mcpField
H
headless-ghidra-evidence

headless-ghidra-evidence

github.com/bytelandtechnologySecurity590 installsUpdated 25w ago
Repository

About headless-ghidra-evidence

A workflow skill for reviewing third-party libraries in a headless Ghidra analysis, using baseline and runtime evidence. It records library versions, source locations, confidence, and function classifications for later metadata recovery.

Key features

  1. 01Review baseline and runtime evidence
  2. 02Record library versions and confidence
  3. 03Track pristine source directories
  4. 04Classify third-party functions
  5. 05Check the P2 phase gate

Use cases

  1. 01Identifying libraries in analyzed binaries
  2. 02Recording source and version evidence
  3. 03Preparing function metadata recovery
  4. 04Documenting cases with no third-party code

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bytelandtechnology/headless-ghidra --skill headless-ghidra-evidence

After installing, type/headless-ghidra-evidencein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

planning-brief.md
README.ja-JP.md
README.md
README.zh-CN.md
examples/
evidence-speckit-handoff.md

Details

From the project README

Headless Ghidra Third-Party — P2

P2 reviews baseline and runtime YAML to identify third-party libraries, record local pristine source directories, and classify functions for later metadata enrichment. Source download or acquisition is outside the CLI; the CLI records source_path, pristine_path, version, confidence, and evidence.

Required ghidra-agent-cli Commands

  • ghidra-agent-cli functions list
  • ghidra-agent-cli functions show
  • ghidra-agent-cli imports list
  • ghidra-agent-cli constants list
  • ghidra-agent-cli strings list
  • ghidra-agent-cli vtables list
  • ghidra-agent-cli types list
  • ghidra-agent-cli callgraph list
  • ghidra-agent-cli callgraph callers
  • ghidra-agent-cli callgraph callees
  • ghidra-agent-cli third-party add
  • ghidra-agent-cli third-party none
  • ghidra-agent-cli third-party set-version
  • ghidra-agent-cli third-party list
  • ghidra-agent-cli third-party classify-function
  • ghidra-agent-cli third-party vendor-pristine
  • ghidra-agent-cli execution-log append
  • ghidra-agent-cli gate check --phase P2

Inputs

  • artifacts/<target-id>/baseline/functions.yaml
  • artifacts/<target-id>/baseline/callgraph.yaml
  • artifacts/<target-id>/baseline/types.yaml
  • artifacts/<target-id>/baseline/constants.yaml
  • artifacts/<target-id>/baseline/vtables.yaml
  • artifacts/<target-id>/baseline/strings.yaml
  • artifacts/<target-id>/baseline/imports.yaml
  • artifacts/<target-id>/runtime/run-manifest.yaml
  • artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
  • Existing artifacts/<target-id>/third-party/identified.yaml if present

Outputs

  • artifacts/<target-id>/third-party/identified.yaml
  • artifacts/<target-id>/third-party/pristine/<library>@<version>/
  • Optional local adaptation changes under artifacts/<target-id>/third-party/compat/<library>@<version>/

Exit Expectations

  • identified.yaml records at least one medium-or-higher confidence library when third-party code is present.
  • identified.yaml records libraries: [] when review finds no third-party code.
  • Each recorded third-party library has a local source_path and a pristine directory under third-party/pristine/.
  • Pristine source directories are kept unmodified; local adaptation edits live under third-party/compat/.
  • The next phase has enough version and function-classification evidence to recover names, signatures, and types.

Constraints

  • Do not mutate baseline YAML exports directly.
  • Do not claim unsupported evidence without recording the supporting source.
  • Do not bypass ghidra-agent-cli for supported baseline reads, third-party writes, or execution logging.
  • Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

  • P2 gate passes → headless-ghidra-discovery

Comments

Markdown supported