From ghidra-headless
Reverse engineers binaries with Ghidra headless analyzer: decompiles to C pseudocode, extracts functions/strings/symbols, analyzes call graphs. For static analysis without GUI.
npx claudepluginhub trailofbits/skills-curated --plugin ghidra-headlessThis skill is limited to using the following tools:
Perform automated reverse engineering using Ghidra's `analyzeHeadless` tool.
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Perform automated reverse engineering using Ghidra's analyzeHeadless tool.
Import binaries, run analysis, decompile to C code, and extract useful
information.
| Task | Command |
|---|---|
| Full analysis with all exports | {baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./output binary |
| Decompile to C code | {baseDir}/scripts/ghidra-analyze.sh -s ExportDecompiled.java -o ./output binary |
| List functions | {baseDir}/scripts/ghidra-analyze.sh -s ExportFunctions.java -o ./output binary |
| Extract strings | {baseDir}/scripts/ghidra-analyze.sh -s ExportStrings.java -o ./output binary |
| Get call graph | {baseDir}/scripts/ghidra-analyze.sh -s ExportCalls.java -o ./output binary |
| Export symbols | {baseDir}/scripts/ghidra-analyze.sh -s ExportSymbols.java -o ./output binary |
| Find Ghidra path | {baseDir}/scripts/find-ghidra.sh |
brew install --cask ghidraThe skill automatically locates Ghidra in common installation paths. Set
GHIDRA_HOME environment variable if Ghidra is installed in a non-standard
location.
{baseDir}/scripts/ghidra-analyze.sh [options] <binary>
Wrapper that handles project creation/cleanup and provides a simpler
interface to analyzeHeadless.
Options:
-o, --output <dir> — Output directory for results (default: current dir)-s, --script <name> — Post-analysis script to run (can be repeated)-a, --script-args <args> — Arguments for the last specified script--script-path <path> — Additional script search path-p, --processor <id> — Processor/architecture (e.g., x86:LE:32:default)-c, --cspec <id> — Compiler spec (e.g., gcc, windows)--no-analysis — Skip auto-analysis (faster, but less info)--timeout <seconds> — Analysis timeout per file--keep-project — Keep the Ghidra project after analysis--project-dir <dir> — Directory for Ghidra project (default: /tmp)--project-name <name> — Project name (default: auto-generated)-v, --verbose — Verbose outputRuns summary, decompilation, function list, strings, and interesting-pattern exports. Does not include call graph or symbols — run ExportCalls.java and ExportSymbols.java separately if needed. Best for initial analysis.
Output files:
{name}_summary.txt — Overview: architecture, memory sections, function counts{name}_decompiled.c — All functions decompiled to C{name}_functions.json — Function list with signatures and calls{name}_strings.txt — All strings found (plain text; use ExportStrings.java for JSON){name}_interesting.txt — Functions matching security-relevant patterns{baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./analysis firmware.bin
Decompile all functions to C pseudocode.
Output: {name}_decompiled.c
Export function list as JSON with addresses, signatures, parameters, and call relationships.
Output: {name}_functions.json
Extract all strings (ASCII, Unicode) with addresses.
Output: {name}_strings.json
Export function call graph showing caller/callee relationships. Includes full call graph, potential entry points, and most frequently called functions.
Output: {name}_calls.json
Export all symbols: imports, exports, and internal symbols.
Output: {name}_symbols.json
mkdir -p ./analysis
{baseDir}/scripts/ghidra-analyze.sh -s ExportAll.java -o ./analysis unknown_binary
cat ./analysis/unknown_binary_summary.txt
cat ./analysis/unknown_binary_interesting.txt
{baseDir}/scripts/ghidra-analyze.sh \
-p "ARM:LE:32:v7" \
-s ExportAll.java \
-o ./firmware_analysis \
firmware.bin
{baseDir}/scripts/ghidra-analyze.sh --no-analysis -s ExportFunctions.java -o . program
cat program_functions.json | jq '.functions[] | "\(.address): \(.name)"'
# After running ExportDecompiled, search for patterns
grep -n "password\|secret\|key" output_decompiled.c
grep -n "strcpy\|sprintf\|gets" output_decompiled.c
Common processor IDs for the -p option:
| Architecture | Processor ID |
|---|---|
| x86 32-bit | x86:LE:32:default |
| x86 64-bit | x86:LE:64:default |
| ARM 32-bit | ARM:LE:32:v7 |
| ARM 64-bit | AARCH64:LE:64:v8A |
| MIPS 32-bit | MIPS:BE:32:default or MIPS:LE:32:default |
| PowerPC | PowerPC:BE:32:default |
{baseDir}/scripts/find-ghidra.sh
# Or set GHIDRA_HOME if in non-standard location
export GHIDRA_HOME=/path/to/ghidra_11.x_PUBLIC
{baseDir}/scripts/ghidra-analyze.sh --timeout 300 -s ExportAll.java binary
# Or skip analysis for quick export
{baseDir}/scripts/ghidra-analyze.sh --no-analysis -s ExportSymbols.java binary
Set before running:
export MAXMEM=4G
Explicitly specify the processor:
{baseDir}/scripts/ghidra-analyze.sh -p "ARM:LE:32:v7" -s ExportAll.java firmware.bin
--timeout and consider --no-analysis for quick scans