both ablation --help and guiai --help.

Do not pipe a downloaded script into an interpreter, use sudo, overwrite an existing installation, skip failed tests, or bypass my permissions.

Ask me for the RE target and project/session directory if needed. Keep the project outside the target. On macOS, open the generated Ablation.app. On Windows and macOS, use --toolkit tk when launching through the CLI. Use your actual executable for the embedded AI Agent; if you cannot identify it, ask me instead of substituting another agent.

Do not install an AI model, credentials, optional analysis extras, or firmware analysis. Do not execute the RE target.

Report the operating system, Ablation and GUIAI versions, installation and project paths, validation result, and exact launch command. Confirm that the native window opens and your real CLI starts inside it.

Linux · MacOS · Windows · CLI only

Install the standard Ablation CLI and GUIAI on Linux, then launch GUIAI with you—the AI Agent I am currently using—embedded in its terminal.

Check for Python 3.10 or newer, Tkinter, a virtual-environment tool, and an X11 or XWayland display. On Ubuntu or Debian, ask before installing missing packages with sudo apt install python3-venv python3-tk python3-gi python3-cairo python3-gi-cairo gir1.2-gtk-3.0 gir1.2-vte-2.91.

Download and review https://github.com/Ablation-Tool/ablation/releases/latest/download/forall.py and run it with the checked Python. Use the default full installation, which includes both Ablation and GUIAI, verifies release checksums, installs GUIAI's wheels offline, and downloads standard Ablation dependencies from PyPI.

Do not overwrite existing files, use sudo for the Python installation, skip failed validation, or execute the RE target. Ask before privileged changes.

Verify ablation --help and guiai --help in the installed environment. Ask me for the RE target and a project directory outside it, then launch with your actual agent executable using guiai desktop TARGET --session PROJECT --agent AGENT_EXECUTABLE. If I need custom agent arguments, use --agent-command instead.

Do not install a model, credentials, or optional analysis extras. Report both versions, installation and project paths, validation results, and the exact launch command. Confirm that the workbench opens and your real CLI starts inside it.

Install the standard Ablation CLI and GUIAI on macOS, then open Ablation.app with you—the AI Agent I am currently using—embedded in its terminal.

Check for Python 3.10 or newer with Tkinter. If it is missing, explain how to install a Python distribution that includes Tkinter and ask before making system changes.

Download and review https://github.com/Ablation-Tool/ablation/releases/latest/download/forall.py and run it with the checked Python. Use the default full installation, which includes both Ablation and GUIAI, verifies release checksums, installs GUIAI's wheels offline, and downloads standard Ablation dependencies from PyPI.

Do not overwrite existing files, use sudo for the Python installation, skip failed validation, or execute the RE target. Do not bypass macOS security settings or my permissions.

Verify ablation --help and guiai --help, and run Contents/MacOS/Ablation --self-test from the installation directory. Open the generated Ablation.app. Ask me to choose the RE target, a project directory outside it, and your actual executable. The app is locally built and is not signed or Apple-notarized.

Do not install a model, credentials, or optional analysis extras. Report both versions, installation and project paths, validation results, and the exact app and CLI launch commands. Confirm that the app opens and your real CLI starts inside it.

Install the standard Ablation CLI and GUIAI on Windows, then launch GUIAI with you—the AI Agent I am currently using—embedded in its terminal.

Check for Python 3.11 x64 with Tcl/Tk support. If it is missing, explain how to install it and ask before making system changes. Do not require WSL.

Download and review https://github.com/Ablation-Tool/ablation/releases/latest/download/forall.py and run it with the checked Python. Use the default full installation, which includes both Ablation and GUIAI, verifies release checksums, installs GUIAI's wheels offline, and downloads standard Ablation dependencies from PyPI.

Do not overwrite existing files, use a global Python installation, skip failed validation, or execute the RE target. Preserve my permissions and existing configuration.

Verify ablation --help and guiai --help in the installed environment. Ask me for the RE target and a project directory outside it, then launch with your actual executable using guiai desktop TARGET --session PROJECT --toolkit tk --agent AGENT_EXECUTABLE. Use --agent-command for custom arguments.

Do not install a model, credentials, or optional analysis extras. Report both versions, installation and project paths, validation results, and the exact launch command. Confirm that the native Windows workbench opens with ConPTY and your real CLI starts inside it.

Use this prompt only when you want the Ablation command-line tools without GUIAI. The normal installation includes both by default.

Install only the standard Ablation command-line tools for me, without the GUIAI workbench.

Check for Git and Python 3.10 or newer. Create a project-local virtual environment and activate it for my operating system. For an existing source checkout, verify its origin and preserve uncommitted changes; do not reset, clean, overwrite, or pull over local changes.

Install the standard package with python -m pip install ablation-tool, or from a reviewed source checkout with python -m pip install . Do not run forall.py for this CLI-only installation because its default includes GUIAI.

Keep full, LLM, bytecode, model-provider, credential, and optional analysis extras opt-in. Do not use sudo, global Python installation, alternate package sources, or firmware analysis. Stop on errors.

Verify with ablation --help. Report the checkout and environment paths, Python version, Ablation version, installed extras, and verification result. Do not launch GUIAI or execute the RE target.

Native CPUs

Automotive ECUs

VMs & Runtimes

Ablation couldn't exist without these creative individuals.

Though no code was written by these authors, doctors, and engineers, their work has direct influence on the production of code, and the aesthetics that makes Ablation what it is.

Thank you.

-Nick

Research Papers

Books supplied by www.oreilly.com | github.com/oreillymedia

GUIAI Design and Direction

Dr. Helen R Horkan contributed ideas and design feedback that helped shape GUIAI’s development and the direction of its native workbench. I’m grateful for her insight and for the influence it had on the project.

Honorable Mention

Microsoft Excel (Data Analysis ToolPak). When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.

Ablation has been used to analyze production firmware and kernel drivers from Cisco, Fortinet, IBM, Juniper, TencentOS, Huawei, and more.

Following coordinated disclosure, the Cisco Product Security Incident Response Team (PSIRT) adopted Ablation for internal vulnerability triage and continues to use it to evaluate ongoing disclosure reports. Cisco Adaptive Security Appliance (ASA) LINA is among the artifacts analyzed, with findings submitted through CERT/CC VINCE.

Ablation in Action

How to Use Ablation

Learn as You RE

NIST SP 800-218

This defines how software should be built, organized around four practice areas: preparing the development environment, protecting the codebase from unauthorized changes, writing software with security built into every layer, and responding when vulnerabilities surface after release.

What this means for Ablation in practice is a mandatory ten-section security audit on every module before it touches the repository. The audit covers input validation, memory handling, integer safety, error handling, concurrency, dependency security, injection prevention, secrets handling, logging, and residual risks. No module is committed without passing it.

Taint trackers, which are the modules that matter most if they get something wrong, carry an additional requirement: 85% statement coverage enforced by a hard gate in the test suite, verified against byte-exact synthetic instruction sequences that test ABI register behavior, not just whether the code runs without crashing. Dependencies are pinned with exact hashes and scanned weekly for known CVEs.

CISA Secure by Design

CISA asks software manufacturers to commit to three things: take ownership of the security outcomes of the people who rely on the software, be transparent about its limitations, and treat security as a requirement rather than a recommendation.

For a RE framework, taking ownership of security outcomes has a specific meaning. A taint tracker that misses a vulnerability does not just produce a wrong answer. It produces a result someone may act on as evidence the binary is clean. That is why a false negative in any Ablation taint tracker is classified as a CRITICAL defect.

Every tracker ships with a documented known-anomalies file describing the exact conditions under which it can produce false negatives, so a researcher knows when to apply manual verification on top of the automated result. The precommit gate is not advisory. No code enters the repository without passing it.

MIL-HDBK-115C

The US Department of Defense handbook for reverse engineering methodology defines four phases:

• Phase 1: Every engagement starts with a session file recording the target description, artifact hash, tool selection, and documentation plan before any analysis runs. The rule that semantic search runs before manual disassembly maps to the following phase.
• Phase 2: Requires characterizing a binary at the function level before doing detailed trace work. The DynamicSandbox covers the following.
• Phase 3: The structured retrospective written at the close of every completed project maps to the final phase.
• Phase 4: The standards document tracks 29 specific requirements drawn from all three frameworks. All 29 are met.

Responsible Use: Ablation is built for authorized security research. Use it only against systems you own or have explicit written permission to test. Running it against systems without authorization violates computer fraud laws in most jurisdictions. The author is not responsible for misuse.

Contact: Feel free to contact me if you have any questions, ideas, complaints, or bugs:

• 📧 ablation@nuclide-research.com
• 𝕏 @showxlate