Ghidra Reverse Engineering
Guides the agent through free Ghidra reverse engineering: analysis, decompiling, cross-references and batch headless runs.
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent follows a structured workflow for reverse engineering compiled programs with Ghidra, a free, open-source tool from the NSA. It walks through importing a binary, running auto-analysis, finding key functions from strings or imported APIs, decompiling them to readable pseudo-code, and renaming or annotating them. It can also run Ghidra in batch (headless) mode for many samples and, if configured, use a Ghidra MCP bridge so the AI can pull decompilation and cross-references directly.
Great for
- Security students learning to analyse binaries without a paid IDA license
- Analysts who need batch decompilation of many samples in a CI or scripted pipeline
- Reverse engineers who want a repeatable checklist for Ghidra projects
Skip it if
- People trying to crack software or bypass licensing without authorisation, since the skill is aimed at deep binary analysis and may feed into exploit work (it routes to an exploit chain skill)
- Users who expect a point-and-click tool; it requires a local Ghidra install and command-line familiarity
Try asking
- “Decompile the main validation function in this sample.bin and explain the algorithm”
- “Run Ghidra headless on all binaries in this folder and export decompiled C to a folder”
- “Find where the program references the string 'license key' and trace the cross-references”
- “Compare two firmware builds with ghidriff and summarise the changed functions”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
ghidra-reverse.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip ghidra-reverse.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip ghidra-reverse.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent to the exact Ghidra install path, since the headless script path varies by installation
- Work only on binaries you own or are authorised to analyse, and keep notes of function addresses for reproducibility
- Be aware the skill's instructions are partly in Chinese and reference files outside this skill folder, so check those dependencies before relying on it
What's inside
- references/ghidra-cheatsheet.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.