skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

ghidra-reverse

Reverse engineer binaries with Ghidra through decompilation, cross-references, and headless batch analysis.

21|8|Updated Aug 3, 2026
Search Tags:#headless#reverse engineering#binary analysis#ghidra#decompilation#disassembly#malware analysis
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill ghidra-reverse-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ghidra-reverse
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/ghidra-reverse
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill ghidra-reverse-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When you need to reverse engineer a binary but lack an IDA Pro license, or when you need repeatable batch decompilation in CI pipelines, this Skill provides a structured Ghidra workflow instead of ad-hoc guessing. ## Core Features & Use Cases - GUI Decompilation Workflow: Import samples, run auto-analysis, decompile key functions, rename symbols, and trace cross-references from strings and imported APIs. - Headless Batch Analysis: Run analyzeHeadless with post-scripts to decompile many binaries automatically in CI or bulk triage scenarios. - Ghidra MCP Integration: Connect to a ghidra-mcp bridge so an AI agent can pull decompilation and xrefs directly, with ports and paths resolved from a tool index rather than guessed. - Use Case: You receive an unknown firmware sample and have no IDA license. Use this Skill to import it into Ghidra, identify the compiler and base address, decompile the functions referenced by suspicious strings, and export the results for downstream Frida or GDB dynamic analysis. ## Quick Start Use the ghidra-reverse skill to import this binary into Ghidra, run auto-analysis, and decompile the functions referenced by its suspicious strings.

Frequently Asked Questions about ghidra-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a binary with Ghidra?▼

Create a Ghidra project, import the binary, and run the default auto-analysis. Then locate key functions via string search or imported API cross-references, open the Decompile window, and rename functions and variables to document the algorithm.

How to run Ghidra headless for batch decompilation?▼

Use the analyzeHeadless command with a project path, the -import flag for your sample, and -postScript to run an export script such as a decompiler dump. The exact script path depends on your Ghidra installation and should be confirmed from your tool index.

Ghidra vs IDA Pro for reverse engineering, which should I use?▼

Ghidra is the preferred entry point when you lack an IDA license, need open-source tooling, or want batch headless analysis in CI. IDA with an MCP bridge is better for deep interactive commercial-grade analysis, while radare2 suits quick CLI reconnaissance.

Can Ghidra be automated with scripts?▼

Yes, Ghidra supports scripting in Java, Jython, and PyGhidra through its Script Manager and headless mode. A ghidra-mcp bridge can also expose decompilation and cross-reference queries to AI agents over a configured port.

What are the limitations of Ghidra for binary analysis?▼

Ghidra's decompiler output can be rougher than IDA's on obfuscated or unusual architectures, and dynamic analysis requires handing off to external tools like Frida or GDB. Headless setup also requires manual installation and correct path configuration.

Related Skills

Explore More Software Engineering Skills→
drupadsachaniadrupadsachania

reverse-engineering

Map MITRE ATT&CK techniques and extract IOCs from malware samples.

Community
Advanced
yhy0yhy0
545

binary

Analyze and exploit CTF binary challenges using Ghidra, pwntools, and dynamic debugging.

Community
Advanced
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
nolanvenholanolanvenhola
3

reverse-engineering

Automate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.

Community
Advanced