ghidra

Run Ghidra headless analysis to export decompiled code, functions, strings, and call graphs.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ghidra-3xecutablefile
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ghidra
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/ghidra
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ghidra-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

You need fast, repeatable reverse-engineering of binaries without manually operating a GUI, so that you can extract symbols, decompile code, and map call relationships efficiently.

Core Features & Use Cases

  • Automated headless analysis: Runs Ghidra analyzeHeadless to import a target binary and perform analysis without interactive steps.
  • Decompilation and rich exports: Produces decompiled C-like output, function lists (JSON), strings (JSON/text), call graphs (JSON), and symbol exports.
  • Architecture-aware workflows: Lets you specify processor/compiler specs (e.g., ARM firmware) to improve analysis quality.

Quick Start

Run a full first-pass export with decompiled code, functions, strings, call graph, and a summary for the binary by executing: ghidra-analyze.sh -s ExportAll.java -o ./analysis ./mybinary

Frequently Asked Questions about ghidra

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate binary analysis and decompilation without using a GUI?

Automated binary analysis runs Ghidra in headless mode to import binaries, perform decompilation, and extract symbols without interactive steps for repeatable offline workflows.

Can I extract call graphs and function lists from firmware binaries?

Firmware binary inspection exports function lists, call graphs, and symbols as JSON files by running Ghidra headless analysis with architecture-specific processor and compiler specs.

What is the best way to run reproducible reverse engineering for malware triage?

Reproducible reverse engineering for malware triage executes Ghidra headless analysis to export decompiled code, strings, and call graphs to a specified output directory.

Do I need specific processor specs to decompile ARM binaries offline?

Specifying ARM processor and compiler specs improves decompilation quality during offline binary analysis by matching the target architecture for accurate headless exports.

What artifacts can I export when doing headless binary analysis?

Headless binary analysis exports decompiled C-like output, function lists, strings, call graphs, and symbol exports in JSON or text formats to a designated result folder.

Does headless reverse engineering support custom analysis scripts and timeouts?

Headless reverse engineering supports selecting custom analysis scripts, configuring processor specs, setting timeouts, and directing exports to specific output directories.