Help us improve
Share bugs, ideas, or general feedback.
From ghidra-headless
Reverse engineers binaries with Ghidra headless analyzer: decompiles to C pseudocode, extracts functions/strings/symbols, analyzes call graphs. For static analysis without GUI.
npx claudepluginhub trailofbits/skills-curated --plugin ghidra-headlessHow this skill is triggered — by the user, by Claude, or both
Slash command
/ghidra-headless:ghidra-headlessThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Perform automated reverse engineering using Ghidra's `analyzeHeadless` tool.
Guides binary reverse engineering with disassembly, decompilation, static/dynamic analysis using IDA Pro, Ghidra, radare2, x64dbg, and scripting via IDAPython, r2pipe, pwntools.
Analyzes binaries with angr Python framework for static analysis, decompiling to C pseudocode, recovering control flow graphs, symbolic execution for vulnerabilities, and input solving on stripped executables.
Reverse engineers malware binaries using Ghidra disassembler and decompiler to analyze internal logic, cryptographic routines, C2 protocols, and evasion techniques at assembly and pseudo-C level.
Share bugs, ideas, or general feedback.
Perform automated reverse engineering using Ghidra's analyzeHeadless tool.
Import binaries, run analysis, decompile to C code, and extract useful
information.
| Task | Command |
|---|---|
| Full analysis with all exports | {baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./output binary |
| Decompile to C code | {baseDir}/scripts/ghidra-analyze.sh -s ExportDecompiled.java -o ./output binary |
| List functions | {baseDir}/scripts/ghidra-analyze.sh -s ExportFunctions.java -o ./output binary |
| Extract strings | {baseDir}/scripts/ghidra-analyze.sh -s ExportStrings.java -o ./output binary |
| Get call graph | {baseDir}/scripts/ghidra-analyze.sh -s ExportCalls.java -o ./output binary |
| Export symbols | {baseDir}/scripts/ghidra-analyze.sh -s ExportSymbols.java -o ./output binary |
| Find Ghidra path | {baseDir}/scripts/find-ghidra.sh |
brew install --cask ghidraThe skill automatically locates Ghidra in common installation paths. Set
GHIDRA_HOME environment variable if Ghidra is installed in a non-standard
location.
{baseDir}/scripts/ghidra-analyze.sh [options] <binary>
Wrapper that handles project creation/cleanup and provides a simpler
interface to analyzeHeadless.
Options:
-o, --output <dir> — Output directory for results (default: current dir)-s, --script <name> — Post-analysis script to run (can be repeated)-a, --script-args <args> — Arguments for the last specified script--script-path <path> — Additional script search path-p, --processor <id> — Processor/architecture (e.g., x86:LE:32:default)-c, --cspec <id> — Compiler spec (e.g., gcc, windows)--no-analysis — Skip auto-analysis (faster, but less info)--timeout <seconds> — Analysis timeout per file--keep-project — Keep the Ghidra project after analysis--project-dir <dir> — Directory for Ghidra project (default: /tmp)--project-name <name> — Project name (default: auto-generated)-v, --verbose — Verbose outputRuns summary, decompilation, function list, strings, and interesting-pattern exports. Does not include call graph or symbols — run ExportCalls.java and ExportSymbols.java separately if needed. Best for initial analysis.
Output files:
{name}_summary.txt — Overview: architecture, memory sections, function counts{name}_decompiled.c — All functions decompiled to C{name}_functions.json — Function list with signatures and calls{name}_strings.txt — All strings found (plain text; use ExportStrings.java for JSON){name}_interesting.txt — Functions matching security-relevant patterns{baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./analysis firmware.bin
Decompile all functions to C pseudocode.
Output: {name}_decompiled.c
Export function list as JSON with addresses, signatures, parameters, and call relationships.
Output: {name}_functions.json
Extract all strings (ASCII, Unicode) with addresses.
Output: {name}_strings.json
Export function call graph showing caller/callee relationships. Includes full call graph, potential entry points, and most frequently called functions.
Output: {name}_calls.json
Export all symbols: imports, exports, and internal symbols.
Output: {name}_symbols.json
mkdir -p ./analysis
{baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./analysis unknown_binary
cat ./analysis/unknown_binary_summary.txt
cat ./analysis/unknown_binary_interesting.txt
{baseDir}/scripts/ghidra-analyze.sh \
-p "ARM:LE:32:v7" \
-s ExportAll.java \
-o ./firmware_analysis \
firmware.bin
{baseDir}/scripts/ghidra-analyze.sh --no-analysis -s ExportFunctions.java -o . program
cat program_functions.json | jq '.functions[] | "\(.address): \(.name)"'
# After running ExportDecompiled, search for patterns
grep -n "password\|secret\|key" output_decompiled.c
grep -n "strcpy\|sprintf\|gets" output_decompiled.c
Common processor IDs for the -p option:
| Architecture | Processor ID |
|---|---|
| x86 32-bit | x86:LE:32:default |
| x86 64-bit | x86:LE:64:default |
| ARM 32-bit | ARM:LE:32:v7 |
| ARM 64-bit | AARCH64:LE:64:v8A |
| MIPS 32-bit | MIPS:BE:32:default or MIPS:LE:32:default |
| PowerPC | PowerPC:BE:32:default |
{baseDir}/scripts/find-ghidra.sh
# Or set GHIDRA_HOME if in non-standard location
export GHIDRA_HOME=/path/to/ghidra_11.x_PUBLIC
{baseDir}/scripts/ghidra-analyze.sh --timeout 300 -s ExportAll.java binary
# Or skip analysis for quick export
{baseDir}/scripts/ghidra-analyze.sh --no-analysis -s ExportSymbols.java binary
Set before running:
export MAXMEM=4G
Explicitly specify the processor:
{baseDir}/scripts/ghidra-analyze.sh -p "ARM:LE:32:v7" -s ExportAll.java firmware.bin
--timeout and consider --no-analysis for quick scans