Pixie JIT-compiles Ghidra Sleigh processor specifications to native ARM64 machine code. 146 architectures across 38 families, ~2× faster than Binary Ninja's built-in decoder, exposed end-to-end as MCP tools so an LLM agent can sweep an entire firmware image.
The video shows the beta workflow end to end: install the plugin, load the NDS32 fixture, inspect the recovered function, and compare Pixie's decompiler output against the original C.
Open MP4 ↗Sleigh patterns lower to ARM64 machine code. No interpreter, no virtualization tax. Hand-written-C performance from a one-line spec change.
100–500 MB/s · 0 alloc on hot path
Every operation — decode, decompile, xrefs, diff, patch — is a callable MCP tool. Point an LLM at a firmware tree and let it sweep hundreds of binaries in one pass.
MCP · batch · headless
x86, ARM v4–v8-M, AArch64, MIPS, RISC-V, PowerPC, 68k, 6502, Z80, AVR, SH, PIC, MSP430, Dalvik, eBPF, LoongArch, SPARC V9, Xtensa, V850, TriCore, and more.
38 Sleigh families · LE/BE
A compile-time recursion limit is baked into every JIT-compiled decoder. For any input byte sequence, decoding terminates in bounded time. Enforced in machine code — cannot be bypassed.
recursion_limit ≤ 16 (default)
@include, @define, @ifdef)146 packaged Sleigh specs across 38 Ghidra families. Compile and apply your own when none of these fit.
release-proof
Compile/load proof covers all packaged specs. Full BN workflow proofs ship today for x86-64, AArch64, and NDS32-LE; remaining packaged specs are classified compile/load-only until matrix coverage lands.
Annual prepay. Named license, one user, multiple machines. VAT may apply.
Beta access during 0.x. License extends through 1.0 release.
Pricing scales with seats and scope. Tell us what you're analyzing.
Public-good security research, academic labs, and CTF organizers may apply for a complimentary license. Manual approval, no support promise — but the tool is yours.