kernullist / PseudoForge

What is PseudoForge?

PseudoForge is an IDA Pro plugin that transforms messy Hex-Rays pseudocode into clean, readable artifacts you can actually review. It targets Windows kernel drivers specifically, normalizing NTSTATUS literals, decoding IOCTL codes, and recovering switch dispatchers from tangled if-else chains. The plugin runs inside IDA and shows a side-by-side preview of raw versus cleaned output, then lets you export bundles containing cleaned pseudocode, switch outlines, rename maps, and flow reports. A standalone CLI handles offline smoke testing without launching IDA, and a separate workflow supports IDA Free users who work with cloud-decompiled code. The core philosophy is deterministic-first: LLM suggestions are optional and must pass validation before appearing in output.

Why is it gaining traction?

The hook is kernel-specific semantics that generic cleanup tools miss. PseudoForge understands NTSTATUS error codes, LIST_ENTRY traversal patterns, IRP dispatch signatures, and pool tag formatting out of the box. It ships with a WDK profile covering thousands of kernel API prototypes and status codes, generated directly from Windows headers. The deterministic rules engine lets teams author JSON-based rename and comment rules without touching Python code, making it practical for team workflows. Optional LLM assist via OpenAI, Claude, or DeepSeek adds rename suggestions, but the plugin refuses to apply them blindly--everything goes through collision checking and identifier validation first.

Who should use this?

Reverse engineers analyzing Windows kernel drivers who spend too much time manually renaming locals and decoding status codes. Malware analysts working with no-symbol OB callbacks or custom IOCTL dispatchers. Security researchers who need to share cleaned pseudocode with teammates and want audit trails showing why each rename appeared. Teams building internal analysis pipelines can use the headless batch mode to process large IDBs and the JSON rules engine to enforce naming conventions across projects.

Verdict

PseudoForge fills a real gap for kernel-focused reverse engineering, but the 19-star count signals early-stage software still finding its audience. Documentation is thorough and the WDK profile generation from headers is a nice touch, but test coverage and community activity will determine long-term viability. If you regularly battle noisy Hex-Rays output on Windows drivers, this is worth installing just for the NTSTATUS decoding and switch recovery alone. Start with the offline CLI smoke test before committing to the full IDA plugin workflow.