ghidra-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Ghidra Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

NOW

: 读取

../field-journal/precedent-reverse.md

```
NOW
```
: 确认需要 Ghidra（无 IDA / 偏好开源 / 批量 headless）
```
NEXT
```
: 读
```
../tool-index.md
```
查 ghidra / ghidra-mcp 路径
```
NEXT
```
: 缺工具 → bootstrap
```
ghidra-mcp
```
（若 manifest 支持）或按手动步骤装 Ghidra
```
ACT
```
: 导入样本 → 自动分析 → 导出关键函数反编译

NOW

: Read

../field-journal/precedent-reverse.md

```
NOW
```
: Confirm the need for Ghidra (No IDA / Prefer open source / Batch headless)
```
NEXT
```
: Read
```
../tool-index.md
```
to check the path of ghidra / ghidra-mcp
```
NEXT
```
: If tools are missing → bootstrap
```
ghidra-mcp
```
(if manifest supports) or install Ghidra manually
```
ACT
```
: Import sample → Auto-analyze → Export decompilation of key functions

适用场景

Applicable Scenarios

无 IDA 许可证时的主逆向入口
批量 headless 分析 / CI 中反编译
Ghidra 脚本（Java/Python Jython/PyGhidra）自动化
与
```
binary-diff
```
/
```
patch-diff-exploit
```
的 ghidriff 联动

Primary reverse engineering entry when IDA license is unavailable
Batch headless analysis / decompilation in CI
Automation with Ghidra scripts (Java/Python Jython/PyGhidra)
Integration with ghidriff from
```
binary-diff
```
/
```
patch-diff-exploit
```

与 IDA 分工

Division of Labor with IDA

需求	优先
已有 IDA MCP 深挖	`ida-reverse/`
开源 / 批量 / 教学	本 skill
仅 CLI 快速侦察	`radare2/`

Requirement	Priority
In-depth analysis with existing IDA MCP	`ida-reverse/`
Open source / batch processing / education	This skill
CLI-only quick reconnaissance	`radare2/`

工作流

Workflow

1. 项目与自动分析

1. Project and Auto-Analysis

text

□ 新建 Project → Import 文件 → Analyze（默认分析器）
□ 记录语言/编译器识别结果与基址
□ 标记入口、导出表、字符串 xref

text

□ Create new Project → Import file → Analyze (default analyzer)
□ Record language/compiler recognition results and base address
□ Mark entry points, export tables, string xrefs

2. 关键函数

2. Key Functions

text

□ 从字符串 / 导入 API 反查
□ Decompile 窗口还原算法
□ 重命名函数/变量；写 Plate comment
□ 需要动态时交接 Frida/GDB（reverse-engineering 动态章）

text

□ Trace back from strings / imported APIs
□ Restore algorithm in Decompile window
□ Rename functions/variables; write Plate comment
□ Hand over to Frida/GDB for dynamic analysis when needed (reverse-engineering dynamic chapter)

3. Headless（批量）

3. Headless (Batch Processing)

bash

undefined

bash

undefined

示例：analyzeHeadless 路径因安装而异，MUST 从 tool-index 取

Example: analyzeHeadless path varies by installation, MUST retrieve from tool-index

analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py

undefined

analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py

undefined

4. MCP（若已配置）

4. MCP (If Configured)

text

□ 确认 ghidra MCP 端口（常见 8765，以 tool-index 为准）
□ 用 MCP 工具拉反编译 / xrefs，禁止猜端口

text

□ Confirm ghidra MCP port (commonly 8765, refer to tool-index)
□ Pull decompilation / xrefs using MCP tool, do not guess ports

工具链

Toolchain

工具	用途	自举
Ghidra	反编译主工具	手动 release / 包管理器
ghidra-mcp	AI 桥	bootstrap 能力名 `ghidra-mcp`
ghidriff	补丁差分	见 `patch-diff-exploit`

Tool	Purpose	Bootstrapping
Ghidra	Primary decompilation tool	Manual release / package manager
ghidra-mcp	AI Bridge	Bootstrap with capability name `ghidra-mcp`
ghidriff	Patch Diffing	Refer to `patch-diff-exploit`

参考

References

```
references/ghidra-cheatsheet.md
```

../ida-reverse/

../radare2/

../binary-diff/

```
references/ghidra-cheatsheet.md
```

../ida-reverse/

../radare2/

../binary-diff/

路由上下文

Routing Context

上游: MASTER R22
下游: 动态验证 → Frida/GDB；利用 →

pwn-chain

同级:

ida-reverse

（商业深挖）

Upstream: MASTER R22
Downstream: Dynamic verification → Frida/GDB; Exploitation →

pwn-chain

Peer:

ida-reverse

(Commercial in-depth analysis)

任务完成自检

Task Completion Self-Check

是否基于真实 Ghidra/tool-index 路径？
是否标注函数地址与重命名？
是否有可复现步骤？
Checklist / journal？

Is it based on real Ghidra/tool-index path?
Are function addresses and renames annotated?
Are there reproducible steps?
Is there a Checklist / journal?