Binary → Architecture → Modern App

EmberNotes — From Legacy Binary to Modern Editor

Start with a compiled binary. No source code. No documentation. We decompiled it via Ghidra, mapped the full architecture with RootCause, then used that understanding to build EmberNotes—a modern, feature-rich editor written from scratch in Python. 1,789 lines. Zero external dependencies. Tabbed editing, syntax highlighting, dark mode.

Architecture Map

RippleForge parsed the decompiled output and produced this interactive dependency graph. What was a flat 23,000-line C file is now a searchable, navigable architecture.

Interactive RippleForge visualization — pan, zoom, and search. Generated automatically from the decompiled binary. This architecture map informed the design of EmberNotes.

What the Pipeline Sees

Decompiled output is cryptic—machine-generated names, no comments, no structure. RootCause ingests this and extracts architecture, call graphs, and function classifications automatically. That structural understanding is what made building EmberNotes possible.

Raw Decompiled Output (Ghidra)

// Decompiled from: legacy_editor.exe
// Decompiled by Ghidra

// =========================================
// Function: FUN_140001008
// Address: 140001008
// =========================================

void FUN_140001008(undefined8 param_1,
    byte *param_2, undefined8 param_3,
    undefined8 param_4, undefined8 *param_5,
    undefined8 param_6)
{
  undefined1 auStackY_88 [32];
  _EVENT_DATA_DESCRIPTOR local_58 [2];
  undefined8 local_38;
  undefined4 local_30;
  undefined4 local_2c;
  ulonglong local_18;

  local_18 = DAT_140034400
      ^ (ulonglong)auStackY_88;
  local_28 = param_6;
  local_1c = 0;
  local_20 = 8;
  local_38 = *param_5;
  local_2c = 0;
  local_30 = 0x10;
  FUN_1400012dc(0x1400341f8,
      param_2, (LPCGUID)0x0,
      (LPCGUID)0x0, 4, local_58);
  return;
}

// ... 22,990 more lines like this

RippleForge Architecture Output

{
  "project": "legacy_editor_analyzed",
  "nodes": 492,
  "edges": 762,

  "function_classifications": {
    "io_handler": 87,
    "control_flow": 64,
    "data_processing": 53,
    "business_logic": 41,
    "validation": 38,
    "reporting": 29,
    "unknown": 180
  },

  "call_graph": {
    "max_depth": 12,
    "orphaned_functions": 23,
    "hotspot_functions": [
      "FUN_14000b250 (47 callers)",
      "FUN_14000c8a0 (39 callers)",
      "FUN_140009d10 (31 callers)"
    ]
  },

  "artifacts_produced": [
    "Interactive dependency map (D3.js)",
    "Function inventory (492 entries)",
    "Call graph (762 edges)",
    "Hotspot analysis",
    "Orphan detection"
  ]
}

What This Demonstrates

This is not a toy example. This is the full pipeline: decompile a real binary, understand its architecture, then build something better.