DOCSEARCHbyAlgolia
Submit Docs

GhidrAssist Documentation

repository·master·Indexed 20 days ago

https://github.com/symgraph/ghidrassist

An LLM-powered plugin for Ghidra designed for interactive reverse engineering. It features code explanation, a ReAct-based autonomous agentic investigation mode, and a Graph-RAG system for semantic binary analysis. GhidrAssist supports OpenAI v1-compatible APIs, including local providers like Ollama and LM Studio, and cloud services via OpenAI, Anthropic, and LiteLLM. It can integrate with GhidrAssistMCP to execute Ghidra-specific tools such as navigating cross-references and renaming functions.

Tokens
7.9K
Snippets
6
Records
50
Agent score
71%

What's inside GhidrAssist

  1. Overview of GhidrAssist capabilities and tabs

    master

    GhidrAssist is an LLM-powered Ghidra plugin designed to automate reverse engineering workflows. It integrates directly into the Ghidra CodeBrowser via seven specialized tabs, allowing you to interact with models without leaving your analysis environment.

    Available Analysis Tabs

    TabPurpose
    ExplainGenerate and store function explanations with security analysis
    QueryInteractive chat with context macros and autonomous ReAct agent
    ActionsLLM-powered suggestions for renaming, retyping, and struct creation
    Semantic GraphBuild a knowledge graph of function relationships and security properties
    RAGManage external documentation for context-enhanced queries
    SymGraphCompare against SymGraph, import shared analysis, and publish revisions
    SettingsConfigure LLM providers, MCP servers, and plugin options

  2. What is ReAct Agentic Mode?

    master

    ReAct (Reasoning and Acting) Agentic Mode is an autonomous investigation mode that uses a structured Think-Act-Observe loop. Instead of a single response, the LLM acts as an agent to solve complex reverse engineering tasks.

    How it works

    1. Propose: The LLM proposes a series of investigation steps presented as a todo list.
    2. Execute: The agent systematically executes tools (via MCP or internal functions) to gather data.
    3. Observe: The agent observes the results of each tool call and updates its progress.
    4. Synthesize: After completing the steps, the agent provides a final synthesis containing comprehensive answers and key findings.

    When to use it

    Use Agentic mode for complex, multi-step queries such as:

    • "Trace the data flow from user input to this call"
    • "Find all functions that modify global variable X"
    • "Analyze the error handling in the current function"
    • "Find vulnerabilities in this function"

  3. Available Action Types in the Actions tab

    master

    GhidrAssist provides four primary types of LLM-powered analysis actions:

    • Rename Function: Suggests a semantic name for the current function based on its observed behavior.
    • Rename Variable: Proposes descriptive variable names based on how they are used in the code.
    • Retype Variable: Recommends more accurate or descriptive data types for variables based on usage.
    • Auto Create Struct: Analyzes offset access patterns to generate new structure definitions.

  4. Explore the Semantic Graph Tab

    master

    The Semantic Graph tab is used to build and explore a knowledge graph of a binary. It captures relationships, LLM-generated summaries, security properties, and taint analysis results. It provides a call-graph-backed knowledge base that helps identify function communities and vulnerabilities.

    Key features include:

    • Call-graph knowledge base: Maps relationships between functions.
    • LLM Summaries: Provides high-level descriptions of function behavior.
    • Security Annotations: Includes security flags and taint analysis results.
    • Function Communities: Groups related functions for modular understanding.

  5. Understand the GhidrAssist Architecture

    master

    GhidrAssist follows a Model-View-Controller (MVC) architecture to ensure the Ghidra UI remains responsive during heavy LLM operations:

    • Views: Swing-based UI components for each tab.
    • Controllers: Handle business logic and LLM orchestration.
    • Services: Reusable services for settings, analysis storage, RAG, and more.

    Note: All LLM operations run in background tasks with streaming support for real-time output.

  6. How MCP Tool Integration works in GhidrAssist

    master

    GhidrAssist supports the Model Context Protocol (MCP), enabling LLMs to perform active tasks within Ghidra via tool calls. When MCP is enabled, the LLM can:

    • Navigate to functions and addresses
    • Retrieve decompiled code and disassembly
    • Query cross-references
    • Access the semantic graph
    • Use external MCP servers for specialized tooling

    Connection Methods:

    • Remote MCP servers: Connect via SSE or Streamable HTTP.
    • Local MCP tools: Launched directly over stdio.

  7. How stored explanations are indexed

    master

    GhidrAssist persists function explanations so they can be retrieved later. Explanations are uniquely identified and stored using a combination of:

    • The Binary SHA256 hash
    • The Function address

    This ensures that when you return to a specific function in a specific binary, the previously generated or edited explanation is automatically loaded.

  8. Understand SymGraph document workflow

    master

    Document synchronization in SymGraph is integrated with the Query experience:

    • Pushing Documents: Local document chats that are marked as SymGraph push candidates are included in publish previews. You can modify the document type before publishing.
    • Importing Documents: When you import documents from SymGraph, they are inserted into your Query history as SymGraph-backed document chats. These can be reopened and updated locally.

  9. How the ReAct Autonomous Agent works

    master

    For complex investigations, GhidrAssist includes a ReAct (Reasoning + Acting) agent. This agent is designed for exploratory questions (e.g., "What does this binary do?") by following a four-step autonomous loop:

    1. Plan: Creates an investigation plan based on your question.
    2. Execute: Performs multiple tool calls to gather necessary information.
    3. Reflect: Evaluates findings and adapts its approach.
    4. Synthesize: Produces a comprehensive final answer.

  10. Configure Query Tab Enhancement Options

    master

    The Query tab allows you to toggle specific capabilities to change how the LLM interacts with your binary. These options are located in the Input Area:

    • Use RAG: Includes document context from the RAG (Retrieval-Augmented Generation) index in your query.
    • Use MCP Tools: Enables the LLM to call Model Context Protocol (MCP) tools for interactive analysis (e.g., decompiling functions, getting cross-references, or querying the semantic graph).
    • Agentic Mode (ReAct): Enables the ReAct autonomous agent for complex, multi-step investigations.

  11. Quickstart: Install and Enable GhidrAssist

    master

    Follow these steps to set up GhidrAssist in your Ghidra environment:

    1. Install Extension: Copy the binary release ZIP archive to your Ghidra_Install/Extensions/Ghidra directory.
    2. Enable in Ghidra: Launch Ghidra, go to File -> Install Extension, and enable GhidrAssist.
    3. Load Binary: Open your target binary in the CodeBrowser.
    4. Configure Plugin: In the CodeBrowser, navigate to File -> Configure -> Miscellaneous and enable GhidrAssist.
    5. Open UI: Go to CodeBrowser -> Window -> GhidraAssistPlugin (or use the GhidrAssist option in the Windows menu).
    6. Initial Setup:
      • Ensure RLHF and RAG database paths are correctly set for your environment.
      • Point the API host to your preferred provider and set the API key.
      • (Optional) Set the Reasoning Effort level in the Analysis Options tab if using models that support extended thinking.
    # General workflow summary
# 1. Copy ZIP to Ghidra_Install/Extensions/Ghidra
# 2. Ghidra -> File -> Install Extension -> Enable GhidrAssist
# 3. CodeBrowser -> File -> Configure -> Miscellaneous -> Enable GhidrAssist
# 4. CodeBrowser -> Window -> GhidrAssistPlugin

  12. Use Context Macros in the Query Tab

    master

    To provide the LLM with specific binary data without manual copying, use context macros in your prompts. These macros are automatically replaced with the relevant binary context before the query is sent to the LLM.

    MacroDescription
    #funcCurrent function code (decompiler or disassembly)
    #addrData at the current address
    #lineCurrent line (decompiler or disassembly)
    #range(start, end)Data in an address range

    Example usage: What vulnerabilities exist in #func?

    What vulnerabilities exist in #func?