WPeGPT: an IDA plugin that pipes decompiled pseudocode to an LLM

What WPeGPT does that a decompiler does not

IDA gives you pseudocode. It does not give you a sentence explaining what the function is for. WPeGPT fills that gap by taking the decompiled text of the function you are looking at, sending it to an AI model, and writing the model's answer back into the database as a comment. The README is blunt about the value of that output: "AI's analysis results are for reference only." That framing matters, because the plugin is a reading aid, not an oracle.

The audience is reverse engineers who already work in IDA and want a first pass on unfamiliar code. The plugin covers five interactive tasks: function analysis (purpose, usage environment, behavior), variable renaming, Python reconstruction of small routines such as XOR decryption, vulnerability finding in the current function, and an attempt at generating a PoC exploit. The last two are the ones most likely to disappoint, and the README does not pretend otherwise. It also names its lineage: the project was inspired by Gepetto, and the update history shows version 1.0 in February 2023 was based on it.

The rename to WPeGPT from WPeChatGPT happened at v3.0. The README states existing installations are unaffected, which is a useful signal about how the maintainer treats upgrades.

How the plugin talks to a model, and what changed in v3.0

In interactive mode the data flow is short. You trigger an action from the pseudocode window, the plugin collects the decompiled function text, sends it through the openai Python package to the configured endpoint, and inserts the returned text as a comment. There is no local model, no caching layer described in the README, and no offline path. Every analysis is an HTTP request to whatever API_BASE_URL points at.

The architectural change in v3.0 is the split into WPeGPT.py, config.py and wpe_ai_controller.py, plus WPeServer, an embedded TCP server inside IDA that accepts commands from an external controller and supports multiple concurrent IDA instances. That turns the plugin into something a script can drive, which is the basis for the headless workflow.

The automated pipeline is described as three phases: a global scan, then critical path analysis, then either full function analysis or vulnerability analysis depending on mode. Three modes are documented with rough durations: light at 2 to 5 minutes, full at 10 to 30 minutes, vuln at 5 to 20 minutes. Those numbers come from the README's own table and depend entirely on the binary and the model, so treat them as scale indicators rather than promises.

Supporting machinery feeds that pipeline: string classification into ten categories (networking, keylogging, crypto, injection, persistence, antianalysis, dropper, code execution, memory/file ops, installer framework), network IoC extraction for IPs, domains, URLs and ports with an attempt to decrypt encrypted C2 addresses, a suspiciousness score built from keyword matching, caller and callee relationships, function size and standard library filtering, and pattern-based shellcode loader detection. Results land in both JSON and Markdown under a directory named after the binary.

Installing WPeGPT and running the first function analysis

Installation has three steps and one hard prerequisite: IDA must be configured to use Python 3. The README says so explicitly, and skipping it is the most common way to end up with a plugin that never loads.

First, install the Python dependencies from the repository root. The requirements file pins two packages, openai at version 0.27.0 or newer and httpx.

pip install -r ./requirements.txt

Second, edit WPeGPT_Config/config.py. The README lists the keys you must set: API_KEY, API_BASE_URL and MODEL. It also documents ZH_CN, which defaults to True for Chinese and should be set to False for English output, plus optional ANALYSIS_MODE and MAX_WORKERS. If you are behind a proxy, FORWARD_PROXY is the documented place to put it, for example http://127.0.0.1:7890.

Third, copy WPeGPT.py and the whole WPeGPT_Config/ folder into your IDA plugins directory and restart IDA. The folder has to travel with the script, not just the single file.

Once IDA is back up, the fastest real test is the function analysis shortcut. Open a binary, click into a function, and press Ctrl+Alt+G. The result should appear as a comment on that function. The other documented shortcuts are Ctrl+Alt+R for renaming variables, Ctrl+Alt+E for vulnerability finding, and Ctrl+Alt+W for light auto analysis. Everything is also reachable by right-clicking in the pseudocode window or through Edit, then WPeGPT in the menu bar.

For the headless path, the README points at the separate wpegpt-analyzer project or the menu entry Edit, WPeGPT, Auto-WPeGPT. Reports are written to a folder named <binary_name>_WPeAI_Results/.

Where WPeGPT breaks, and when to leave it closed

The first limitation is not technical. Every function you analyze leaves your machine and goes to a third-party API. For malware from a paid engagement, or firmware under an NDA, that is a policy decision before it is a tooling decision, and the README offers no local-model option or redaction step.

The second is the proxy problem the README devotes its own section to. If you are behind a proxy and see connection errors, the documented cause is urllib3 v1.26, and the documented fix is to uninstall it and install urllib3==1.25.11. Pinning an old urllib3 in a shared Python environment can conflict with other packages, so this is a workaround with a cost, not a clean solution. The alternatives the README gives are setting FORWARD_PROXY or using a reverse proxy through API_BASE_URL.

The third is the nature of the output. Vulnerability finding and exploit generation are model guesses over pseudocode, with no verification step described. A confident wrong answer inserted as a comment is worse than no comment, because it anchors the next analyst. The README's own warning about results being for reference only is the honest position here.

Finally, the automated pipeline is only as good as its scoring heuristics. Suspiciousness ranking by keywords, call relationships, size and stdlib filtering will deprioritize a small, quiet function that happens to matter, and the README does not document a way to force a specific function into the analysis set.

WPeGPT against Gepetto, and against a plain chat window

The obvious alternative is Gepetto, which WPeGPT credits as its inspiration and which the version 1.0 entry says the project was based on. Both are IDA plugins that send decompiled code to a model and insert the answer as a comment. The difference in approach shows up at v3.0: WPeGPT added a TCP server inside IDA, a controller script, three analysis modes and a report generator, so it can run without a human clicking through functions. Gepetto's documented scope in the WPeGPT README is the interactive side. If you want a single function explained, the two are close enough that either works. If you want a whole binary triaged overnight, only one of them is built for that.

The other alternative is copying pseudocode into a chat window by hand. That costs nothing to install and gives you full control over what you paste. What it does not give you is the write-back: WPeGPT's results land as IDA comments attached to the right function, and the automated mode produces structured JSON and Markdown without you pasting anything. The trade is convenience for a plugin you have to configure, debug and keep in sync with your IDA version.

Maintenance, versioning and the missing licence

The last push to the repository was on 2026-05-27, which is also the date of the v3.0 release. The release cadence visible in the history is uneven: v2.6 in February 2025, v2.7 in December 2025, v3.0 in May 2026. That is roughly two releases a year, and v3.0 was a rewrite rather than a patch, so expect the modular layout to be the stable shape going forward.

Upgrade cost is low for interactive users. The README states that existing installations are unaffected by the rename from WPeChatGPT to WPeGPT. The v2.5 entry notes that support for the newer openai Python package required updating that package, so dependency drift is the realistic upgrade hazard. The requirements file only asks for openai >= 0.27.0 and httpx, which leaves the actual installed version up to your environment.

On licensing, the repository metadata carries no licence identifier, and the README does not state one. That is a gap you should resolve before shipping WPeGPT inside a commercial workflow or redistributing it. Without a declared licence, the default position is that no rights are granted beyond what the platform's terms allow, but this is a question for your own legal review, not something the project documentation answers.

Editorial conclusion

Adopt WPeGPT if you already live in IDA and want a second opinion on a function without leaving the pseudocode window, and if you are comfortable sending that pseudocode to a third-party API. Do not adopt it if the binary is under a no-export policy, if you need a deterministic result you can defend in a report, or if you expect the vulnerability and exploit features to find anything a careful analyst would miss. Before installing, verify three things: that your IDA is configured to use Python 3, that the API key and API_BASE_URL in WPeGPT_Config/config.py point at the provider you actually intend to use, and that your IDA plugin directory is the one the running instance loads from.

Frequently asked questions

Official sources

1. Issues
2. README
3. Releases
4. WPeace-HcH/WPeGPT on GitHub