mcpField
H
headless-ghidra-discovery

headless-ghidra-discovery

github.com/bytelandtechnologySecurity584 installsUpdated 25w ago
Repository

About headless-ghidra-discovery

headless-ghidra-discovery is a skill for enriching Ghidra function metadata during phase P3 of reverse-engineering workflows. It uses third-party evidence and runtime call chains, with project changes applied serially through ghidra-agent-cli.

Key features

  1. 01Combine third-party evidence and runtime call chains
  2. 02Produce function rename and signature metadata
  3. 03Validate metadata and hotpaths
  4. 04Apply and verify changes serially through the CLI
  5. 05Record reproducible analysis evidence

Use cases

  1. 01Recover names and signatures for hotpath functions
  2. 02Apply metadata changes to a Ghidra project
  3. 03Check phase P3 gate requirements

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bytelandtechnology/headless-ghidra --skill headless-ghidra-discovery

After installing, type/headless-ghidra-discoveryin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

README.ja-JP.md
README.md
README.zh-CN.md

Details

From the project README

Headless Ghidra Metadata Enrichment — P3

P3 enriches function metadata from third-party evidence and the P1 runtime hotpath call-chain. Analysis work may be parallelized while producing YAML, but all writes back to the Ghidra project must go through serialized ghidra-agent-cli ghidra ... commands.

Required ghidra-agent-cli Commands

  • ghidra-agent-cli workspace state show
  • ghidra-agent-cli functions list
  • ghidra-agent-cli callgraph callers
  • ghidra-agent-cli callgraph callees
  • ghidra-agent-cli metadata enrich-function
  • ghidra-agent-cli metadata validate
  • ghidra-agent-cli hotpath validate
  • ghidra-agent-cli ghidra apply-renames
  • ghidra-agent-cli ghidra verify-renames
  • ghidra-agent-cli ghidra apply-signatures
  • ghidra-agent-cli ghidra verify-signatures
  • ghidra-agent-cli gate check --phase P3

Inputs

  • artifacts/<target-id>/pipeline-state.yaml
  • artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
  • artifacts/<target-id>/third-party/identified.yaml
  • artifacts/<target-id>/baseline/functions.yaml
  • artifacts/<target-id>/baseline/callgraph.yaml
  • artifacts/<target-id>/baseline/types.yaml

Outputs

  • artifacts/<target-id>/metadata/renames.yaml
  • artifacts/<target-id>/metadata/signatures.yaml
  • artifacts/<target-id>/metadata/types.yaml
  • artifacts/<target-id>/metadata/constants.yaml
  • artifacts/<target-id>/metadata/strings.yaml
  • artifacts/<target-id>/metadata/apply-records/

Exit Expectations

  • Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
  • Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
  • The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

  • Do not decompile anything in this phase.
  • Do not rewrite historical per-function outputs.
  • Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
  • Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

  • P3 gate passes → headless-ghidra-batch-decompile

Comments

Markdown supported