ghidra-reverse-engineering

What problem does it solve?

Analyzing Android native libraries (.so) and JNI interfaces traditionally requires expensive proprietary reverse engineering tools like IDA Pro, or significant manual effort to use free tools like Ghidra effectively for tasks like decompilation, call graph tracing, and algorithm extraction. This skill eliminates that friction by integrating Ghidra and GhidraMCP directly with Claude Code, enabling automated, agent-driven analysis of native code for common reverse engineering workflows.

Core Features & Use Cases

• Interactive MCP-Driven Analysis: Claude can control a running Ghidra instance via GhidraMCP to perform decompilation, cross-reference lookups, function renaming, string/constant search, and P-code dataflow analysis without manual GUI interaction.
• Headless Batch Support: Enables automated analysis via Ghidra's analyzeHeadless interface for CI/CD pipelines or bulk processing of multiple native binaries without a GUI.
• Android Native Specialization: Includes a pre-built standard workflow for common Android reverse engineering tasks: locating JNI entry points, tracing call graphs, identifying obfuscated code like OLLVM control-flow flattening, and extracting cryptographic or request-signing logic.
• Use Case Example: When analyzing an Android app with a native library that handles API request signing, use this skill to quickly locate the JNI-registered sign function, decompile its logic, and extract the signing algorithm for verification with Frida or Unidbg emulation.

Quick Start

Use the ghidra-reverse-engineering skill to decompile the sign() function in the target Android native library libsign.so and extract the HMAC key derivation logic.