use-ghidra

Analyze and annotate binaries through Ghidra using decompile, catalog, and call-site scripts.

Updated Jun 30, 2026
One-click install
npx skills add https://github.com/bsamiee/Rasm --skill use-ghidra-bsamiee
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: use-ghidra
Source: https://github.com/bsamiee/Rasm/tree/main/.claude/skills/use-ghidra
Command: npx skills add https://github.com/bsamiee/Rasm --skill use-ghidra-bsamiee

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Reverse engineering a binary requires many repetitive Ghidra operations—importing, analyzing, naming Objective-C stubs, cataloging strings and functions, and decompiling functions with their callers and callees. This Skill automates that workflow through ghidra-cli and a bundle of Java GhidraScript files, producing indexed, line-readable output files. ## Core Features & Use Cases - Binary Import & Analysis: Import binaries (including thinned universal Mach-O slices and raw headerless bytes) into one Ghidra project per binary and verify analysis completed. - Catalog & Decompile Scripts: Run Catalog.java, Decompile.java, CallSites.java, Stubs.java, and Headers.java to enumerate strings, imports, and functions, decompile seed functions with their neighborhood, list call sites with resolved arguments, rename Objective-C stubs, and apply C header prototypes. - Persistent Annotation: Parse C headers under clang-derived macros so types and prototypes persist in the project and sharpen every later decompilation. - Use Case: Given an arm64 macOS binary, import it, name every __objc_stubs function after its selector, catalog all strings and functions, then decompile the functions referencing a specific string into one indexed C file for reading. ## Quick Start Use the use-ghidra skill to import this binary into a Ghidra project, run analysis, and decompile the functions referencing a given string.

Frequently Asked Questions about use-ghidra

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile a function with Ghidra from the command line?▼

Use ghidra-cli to start a bridge on a project, then run a GhidraScript such as Decompile.java via `ghidra script run`. The script accepts seeds by address, name, regex, string reference, or tag and writes an indexed C file with callers and callees.

How to analyze a Mach-O binary with Ghidra headless?▼

Thin universal Mach-O files with `lipo -thin arm64` before import, or use analyzeHeadless with BinaryLoader, a base address, and a processor language ID for headerless bytes. Set GHIDRA_HEADLESS_MAXMEM on the bridge's starting command to control heap size.

Why does Ghidra fail with LockException on my project?▼

Only one process can open a Ghidra project at a time, so headless runs beside a resident bridge abort with LockException until `ghidra stop`. Crashes leave `<name>.lock` and `<name>.lock~` files under $GHIDRA_PROJECT_DIR that must be removed by hand.

Why does Ghidra decompile return No function at address?▼

This happens when no analysis has run after import, even though `program list` may show analyzed: true. Run `ghidra analyze --project <name>` in the background, then verify the function count exceeds the size-1 import stubs.

Can Ghidra scripts parse C headers into program types?▼

Yes, a Headers.java GhidraScript parses C headers with the CParser under preprocessor macros captured from clang, applying prototypes to named functions. Include paths must be directories, and shims are needed for constructs like __has_include and namespaced attributes.

What are the limitations of running Ghidra scripts through a bridge?▼

Jobs run one at a time and queue, and `script java` or `script python` modes are unsupported through the bridge. Decompiles past the 300-second socket read require GHIDRA_CLI_READ_TIMEOUT=0, and one file failing to compile fails the whole script bundle.