ghidra-reverse
starsforks
How to install ghidra-reverse?
zhaoxuya520/reverse-skill/ghidra-reverse
$npx -y skills add zhaoxuya520/reverse-skill --skill ghidra-reverseUse for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
SKILL.md
| 1 | # Ghidra Reverse Engineering |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 读取 `../field-journal/precedent-reverse.md` |
| 6 | 2. `NOW`: 确认需要 **Ghidra**（无 IDA / 偏好开源 / 批量 headless） |
| 7 | 3. `NEXT`: 读 `../tool-index.md` 查 ghidra / ghidra-mcp 路径 |
| 8 | 4. `NEXT`: 缺工具 → bootstrap `ghidra-mcp`（若 manifest 支持）或按手动步骤装 Ghidra |
| 9 | 5. `ACT`: 导入样本 → 自动分析 → 导出关键函数反编译 |
| 10 | |
| 11 | ## 适用场景 |
| 12 | |
| 13 | - 无 IDA 许可证时的主逆向入口 |
| 14 | - 批量 headless 分析 / CI 中反编译 |
| 15 | - Ghidra 脚本（Java/Python Jython/PyGhidra）自动化 |
| 16 | - 与 `binary-diff` / `patch-diff-exploit` 的 ghidriff 联动 |
| 17 | |
| 18 | ## 与 IDA 分工 |
| 19 | |
| 20 | | 需求 | 优先 | |
| 21 | |------|------| |
| 22 | | 已有 IDA MCP 深挖 | `ida-reverse/` | |
| 23 | | 开源 / 批量 / 教学 | **本 skill** | |
| 24 | | 仅 CLI 快速侦察 | `radare2/` | |
| 25 | |
| 26 | ## 工作流 |
| 27 | |
| 28 | ### 1. 项目与自动分析 |
| 29 | |
| 30 | ```text |
| 31 | □ 新建 Project → Import 文件 → Analyze（默认分析器） |
| 32 | □ 记录语言/编译器识别结果与基址 |
| 33 | □ 标记入口、导出表、字符串 xref |
| 34 | ``` |
| 35 | |
| 36 | ### 2. 关键函数 |
| 37 | |
| 38 | ```text |
| 39 | □ 从字符串 / 导入 API 反查 |
| 40 | □ Decompile 窗口还原算法 |
| 41 | □ 重命名函数/变量；写 Plate comment |
| 42 | □ 需要动态时交接 Frida/GDB（reverse-engineering 动态章） |
| 43 | ``` |
| 44 | |
| 45 | ### 3. Headless（批量） |
| 46 | |
| 47 | ```bash |
| 48 | # 示例：analyzeHeadless 路径因安装而异，MUST 从 tool-index 取 |
| 49 | analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py |
| 50 | ``` |
| 51 | |
| 52 | ### 4. MCP（若已配置） |
| 53 | |
| 54 | ```text |
| 55 | □ 确认 ghidra MCP 端口（常见 8765，以 tool-index 为准） |
| 56 | □ 用 MCP 工具拉反编译 / xrefs，禁止猜端口 |
| 57 | ``` |
| 58 | |
| 59 | ## 工具链 |
| 60 | |
| 61 | | 工具 | 用途 | 自举 | |
| 62 | |------|------|------| |
| 63 | | Ghidra | 反编译主工具 | 手动 release / 包管理器 | |
| 64 | | ghidra-mcp | AI 桥 | bootstrap 能力名 `ghidra-mcp` | |
| 65 | | ghidriff | 补丁差分 | 见 `patch-diff-exploit` | |
| 66 | |
| 67 | ## 参考 |
| 68 | |
| 69 | - `references/ghidra-cheatsheet.md` |
| 70 | - `../ida-reverse/` `../radare2/` `../binary-diff/` |
| 71 | |
| 72 | ## 路由上下文 |
| 73 | |
| 74 | **上游**: MASTER R22 |
| 75 | **下游**: 动态验证 → Frida/GDB；利用 → `pwn-chain` |
| 76 | **同级**: `ida-reverse`（商业深挖） |
| 77 | |
| 78 | ## 任务完成自检 |
| 79 | |
| 80 | - [ ] 是否基于真实 Ghidra/tool-index 路径？ |
| 81 | - [ ] 是否标注函数地址与重命名？ |
| 82 | - [ ] 是否有可复现步骤？ |
| 83 | - [ ] Checklist / journal？ |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
