Minglink/dsh-infinite-gen-4

Install

dsh plugin --profile web add github:Minglink/dsh-infinite-gen-4

What it does

A reverse-engineering analysis and visualization workbench that puts static analysis, native debugging, traffic capture, deobfuscation research, and agent collaboration into a single workflow. It targets tasks like "figuring out what an unfamiliar program actually does."

Features

• Opens 8 everyday Core entries by default, expanding to Full 40 when more capability is needed
• Static analysis: functions, strings, cross-references, decompilation, control-flow graphs, structs, and jump tables
• Debugging: native debugging through x64dbg with breakpoints, registers, memory, and limited traces; plus Unicorn single-function emulation
• Traffic: local proxy, explicit TLS decryption, traffic history, request replay, and payload extraction
• Visualization: pannable and zoomable SVG control-flow graphs, double-click to view assembly, focus highlighting for local variables
• 13 modify or execute entries require host approval rather than running silently

Good fit for

• Security auditing, malware sample analysis, protocol reverse engineering
• Scenarios that need the analysis process and evidence chain recorded
• Teaching and research demonstrations of binary analysis workflows

Advice

• Use it only on targets you own or are authorized to test; the README itself limits the scope to this
• Start with the Core 8 rather than opening Full 40 immediately; with too many tools you won't know which one to use
• It emphasizes evidence reports over model speculation, so check the evidence itself before accepting a conclusion

Cautions

• Security red line: reads credentials + network access, plaintext http, literal IP 21.0.12.1
• The older description in the plugin directory calls it an armor-break plugin, which does not match the current README (a reverse-engineering workbench); the project has clearly been repurposed, so **go by the README**
• The license includes non-commercial restrictions; confirm separately before commercial use
• It does not perform full taint analysis; focus-line filtering is not the same as data-flow tracking

Security red lines

• reads credentials/secrets AND has network access
• uses plaintext http:// to test
• uses literal IP 21.0.12.1 for network access