skills.rest
3xecutablefile
3xecutablefileCOMMUNITY
Explore all skills by this author →
GitHub

ghidra-headless

Run Ghidra headless analysis to import binaries and export decompiled code.

Updated Aug 27, 2026
Search Tags:#call graph#ghidra#decompilation#string extraction#headless analysis#binary reverse engineering#firmware auditing
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ghidra-headless
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ghidra-headless
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/ghidra-headless
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ghidra-headless

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It streamlines reverse engineering by automating Ghidra headless analysis so you can decompile and extract artifacts from binaries without using the GUI.

Core Features & Use Cases

  • Headless decompilation and exports: Runs analyzeHeadless to import a binary, decompile functions to C, and export summaries and artifacts.
  • Security triage workflows: Produces function lists, strings, call graphs, symbols, and “interesting” security-relevant findings for faster auditing.
  • Batch processing: Supports repeatable analysis runs across multiple binaries, outputting JSON/text files suitable for follow-on tooling.

Example use case: You receive an unknown firmware image and need to quickly identify authentication logic and high-value functions, then review decompiled C and search exported strings for secrets or keys.

Quick Start

Use the ghidra-headless skill to decompile an executable to C pseudocode by running: ghidra-analyze.sh -s ExportDecompiled.java -o ./analysis ./your_binary

Frequently Asked Questions about ghidra-headless

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I batch decompile multiple binaries to C pseudocode without using a GUI?▼

Batch decompilation is automated by running Ghidra headless analysis via wrapper scripts, which import binaries, execute decompilation, and export C pseudocode and artifacts without requiring GUI interaction. This supports repeatable static triage across multiple executables.

Can I extract strings and call graphs from firmware images for security auditing?▼

Firmware auditing is supported by running headless Ghidra analysis to extract strings, call graphs, symbols, and security-relevant findings from firmware images. Exported JSON and text files allow fast identification of authentication logic and high-value functions for review.

Do I need a specific Ghidra installation to run headless binary reverse engineering?▼

Headless binary reverse engineering requires a working Ghidra installation with the analyzeHeadless tool accessible. Optional architecture and CSPEC selection can be applied to match the target binary format, ensuring deterministic export scripts run correctly.

What is the best way to perform static triage on unknown executables in bulk?▼

Static triage of unknown executables is best performed by automating Ghidra headless mode to batch process binaries, outputting function lists, decompiled C code, and extracted strings to JSON or text files suitable for follow-on tooling and review.

Does this approach export artifacts in formats suitable for downstream tooling?▼

Headless analysis exports decompiled code and artifacts as JSON and text files, making them directly suitable for downstream tooling. This allows security triage workflows to ingest function lists, call graphs, and symbols for further automated review.

Why use headless analysis instead of the standard Ghidra GUI for reverse engineering?▼

Headless analysis is used instead of the Ghidra GUI to streamline reverse engineering through automated, repeatable batch processing. It enables bulk extraction of decompiled C, strings, and call graphs without manual GUI interaction, accelerating static triage workflows.

Related Skills

Explore More Software Engineering Skills→
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
yunmengyayunmengya
80

ai-audit-mcp

Audit code contexts to identify and report exploitability findings.

Community
Advanced
marcosd4hmarcosd4h
17

logic-vulnerability-detector

Detect logic vulnerabilities in DeepExtractIDA binaries and verify findings.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-re-ghidra

Automate binary reverse engineering tasks with Ghidra headless analysis.

Community
Advanced