ghidra-reverse
Helps your agent perform software reverse engineering using Ghidra. It can decompile code and help understand programs when other tools are unavailable.
What it does
Ghidra is a free program to analyze and understand software when you don't have the source code. It helps you see how a program works internally, even without the original instructions.
When to use it
- ✓When you need to analyze a program without a license for a similar tool (IDA).
- ✓To analyze many programs at once, automatically.
- ✓To learn how programs work, like in a class.
Example of what to ask your AI
“Analyze this program for me and tell me how it works.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
Ghidra reads the program, tries to 'translate' machine code into something closer to the original language, and shows the connections between different parts of the program.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add sickn33/agentic-awesome-skills --skill ghidra-reverseOr download just the file:
curl -L https://raw.githubusercontent.com/sickn33/agentic-awesome-skills/main/plugins/agentic-awesome-skills-claude/skills/ghidra-reverse/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Ghidra Reverse Engineering
When to Use
- Static analysis of binaries without an IDA license.
- Bulk headless decompilation or scripted analysis across many binaries.
适用场景
- 无 IDA 许可证时的主逆向入口
- 批量 headless 分析 / CI 中反编译
- Ghidra 脚本（Java/Python Jython/PyGhidra）自动化
- 与
binary-diff/patch-diff-exploit的 ghidriff 联动
与 IDA 分工
| 需求 | 优先 |
|---|---|
| 已有 IDA MCP 深挖 | ida-reverse/ |
| 开源 / 批量 / 教学 | 本 skill |
| 仅 CLI 快速侦察 | radare2/ |
工作流
1. 项目与自动分析
□ 新建 Project → Import 文件 → Analyze（默认分析器）
□ 记录语言/编译器识别结果与基址
□ 标记入口、导出表、字符串 xref
2. 关键函数
□ 从字符串 / 导入 API 反查
□ Decompile 窗口还原算法
□ 重命名函数/变量；写 Plate comment
□ 需要动态时交接 Frida/GDB（reverse-engineering 动态章）
3. Headless（批量）
# 示例：analyzeHeadless 路径因安装而异，MUST 从 tool-index 取
analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py
4. MCP（若已配置）
□ 确认 ghidra MCP 端口（常见 8765，以 tool-index 为准）
□ 用 MCP 工具拉反编译 / xrefs，禁止猜端口
工具链
| 工具 | 用途 | 自举 |
|---|---|---|
| Ghidra | 反编译主工具 | 手动 release / 包管理器 |
| ghidra-mcp | AI 桥 | bootstrap 能力名 ghidra-mcp |
| ghidriff | 补丁差分 | 见 patch-diff-exploit |
参考
references/ghidra-cheatsheet.md../ida-reverse/../radare2/../binary-diff/
路由上下文
上游: MASTER R22
下游: 动态验证 → Frida/GDB；利用 → pwn-chain
同级: ida-reverse（商业深挖）
任务完成自检
- 是否基于真实 Ghidra/tool-index 路径？
- 是否标注函数地址与重命名？
- 是否有可复现步骤？
- Checklist / journal？
Limitations
- Decompiler output is less polished than IDA's for some architectures.
- Large firmware images may need significant RAM and patience.
Adapted from zhaoxuya520/reverse-skill (MIT).
FAQ
What is 'reverse engineering'?
It's the process of taking apart a program to understand how it was built, like a detective investigating an object.
Is Ghidra difficult to use?
It might require some learning, but it's a powerful and free tool for those who want to investigate software.
Do I need to know how to program to use Ghidra?
It helps a lot, but Ghidra's goal is precisely to make the code more readable for the person analyzing it.
Details
Original description by the author
Free/open reverse engineering with Ghidra (headless or GUI): decompilation, cross-references, scripting, and optional Ghidra MCP workflows when IDA is unavailable.
Popularity
- GitHub stars
- 48k
- Ranking position
- #3118
- License
- MIT
- Updated
- 10/15/2026
Comments
- …
More skills from this repository
00-andruia-consultant
Helps your agent start or improve AI projects. It analyzes code, suggests tools, and creates action plans in Spanish.
sickn33/agentic-awesome-skills
007
Lets your agent perform security audits and threat modeling. It's useful for protecting projects against attacks and vulnerabilities.
sickn33/agentic-awesome-skills
10-andruia-skill-smith
Helps your agent create or improve AI tools. It defines how tools work, writes documentation, and validates the structure.
sickn33/agentic-awesome-skills
20-andruia-niche-intelligence
Lets your agent create a summary about a specific industry. It's useful for understanding the context, rules, usage patterns, and risks of a project, using reliable sources.
sickn33/agentic-awesome-skills
Similar skills
benchmark-optimization-loop
Has your agent improve something's speed in a measured way. It tests multiple versions and chooses the fastest one that still works correctly.
affaan-m/ECC
change-impact
Helps your agent analyze the impact of code changes before making them. It compares the planned vs. actual results afterward, covering paths, data, tests, and documentation. Useful for risky or system-wide changes.
affaan-m/ECC
click-path-audit
Lets your agent trace all user buttons and interactions to find bugs. It finds issues where functions seem to work alone but fail together. Useful when bugs persist even after debugging.
affaan-m/ECC