Repolode
Submit
symgraph

symgraph/GhidrAssist

An LLM-powered extension for Ghidra that adds AI-assisted code explanation, chat, and agentic analysis to reverse engineering workflows.

View on GitHub
Stars
767
Forks
77
Open issues
4
Last commit
5 days ago

What is it?

GhidrAssist is a Java plugin for Ghidra that connects reverse engineers to large language models. It works with any OpenAI v1-compatible API, including local servers such as Ollama and LM Studio and cloud providers such as OpenAI, Anthropic, and Azure. Users can explain functions in disassembly or decompiled pseudo-C, hold multi-turn chats with saved history, and run direct custom queries with function context.

Beyond basic prompting, the plugin builds a semantic knowledge graph of a binary across statement, block, function, module, and binary levels. It stores LLM summaries in SQLite, detects function communities with the Leiden algorithm, and extracts network, file I/O, and crypto API usage with risk levels. A ReAct agent mode can plan investigation steps, call tools, and synthesize findings. MCP support lets it work with the GhidrAssistMCP server for Ghidra-specific tools.

The project targets reverse engineers and security researchers who want LLM help inside Ghidra. It requires Ghidra 11.0 or later.

Key features

  • 01Explains functions in disassembly and decompiled pseudo-C code.
  • 02Supports multi-turn chat with persistent history.
  • 03Builds a hierarchical semantic knowledge graph with SQLite storage.
  • 04Extracts network, file I/O, and crypto API usage with risk levels.
  • 05Runs a ReAct agent that plans and executes investigation steps.
  • 06Connects to MCP servers over SSE for Ghidra-specific tools.

Use cases

  • Getting quick explanations of unfamiliar functions during binary triage.
  • Scanning a binary for network, file, or crypto API usage with risk labels.
  • Running a local LLM against proprietary binaries without sending code to a cloud service.
  • Asking multi-step questions such as tracing data flow across functions.

Quick start

  1. 1

    Copy the binary release ZIP into the Ghidra Extensions directory (if needed)

  2. 2

    In Ghidra, go to File > Install Extension and enable GhidrAssist

  3. 3

    Open CodeBrowser, enable GhidrAssist, then set the API host and API key in its settings

Things to know

  • Requires an OpenAI v1-compatible LLM API, which may need a paid API key or a local model server.
  • Requires Ghidra 11.0 or newer.
  • Agentic mode and Actions depend on models with reliable tool calling.

Topics

#reverse-engineering#llm#ghidra-extension#ai-assistant#decompiler#binary-analysis#openai-compatible#chatgpt#ghidra#ghidra-plugin

FAQ

What is GhidrAssist?
An LLM-powered extension for Ghidra that adds AI-assisted code explanation, chat, and agentic analysis to reverse engineering workflows. GhidrAssist is a Java plugin for Ghidra that connects reverse engineers to large language models. It works with any OpenAI v1-compatible API, including local servers such as Ollama and LM Studio and cloud providers such as OpenAI, Anthropic, and Azure. Users can explain functions in disassembly or decompiled pseudo-C, hold multi-turn chats with saved history, and run direct custom queries with function context.
Is GhidrAssist free to use? What license does it have?
GhidrAssist is open source under the MIT license. Check the license terms before using it in commercial products.
Is GhidrAssist still maintained?
Actively maintained. The last commit to GhidrAssist was on Oct 16, 2026.
What can I use GhidrAssist for?
Getting quick explanations of unfamiliar functions during binary triage. Scanning a binary for network, file, or crypto API usage with risk labels. Running a local LLM against proprietary binaries without sending code to a cloud service. Asking multi-step questions such as tracing data flow across functions.
How do I install GhidrAssist?
Copy the binary release ZIP into the Ghidra Extensions directory (if needed) In Ghidra, go to File > Install Extension and enable GhidrAssist Open CodeBrowser, enable GhidrAssist, then set the API host and API key in its settings
Where can I get GhidrAssist?
The source code and installation instructions are on GitHub: https://github.com/symgraph/GhidrAssist

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects