[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-83281":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":13,"stars7d":15,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":16,"compositeScore":17,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":18,"hasPages":18,"topics":20,"createdAt":9,"pushedAt":9,"updatedAt":21,"readmeContent":22,"aiSummary":9,"trendingCount":14,"starSnapshotCount":14,"syncStatus":23,"lastSyncTime":24,"discoverSource":25},83281,"ghidra-rpc","cellebrite-labs\u002Fghidra-rpc","cellebrite-labs","A Ghidra agentic reverse engineering skill.",null,"Python",189,14,1,0,87,8,3.53,false,"main",[],"2026-06-12 02:04:32","# ghidra-rpc\n\nAn agentic skill that gives an LLM access to [Ghidra](https:\u002F\u002Fghidra-sre.org\u002F) so\nit can perform reverse engineering tasks autonomously: decompile functions, trace\ncall graphs, rename and annotate symbols, define data structures, diff binary\nversions, and more — all without human intervention.\n\n`ghidra-rpc` runs Ghidra as a persistent background daemon and exposes its\ncapabilities through a CLI that returns structured JSON. Any AI coding assistant\nthat can run shell commands (pi, Claude Code, Cursor, etc.) can drive a full RE\nsession by issuing commands and reasoning over the results.\n\nDeveloped at **[Cellebrite Labs](https:\u002F\u002Fgithub.com\u002Fcellebrite-labs)**.\n\n## What the AI Can Do\n\n| Area | Capabilities |\n|------|-------------|\n| **Understand code** | Decompile functions to pseudo-C, disassemble, inspect CFG and P-code |\n| **Navigate** | Trace callers\u002Fcallees, search strings and byte patterns, find cross-references |\n| **Annotate** | Rename functions and symbols, add comments, set bookmarks and tags |\n| **Type recovery** | Define structs\u002Funions\u002Fenums, retype variables, set function signatures |\n| **Patch** | Assemble instructions (SLEIGH), write raw bytes, override flow types |\n| **Diff binaries** | Version-track two builds, diff changed functions, match functions via BSim |\n\n## Quick Start\n\n```bash\n# Prerequisites: Ghidra 11+, Python 3.11+, Java 17+, uv\nexport GHIDRA_INSTALL_DIR=\u002Fopt\u002Fghidra_12.0\nuv tool install \u002Fpath\u002Fto\u002Fghidra-rpc\n```\n\nOnce installed, tell your AI assistant to start a session:\n\n> *\"Load \u002Fusr\u002Fbin\u002Fls into Ghidra and find any unsafe string operations.\"*\n\nFor manual use or debugging:\n\n```bash\n# Start the daemon (use --detach for background)\nghidra-rpc start --project \u002Ftmp\u002Fwork.gpr --headless\n\nexport GHIDRA_RPC_PROJECT=\u002Ftmp\u002Fwork.gpr\nghidra-rpc load \u002Fusr\u002Fbin\u002Fls\nghidra-rpc decompile ls main\nghidra-rpc xrefs-to ls strcmp\nghidra-rpc rename-function ls FUN_00401234 parse_args\n```\n\nSee [docs\u002Finstall.md](docs\u002Finstall.md) for prerequisites and\n[docs\u002Fquickstart.md](docs\u002Fquickstart.md) for a full walkthrough.\n\n## How It Works\n\n```\n┌─────────────┐      Unix Socket       ┌──────────────────────────┐\n│  LLM agent  │  ──── JSON\u002Fnewline ──→ │  ghidra-rpc daemon       │\n│  (via CLI)  │  ←── JSON\u002Fnewline ───  │  (PyGhidra + Ghidra JVM) │\n└─────────────┘                        └──────────────────────────┘\n```\n\nThe daemon runs Ghidra in-process via\n[PyGhidra](https:\u002F\u002Fgithub.com\u002FNationalSecurityAgency\u002Fghidra\u002Ftree\u002Fmaster\u002FGhidra\u002FFeatures\u002FPyGhidra).\nGhidra loads the binary once and stays warm between commands — no re-analysis on\nevery invocation. All changes (renames, comments, type definitions, patches) are\nsaved to the Ghidra project after every command and remain visible when you open the\nproject in the Ghidra GUI.\n\n## Documentation\n\n- [Installation](docs\u002Finstall.md)\n- [Quick Start](docs\u002Fquickstart.md)\n- [Troubleshooting](docs\u002Ftroubleshooting.md)\n- [Internals](docs\u002Finternals.md) — session\u002Fsocket design, Ghidra API notes\n\n### Workflow Guides\n\n- [Binary Audit](docs\u002Fflows\u002Fbinary-audit.md)\n- [Vulnerability Research](docs\u002Fflows\u002Fvulnerability-research.md)\n- [Patch Analysis](docs\u002Fflows\u002Fpatch-analysis.md)\n\n## License\n\nMIT\n",2,"2026-06-11 04:10:47","CREATED_QUERY"]