AI reverse-engineering tools write confident reports full of addresses that don't exist and malware that isn't there. groundre checks every claim against the binary itself and labels it with evidence — an LLM never decides a verdict.
One job: turn a confident AI report into a checked, reproducible verdict.
Drop in a binary and an AI's report (JSON, Markdown, PDF, text). Every claim comes back VERIFIED, UNVERIFIED, or CONTRADICTED — each with the exact evidence.
Ground truth is rebuilt from the binary with Ghidra. Deterministic checks assign every verdict — reproducible, cited, and impossible to sweet-talk.
Detonate the binary in a disposable, network-isolated sandbox: screen video, network calls, processes, and input-fuzzing for crashes — nothing touches your machine.
Fingerprint bundled components, check OSV + NVD in real time, and confirm whether the vulnerable code is actually reachable — not just a version match.
Any format. The ingestion layer extracts claims — it never decides a verdict.
Ghidra rebuilds the binary: functions, imports, strings, xrefs, call graph.
Deterministic verifiers grade every claim with a citation you can click.
Every layer is deterministic and cites evidence. No model output is trusted on its word.
Parses any report — JSON, Markdown, PDF, text — into typed claims. It extracts what to check; it never decides a verdict.
Ghidra (PyGhidra) rebuilds the binary: functions, imports, strings, cross-references, and the call graph. Cached by SHA-256.
Address, IOC, capability, call-graph, crypto-constant and CVE checks grade every claim VERIFIED / UNVERIFIED / CONTRADICTED, each with a citation.
A disposable Docker container runs the binary with no host access — screen video, network, processes, and input-fuzzing for crashes.
Fingerprints bundled components, checks OSV + NVD in real time, and confirms whether the vulnerable code is actually reachable — not just a version match.
Every model was asked to reverse-engineer the same binaries. groundre checked each claim. The gap between the best and the worst is a hallucination problem you can measure.
Open the scoreboard →No. Every verdict is computed by deterministic checks against the binary. An LLM may help parse a messy report into claims, but it never grades one.
Windows PE and Linux ELF binaries, installers (MSI), and mobile apps (APK / AAB / IPA). Dynamic analysis runs in an isolated Docker sandbox.
Yes — same binary, same verdicts, every time, each backed by an address or xref you can click through to.
Static analysis and the sandbox run locally. The live CVE step sends only component names and versions to OSV / NVD — never the binary itself.
Point groundre at a binary and see what the AI got wrong — in seconds, with evidence.
Verify a binary →