How it worksArchitectureScoreboardFAQVerify a binary
deterministic RE verifier

Verify every claim your AI makes about a binary.

AI reverse-engineering tools write confident reports full of addresses that don't exist and malware that isn't there. groundre checks every claim against the binary itself and labels it with evidence — an LLM never decides a verdict.

0.00% false-flag rate · 1,309 claims checked · live bench

What groundre does

One job: turn a confident AI report into a checked, reproducible verdict.

Verify any AI report

Drop in a binary and an AI's report (JSON, Markdown, PDF, text). Every claim comes back VERIFIED, UNVERIFIED, or CONTRADICTED — each with the exact evidence.

Code decides, not an LLM

Ground truth is rebuilt from the binary with Ghidra. Deterministic checks assign every verdict — reproducible, cited, and impossible to sweet-talk.

Run it, safely

Detonate the binary in a disposable, network-isolated sandbox: screen video, network calls, processes, and input-fuzzing for crashes — nothing touches your machine.

Live CVEs, confirmed

Fingerprint bundled components, check OSV + NVD in real time, and confirm whether the vulnerable code is actually reachable — not just a version match.

How it works

01

Report in

Any format. The ingestion layer extracts claims — it never decides a verdict.

02

Ground truth

Ghidra rebuilds the binary: functions, imports, strings, xrefs, call graph.

03

Verdicts out

Deterministic verifiers grade every claim with a citation you can click.

Architecture

Every layer is deterministic and cites evidence. No model output is trusted on its word.

01

Ingestion

Parses any report — JSON, Markdown, PDF, text — into typed claims. It extracts what to check; it never decides a verdict.

02

Ground truth

Ghidra (PyGhidra) rebuilds the binary: functions, imports, strings, cross-references, and the call graph. Cached by SHA-256.

03

Deterministic verifiers

Address, IOC, capability, call-graph, crypto-constant and CVE checks grade every claim VERIFIED / UNVERIFIED / CONTRADICTED, each with a citation.

04

Isolated sandbox

A disposable Docker container runs the binary with no host access — screen video, network, processes, and input-fuzzing for crashes.

05

Live CVE

Fingerprints bundled components, checks OSV + NVD in real time, and confirms whether the vulnerable code is actually reachable — not just a version match.

We grade the models, not the grader.

Every model was asked to reverse-engineer the same binaries. groundre checked each claim. The gap between the best and the worst is a hallucination problem you can measure.

Open the scoreboard →
1.0%best · Claude Opus 4.8
17.9%worst · Mythos-1
0verdicts an LLM decided

FAQ

Does an LLM decide the verdicts?

No. Every verdict is computed by deterministic checks against the binary. An LLM may help parse a messy report into claims, but it never grades one.

What can it analyze?

Windows PE and Linux ELF binaries, installers (MSI), and mobile apps (APK / AAB / IPA). Dynamic analysis runs in an isolated Docker sandbox.

Is it reproducible?

Yes — same binary, same verdicts, every time, each backed by an address or xref you can click through to.

Does my binary leave my machine?

Static analysis and the sandbox run locally. The live CVE step sends only component names and versions to OSV / NVD — never the binary itself.

Stop trusting. Start verifying.

Point groundre at a binary and see what the AI got wrong — in seconds, with evidence.

Verify a binary →