mcpField
H
headless-ghidra-baseline

headless-ghidra-baseline

github.com/bytelandtechnologySecurity583 installsUpdated 25w ago
Repository

About headless-ghidra-baseline

A skill for the P1 phase of a headless Ghidra analysis pipeline, intended for reverse-engineering workflows that need a reproducible baseline and runtime record. It uses ghidra-agent-cli to import and analyze targets, then exports YAML metadata and runtime and hotpath records.

Key features

  1. 01Run Ghidra import and auto-analysis
  2. 02Export baseline YAML metadata
  3. 03Capture and validate runtime records
  4. 04Record and validate hotpath call chains
  5. 05Check the P1 phase gate

Use cases

  1. 01Produce baseline metadata for later phases
  2. 02Record runtime availability or unavailability
  3. 03Provide an initial hotpath call chain for later analysis

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bytelandtechnology/headless-ghidra --skill headless-ghidra-baseline

After installing, type/headless-ghidra-baselinein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

README.ja-JP.md
README.md
README.zh-CN.md

Details

From the project README

Headless Ghidra Baseline+Runtime — P1

P1 runs the initial Ghidra import and auto-analysis, exports baseline YAML metadata, makes the target reproducibly runnable, and records runtime/hotpath YAML that later phases consume.

Required ghidra-agent-cli Commands

  • ghidra-agent-cli ghidra import
  • ghidra-agent-cli ghidra auto-analyze
  • ghidra-agent-cli ghidra export-baseline
  • ghidra-agent-cli frida device-list
  • ghidra-agent-cli frida device-attach
  • ghidra-agent-cli frida io-capture
  • ghidra-agent-cli frida trace
  • ghidra-agent-cli runtime record
  • ghidra-agent-cli runtime validate
  • ghidra-agent-cli hotpath add
  • ghidra-agent-cli hotpath validate
  • ghidra-agent-cli gate check --phase P1

The shell wrappers and Java Ghidra scripts remain the backend implementation for these commands. The workflow contract is the CLI surface plus the YAML outputs below.

Inputs

  • artifacts/<target-id>/pipeline-state.yaml
  • artifacts/<target-id>/scope.yaml
  • targets/<target-id>/ghidra-projects/

Outputs

  • artifacts/<target-id>/baseline/functions.yaml
  • artifacts/<target-id>/baseline/callgraph.yaml
  • artifacts/<target-id>/baseline/types.yaml
  • artifacts/<target-id>/baseline/vtables.yaml
  • artifacts/<target-id>/baseline/constants.yaml
  • artifacts/<target-id>/baseline/strings.yaml
  • artifacts/<target-id>/baseline/imports.yaml
  • artifacts/<target-id>/runtime/run-manifest.yaml
  • artifacts/<target-id>/runtime/run-records/*.yaml
  • artifacts/<target-id>/runtime/fixtures/**
  • artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
  • artifacts/<target-id>/runtime/project/** when a library harness is needed

Exit Expectations

  • All required baseline YAML files exist and are readable.
  • Runtime availability or unavailability is recorded with reproducible executable args or a C++/CMake library harness.
  • The P1 hotpath call-chain is available as the initial P3/P4 priority source.
  • No P4 decompilation artifacts are created in this phase.

Constraints

  • Do not decompile function bodies in P1.
  • Do not apply renames or signatures in P1.
  • Do not modify pipeline-state.yaml except through sanctioned state changes.
  • Do not bypass ghidra-agent-cli for import, analysis, export, or supported gate checks.
  • Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

  • P1 gate passes → headless-ghidra-evidence

Comments

Markdown supported