skills.rest
warterbili
warterbiliCOMMUNITY
Explore all skills by this author →
Website𝕏@lsdwaterbiliGitHub

ghidra-reverse-engineering

Automate reverse engineering of Android native libraries and JNI interfaces with Ghidra.

Updated Aug 27, 2026
Search Tags:#reverse engineering#binary analysis#obfuscation#ghidra#decompilation#android native#jni
One-click install
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill ghidra-reverse-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ghidra-reverse-engineering
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/native/ghidra-reverse-engineering
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill ghidra-reverse-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzing Android native libraries (.so) and JNI interfaces traditionally requires expensive proprietary reverse engineering tools like IDA Pro, or significant manual effort to use free tools like Ghidra effectively for tasks like decompilation, call graph tracing, and algorithm extraction. This skill eliminates that friction by integrating Ghidra and GhidraMCP directly with Claude Code, enabling automated, agent-driven analysis of native code for common reverse engineering workflows.

Core Features & Use Cases

  • Interactive MCP-Driven Analysis: Claude can control a running Ghidra instance via GhidraMCP to perform decompilation, cross-reference lookups, function renaming, string/constant search, and P-code dataflow analysis without manual GUI interaction.
  • Headless Batch Support: Enables automated analysis via Ghidra's analyzeHeadless interface for CI/CD pipelines or bulk processing of multiple native binaries without a GUI.
  • Android Native Specialization: Includes a pre-built standard workflow for common Android reverse engineering tasks: locating JNI entry points, tracing call graphs, identifying obfuscated code like OLLVM control-flow flattening, and extracting cryptographic or request-signing logic.
  • Use Case Example: When analyzing an Android app with a native library that handles API request signing, use this skill to quickly locate the JNI-registered sign function, decompile its logic, and extract the signing algorithm for verification with Frida or Unidbg emulation.

Quick Start

Use the ghidra-reverse-engineering skill to decompile the sign() function in the target Android native library libsign.so and extract the HMAC key derivation logic.

Frequently Asked Questions about ghidra-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile an Android .so library and extract JNI methods using Ghidra?▼

To decompile Android .so libraries and extract JNI methods using Ghidra, you can use an automated agent-driven workflow that locates JNI entry points, traces call graphs, and extracts native algorithms without manual GUI interaction.

Does Ghidra support automated headless batch analysis for Android native binaries in CI/CD pipelines?▼

Yes, Ghidra supports automated headless batch analysis for Android native binaries in CI/CD pipelines via the analyzeHeadless interface, enabling bulk processing of multiple .so files without requiring a GUI environment.

Can I reverse engineer OLLVM control-flow flattening obfuscation in Android native code with Ghidra?▼

Yes, you can reverse engineer OLLVM control-flow flattening obfuscation in Android native code using Ghidra's P-code dataflow analysis and decompilation features to identify and deobfuscate flattened control structures.

What is the best free alternative to IDA Pro for analyzing Android JNI interfaces and native algorithms?▼

Ghidra is a free alternative to IDA Pro for analyzing Android JNI interfaces and native algorithms, offering automated decompilation, cross-reference lookups, and P-code dataflow analysis integrated directly with Claude Code.

How do I locate a JNI-registered sign function in an Android .so file for Frida or Unidbg verification?▼

To locate a JNI-registered sign function in an Android .so file for Frida or Unidbg verification, use the Ghidra integration to map JNI entry points, decompile the signing logic, and extract the cryptographic key derivation algorithm.

Do I need GhidraMCP to perform interactive decompilation and function renaming on Android .so files?▼

Yes, you need GhidraMCP to perform interactive decompilation and function renaming on Android .so files, as it allows an AI agent to control a running Ghidra instance for cross-reference lookups and string searches without manual GUI interaction.

Related Skills

Explore More Software Engineering Skills→
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
MicrockMicrock
322

native-modules

Bridge JavaScript and native code for React Native iOS and Android modules.

Community
Advanced
woxiangyangzhimaowoxiangyangzhimao
3

app-reverse

Identify and decode encrypted parameters from Android and iOS applications.

Community
Advanced
nolanvenholanolanvenhola
3

reverse-engineering

Automate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.

Community
Advanced