reverse-engineering-assistant
installs/mo · pypistarsforks
How to install reverse-engineering-assistant?
cyberkaida/reverse-engineering-assistant
$git clone https://github.com/cyberkaida/reverse-engineering-assistant> A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering
README.md
| 1 | # ReVa - Ghidra MCP Server for AI-Powered Reverse Engineering |
| 2 | |
| 3 | > A Ghidra extension that provides a [Model Context Protocol (MCP)](https://modelcontextprotocol.io/faqs) server for AI-assisted reverse engineering |
| 4 | |
| 5 | ReVa (Reverse Engineering Assistant) is a **Ghidra MCP server** that enables AI language models to interact with Ghidra's powerful reverse engineering capabilities. ReVa uses |
| 6 | state of the art techniques to limit [context rot](https://github.com/chroma-core/context-rot) and enable |
| 7 | long form reverse engineering tasks. |
| 8 | |
| 9 | ReVa is different from other efforts at building AI assistants for RE tasks because it uses a _tool driven approach_ with a focus |
| 10 | on designing tools for effective LLM use. |
| 11 | ReVa aims to provide a variety of small tools to the LLM, just as your RE environment provides a set of small tools |
| 12 | to you. |
| 13 | |
| 14 | Each of the tools given to the LLM are constructed to be easy for the LLM to use and to tolerate a variety of inputs |
| 15 | and to reduce hallucination by the LLM. We do this by providing the LLM with a schema but tolerating other input, |
| 16 | including descriptions that guide the LLM,and redirecting correctable mistakes back to the LLM, and including extra |
| 17 | output to guide the next decision by the LLM. |
| 18 | |
| 19 | ReVa's tools differ to other solutions, they provide smaller, |
| 20 | critical fragments with reinforcement and links to other |
| 21 | relevant information to reduce context usage and hallucination. |
| 22 | This greatly improves performance, especially on long form |
| 23 | reverse engineering tasks. This allows ReVa to handle large |
| 24 | binaries and even entire firmware images. |
| 25 | |
| 26 | To encourage exploration as a human would, we report additional context like the namespace and cross references along with the decompilation, this |
| 27 | is a small nudge to make the LLM explore the binary in the same way a human would. |
| 28 | |
| 29 | Using this technique you can ask general questions and get relevant answers. The model prioritises |
| 30 | information from the tools, but when there is no information it can still respond to generic |
| 31 | questions from its training. |
| 32 | |
| 33 | As an MCP server, ReVa can be used alongside other MCP servers to enrich its analysis. |
| 34 | For example you can use the [GitHub MCP Server](https://github.com/github/github-mcp-server) |
| 35 | to allow ReVa access to source code on GitHub, or the |
| 36 | [Kagi MCP Server](https://github.com/kagisearch/kagimcp) to allow ReVa to search the web. |
| 37 | |
| 38 | You can ask questions like: |
| 39 | |
| 40 | - Examine the programs in this project and explain the relationship between the main binary and the shared libraries. |
| 41 | - What are the interesting strings in this program? |
| 42 | - Does this program use encryption? Write a markdown report on the encryption and where it is used. |
| 43 | - Draw a class diagram using plantuml syntax. |
| 44 | - Start from main, examine the program in detail. Rename variables as you go and provide a summary of the program. |
| 45 | - Explain the purpose of the `__mod_init` segment. |
| 46 | - What does `mmap` return? |
| 47 | - What does the function at address 0x80000 do? |
| 48 | - This is a CTF problem. Write a pwntools script to get the flag. |
| 49 | - Import these two binaries and diff them, explain the changes. |
| 50 | |
| 51 | # Installation |
| 52 | |
| 53 | > NOTE: ReVa only supports Ghidra 12.0 and above! |
| 54 | |
| 55 | ReVa is a Ghidra extension. To install it, you can download the release for your |
| 56 | version of Ghidra from the releases page and install it using the Ghidra extension manager. |
| 57 | |
| 58 | Alternatively, you can build it from source. To do this, clone the repository and run the following command: |
| 59 | |
| 60 | ```bash |
| 61 | export GHIDRA_INSTALL_DIR=/path/to/ghidra |
| 62 | gradle install |
| 63 | ``` |
| 64 | |
| 65 | After installing the extension you need to activate it in two places: |
| 66 | |
| 67 | 1. In the Project view, open the File menu and select "Configure". Click the "Configure all plugins" button on the top right of the menu (it looks like a plug). Check the "ReVa Application Plugin" |
| 68 | 2. In the Code Browser tool (Click the Dragon icon or open a File), open the File menu and select "Configure". Click the "Configure all plugins" button on the top right of the menu (it looks like a plug). Check the "ReVa Plugin". Then Press File an |
People who liked this also viewed
6 picksType
- langfuse-mcpA Model Context Protocol (MCP) server for Langfuse, enabling AI agents to query Langfuse trace data for enhanced debugging and observabilityMCP ServersJun 2026
- tauri-plugin-mcpAllows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.MCP ServersJul 2026
- perfetto-mcpThis is a Model Context Protocol (MCP) server that gets answers from your Perfetto Traces. It turns natural‑language prompts into focused Perfetto analyses.MCP ServersApr 2026
- jshookmcpjs hook toolkit that all you needMCP ServersJul 2026
- Cron Expression Parser — Explain & Next Run TimesCron expression parser API for AI agents. Parse, validate, and explain cron expressions in plain English. Get next N scheduled run times in any timezone. Tools: schedule_parse_cron. Use this for debugging cron schedules, building scheduliMCP Serversrecently
- trace-mcpMCP server for Claude Code and Codex. One tool call replaces ~42 minutes of agent explorationMCP ServersJul 2026
