ghidra

Automate binary reverse engineering with Ghidra's headless analyzer.

6|1|Updated Nov 23, 2023

Search Tags:#automation #headless #reverse-engineering #ghidra #decompilation #binary-analysis

Ready to run

npx skills add https://github.com/gmcabrita/dotfiles --skill ghidra-gmcabrita

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ghidra
Source: https://github.com/gmcabrita/dotfiles/tree/main/.agents/skills/ghidra
Command: npx skills add https://github.com/gmcabrita/dotfiles --skill ghidra-gmcabrita

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Automate reverse engineering of binaries without a GUI by orchestrating Ghidra's headless analyzer to produce structured exports such as functions, strings, symbols, and call graphs.

Core Features & Use Cases

Import binaries, run analysis, decompile to C code, and extract useful information for offline inspection.
Export functions, strings, symbols, and call graphs to machine-readable formats for reports and audits.
Typical use: analyze unknown binaries or firmware to rapidly identify architecture, control flow, and potential vulnerabilities.

Quick Start

Run ghidra-analyze.sh with ExportAll.java on a binary to generate a full set of exports.

Frequently Asked Questions about ghidra

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate binary analysis and decompilation without launching a GUI?▼

Automating binary analysis without a GUI involves orchestrating Ghidra's headless analyzer to import binaries, run analysis, decompile to C code, and extract functions, strings, symbols, and call graphs for offline inspection.

What does headless reverse engineering extract from unknown binaries or firmware?▼

Headless reverse engineering extracts structured exports from binaries or firmware, including decompiled C code, functions, strings, symbols, and call graphs, enabling rapid identification of architecture, control flow, and vulnerabilities.

Do I need Java installed to run Ghidra headless analyzer for decompilation?▼

Yes, running Ghidra headless analyzer for decompilation requires both Ghidra and Java installed in your environment. The automation locates the analyzeHeadless script to execute post-analysis scripts.

Can I run multiple post-analysis scripts during headless binary analysis?▼

Yes, you can run multiple post-analysis scripts during headless binary analysis. The automation supports executing scripts like ExportAll.java alongside project management options to generate a full set of machine-readable exports.

What is the best way to export functions and call graphs to machine-readable formats?▼

The best way to export functions, strings, symbols, and call graphs to machine-readable formats is by running Ghidra's headless analyzer with post-analysis scripts like ExportAll.java for automated report generation.

Why is automated decompilation useful for auditing unknown binaries?▼

Automated decompilation is useful for auditing unknown binaries because it rapidly identifies architecture, control flow, and potential vulnerabilities by producing structured, machine-readable exports without requiring manual GUI interaction.