Minglink/dsh-infinite-gen-5

The problem

Reverse engineering a sample usually means juggling a disassembler, a debugger, a proxy and a notes file, then manually copying addresses and hashes between them. Evidence gets lost, model output gets mistaken for verified fact, and the chain from observation to conclusion is hard to audit. IG5 puts those lanes behind one agent-facing interface, keyed to sample identity and revision, and forces a distinction between what was observed and what was inferred.

What's different

Rather than being another disassembler UI, this is a plugin for DeepSeek Harness: static analysis via Ghidra, native debugging via x64dbg, and HTTP/HTTPS capture all surface as host tools, with a default 8-tool set expanding to 40. Three things genuinely stand apart. First, a split between read-only analysis entries and 13 mutating or executing entries that require explicit host approval. Second, an evidence model where investigation state, handoffs and reviews are bound to specific revisions, so stale attachments are marked rather than silently reused. Third, subagent collaboration with a shared call budget that survives reloads. That is a different posture from Ghidra's or IDA's script-driven extensibility, where the tool trusts the operator by default; IG5 assumes an LLM is in the loop and gates accordingly. The trade-off is that nothing works without the host.

Who it's for

Malware analysts, protocol reversers and security auditors who already run DeepSeek Harness on Windows and want agent-assisted triage with an audit trail. Teams doing authorized pentest follow-up on obfuscated samples will find the deobfuscation and state-model scaffolding relevant. Anyone wanting a general-purpose free disassembler, a cross-platform tool, or an unsupervised "auto-unpack anything" button should look elsewhere — the README is explicit that local proofs are not general VM recovery.

Cost of adoption

Windows x64 only for the real thing: you need an existing DSH profile within a narrow version range (0.2.x, tested on one alpha build), and the full ZIP bundles Ghidra, JDK, Python, x64dbg and their licenses. Source archives are not installable — the README is emphatic you must download the release ZIP and verify its SHA-256. macOS is an experimental Ghidra-only lane; Android and iOS hosts are unvalidated. The license is CC BY-NC-SA 4.0, which rules out commercial use, and NOASSERTION metadata means you should read the LICENSE yourself. Expect install friction: hash checks, cold restarts, and a diagnostic step before you can trust the engine list.

Verdict

The project is 70 days old with 3,437 stars and a recent weekly gain of 479 in the JavaScript board — a fast-rising newcomer, not an established tool. The README is unusually candid about limits, which is a good sign, but candor is not a track record: there is no external validation, no HN discussion, and the host dependency means the project's health is tied to one ecosystem. Worth trying if you are already inside DSH and do authorized Windows RE; wait if you need production stability, cross-platform support, or a commercial license.