CFF Explorer MCP Server

Talk to your PE files. A Model Context Protocol (MCP) server that bridges CFF Explorer's powerful Lua scripting engine with Claude AI — enabling natural language PE analysis, import/export inspection, and binary patching.

What Is This?

This project turns CFF Explorer — a professional-grade PE file analysis tool — into an AI-accessible tool via the Model Context Protocol. Once set up, you can ask Claude things like:

• "Analyse the PE headers of malware.exe and flag anything suspicious"
• "List all imports of suspicious.dll and highlight dangerous API calls"
• "Extract the manifest resource from setup.exe"
• "NOP out 5 bytes at offset 0x1A3C in target.exe"
• "Invert the jump at offset 0x2B10 so the license check always passes"

...and Claude will use CFF Explorer in headerless under the hood to answer you with structured, interpreted results.

How It Works

You (natural language)
        │
        ▼
  Claude Desktop
        │  MCP protocol (stdio)
        ▼
  server.py  ◄─── This project
        │
        │  1. Generates a temporary .cff Lua script
        │  2. Launches CFF Explorer.exe as a subprocess (headless, no GUI)
        │  3. CFF Explorer runs the script, prints results to stdout, exits
        │  4. server.py parses the output into structured JSON
        │
        ▼
  CFF Explorer.exe
  (running invisibly in background for ~1 second)

Key insight: CFF Explorer has a built-in Lua scripting engine (v2). When you pass a .cff script file as a command-line argument, it runs headlessly — no window, no GUI, just script execution and stdout output. This project exploits that to give AI models programmatic access to CFF Explorer's full PE analysis API.

Features

| Tool | Description | |------|-------------| | analyze_pe_headers | Full PE header dump — DOS, COFF File Header, Optional Header, all sections | | list_imports | All imported DLLs and functions with ordinals | | list_exports | All exported symbols from a DLL | | nop_bytes | Patch: NOP out N bytes at a given file offset | | invert_jump | Patch: Flip a conditional jump (JZ↔JNZ, JE↔JNE, etc.) | | extract_resource | Save a PE resource (icon, manifest, bitmap, etc.) to disk |

Requirements

| Requirement | Details | |-------------|---------| | OS | Windows only (CFF Explorer is Windows-exclusive) | | Python | 3.10 or higher | | CFF Explorer | Explorer Suite — free download | | Claude Desktop | claude.ai/download |

Installation

Step 1 — Download CFF Explorer

1. Go to https://ntcore.com/?page_id=388

2. Download Explorer Suite

3. Install it (default path: C:\Program Files\Explorer Suite\)

4. Important: Open CFF Explorer GUI → go to Edit → Preferences → uncheck Scripting Privilege Protection (SPP)

   SPP shows a GUI consent dialog before certain script operations. In headless mode this dialog blocks forever, causing timeouts. Disable it for the MCP server to work correctly.

Step 2 — Clone This Repo

git clone https://github.com/YOUR_USERNAME/cff-explorer-mcp.git
cd cff-explorer-mcp

Step 3 — Install Python Dependencies

pip install -r requirements.txt

This installs only one package: the mcp SDK.

Step 4 — Configure Claude Desktop

Open your Claude Desktop config file:

%APPDATA%\Claude\claude_desktop_config.json

Add the cff-explorer entry under mcpServers. See claude_desktop_config_example.json for a template:

{
  "mcpServers": {
    "cff-explorer": {
      "command": "python",
      "args": [
        "C:/path/to/cff-explorer-mcp/server.py"
      ],
      "env": {
        "CFF_EXPLORER_PATH": "C:\\Program Files\\Explorer Suite\\CFF Explorer.exe"
      }
    }
  }
}

Note: Use your actual Python path. Find it by running where python in PowerShell.

Step 5 — Restart Claude Desktop

Close and reopen Claude Desktop. You should see the CFF Explorer tools available in the tools panel.

Usage Examples

PE Header Analysis

"Analyse the PE headers of C:\samples\suspicious.exe"

Claude will return:

• Architecture (x86/x64/ARM64)
• Entry point, image base, size
• All sections with virtual/raw sizes, RVAs, and characteristics flags
• Subsystem type (GUI, CUI, Native, etc.)
• Whether it's a .NET assembly
• Suspicious flags (forged timestamp, non-standard image base, section anomalies)

Import Analysis

"List all imports of C:\malware\dropper.dll and flag anything dangerous"

Claude will enumerate all DLLs and functions, then automatically flag:

• Process injection APIs (VirtualAlloc, WriteProcessMemory, CreateRemoteThread)
• Anti-debug APIs (IsDebuggerPresent, CheckRemoteDebuggerPresent)
• Network APIs (WSAStartup, connect, send)
• Crypto APIs (CryptEncrypt, CryptGenRandom)
• Direct NT syscalls (NtQueryValueKey, NtOpenProcess)

Export Listing

"What functions does C:\tools\hook.dll export?"

Lists all named exports with their ordinals — useful for understanding what a DLL exposes to callers.

Binary Patching

"NOP out 6 bytes at offset 0x1234 in C:\crack\game.exe"

"Invert the jump at file offset 0x5678 in C:\target\app.exe"

⚠️ Always back up files before patching. These operations modify the file in-place.

Resource Extraction

"Extract the manifest from C:\app\installer.exe and save it to C:\temp\manifest.xml"

Common resource type IDs:

| Constant | ID | Description | |---|---|---| | RT_CURSOR | 1 | Hardware cursor | | RT_BITMAP | 2 | Bitmap image | | RT_ICON | 3 | Application icon | | RT_MENU | 4 | Menu | | RT_DIALOG | 5 | Dialog box | | RT_STRING | 6 | String table | | RT_VERSION | 16 | Version info | | RT_MANIFEST | 24 | App manifest (XML) |

Project Structure

cff-explorer-mcp/
│
├── server.py                        ← Main MCP server (all logic lives here)
├── requirements.txt                 ← Python dependencies (just: mcp)
├── .gitignore                       ← Standard Python/Windows gitignore
├── claude_desktop_config_example.json  ← Config template for Claude Desktop
└── README.md                        ← This file

Inside server.py

| Section | Description | |---------|-------------| | run_cff_script() | Core runner — writes temp .cff file, invokes CFF Explorer subprocess, captures stdout | | script_*() functions | Lua script generators for each tool — written for CFF Explorer's modified Lua | | parse_*() functions | Parse CFF Explorer's stdout into clean Python dicts | | list_tools() | MCP tool definitions (names, descriptions, JSON schemas) | | call_tool() | MCP tool dispatch — routes calls to the right script + parser |

CFF Explorer Scripting Notes

CFF Explorer uses a modified Lua dialect. Key differences from standard Lua that this project accounts for:

| Feature | Standard Lua | CFF Explorer Lua | |---------|-------------|-----------------| | Arrays | 1-based | 0-based | | Not-equal | ~= | != | | Null value | nil | null | | Raw strings | N/A | @"C:\path" (C# style) | | os library | Available | ❌ Not available | | io library | Available | ❌ Not available | | Output | io.write() | print() → stdout |

The os and io libraries being absent was the main bug found during development. All scripts in this project use only print() for output.

Troubleshooting

Script times out

• Make sure Scripting Privilege Protection (SPP) is disabled in CFF Explorer preferences
• Check that CFF_EXPLORER_PATH points to the correct .exe
• Try running CFF Explorer manually first to ensure it opens

"CFF Explorer not found" error

• Verify the path in your claude_desktop_config.json
• Default install path: C:\Program Files\Explorer Suite\CFF Explorer.exe
• Use double backslashes in JSON: C:\\Program Files\\Explorer Suite\\CFF Explorer.exe

Tools not appearing in Claude Desktop

• Restart Claude Desktop completely after editing the config
• Validate your JSON (no trailing commas, balanced braces)
• Check Claude Desktop logs: %APPDATA%\Claude\logs\

"attempt to index global 'os'" error

• You are running an old version of server.py — update to the latest version
• The old version incorrectly used os.tmpname() which doesn't exist in CFF Explorer's Lua

Contributing

Pull requests are welcome! Some ideas for future tools:

• check_packer — detect common packers (UPX, Themida, etc.) by section entropy
• update_checksum — recalculate and write the PE checksum after patching
• add_section — add a new section to a PE file
• realign_pe — realign sections to a given alignment value
• dotnet_metadata — dump .NET metadata tables for managed assemblies

Credits

• CFF Explorer & Scripting Engine — Daniel Pistelli / NTCore — the tool that makes all of this possible
• MCP SDK — Anthropic
• GhidraMCP — LaurieWired — inspiration for combining RE tools with MCP

Built with Claude