How do I install the Ghidra Reverse skill?

Run npx skillmds@latest add netvar1337/ghidra-reverse in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ghidra Reverse safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ghidra Reverse?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ghidra Reverse free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Ghidra Reverse?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ghidra Reverse by netvar1337 — Agent Skill

Name: Ghidra Reverse
Author: netvar1337

File contents

Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

Ghidra Reverse Engineering

ACTION REQUIRED (execute immediately after reading)

NOW: read ../field-journal/precedent-reverse.md
NOW: confirm Ghidra is needed (no IDA / open-source preference / batch headless)
NEXT: read ../tool-index.md for ghidra / ghidra-mcp paths
NEXT: missing tools → bootstrap ghidra-mcp (if the manifest supports it) or install Ghidra per manual steps
ACT: import sample → auto-analyze → export decompilation of key functions

Applicable Scenarios

Primary reverse engineering entry when there is no IDA license
Batch headless analysis / decompilation in CI
Ghidra script automation (Java/Python Jython/PyGhidra)
ghidriff integration with binary-diff / patch-diff-exploit

Division of Labor with IDA

Need	Preferred
Deep digging with IDA MCP already available	`ida-reverse/`
Open source / batch / teaching	this skill
Quick CLI reconnaissance only	`radare2/`

Workflow

1. Project and Auto-Analysis

□ New Project → Import file → Analyze (default analyzers)
□ Record language/compiler identification and base address
□ Mark entry point, export table, string xrefs

2. Key Functions

□ Trace back from strings / imported APIs
□ Restore algorithms in the Decompile window
□ Rename functions/variables; write Plate comments
□ Hand off to Frida/GDB when dynamics are needed (reverse-engineering dynamic chapter)

3. Headless (batch)

# Example: analyzeHeadless path varies by install, MUST be taken from tool-index
analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py

4. MCP (if configured)

□ Confirm the ghidra MCP port (commonly 8765; tool-index is authoritative)
□ Pull decompilation / xrefs via MCP tools; do not guess ports

Toolchain

Tool	Purpose	Bootstrap
Ghidra	Primary decompiler	Manual release / package manager
ghidra-mcp	AI bridge	bootstrap capability name `ghidra-mcp`
ghidriff	Patch diffing	See `patch-diff-exploit`

References

references/ghidra-cheatsheet.md
../ida-reverse/ ../radare2/ ../binary-diff/

Routing Context

Upstream: MASTER R22
Downstream: dynamic validation → Frida/GDB; exploitation → pwn-chain
Peers: ida-reverse (commercial deep digging)

Task Completion Self-Check

Based on real Ghidra/tool-index paths?
Function addresses and renames annotated?
Reproducible steps present?
Checklist / journal?

---name: ghidra-reversedescription: Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.license: MIT---> Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill# Ghidra Reverse Engineering## ACTION REQUIRED (execute immediately after reading)1. `NOW`: read `../field-journal/precedent-reverse.md`2. `NOW`: confirm **Ghidra** is needed (no IDA / open-source preference / batch headless)3. `NEXT`: read `../tool-index.md` for ghidra / ghidra-mcp paths4. `NEXT`: missing tools → bootstrap `ghidra-mcp` (if the manifest supports it) or install Ghidra per manual steps5. `ACT`: import sample → auto-analyze → export decompilation of key functions## Applicable Scenarios- Primary reverse engineering entry when there is no IDA license- Batch headless analysis / decompilation in CI- Ghidra script automation (Java/Python Jython/PyGhidra)- ghidriff integration with `binary-diff` / `patch-diff-exploit`## Division of Labor with IDA| Need | Preferred ||------|------|| Deep digging with IDA MCP already available | `ida-reverse/` || Open source / batch / teaching | **this skill** || Quick CLI reconnaissance only | `radare2/` |## Workflow### 1. Project and Auto-Analysis```text□ New Project → Import file → Analyze (default analyzers)□ Record language/compiler identification and base address□ Mark entry point, export table, string xrefs```### 2. Key Functions```text□ Trace back from strings / imported APIs□ Restore algorithms in the Decompile window□ Rename functions/variables; write Plate comments□ Hand off to Frida/GDB when dynamics are needed (reverse-engineering dynamic chapter)```### 3. Headless (batch)```bash# Example: analyzeHeadless path varies by install, MUST be taken from tool-indexanalyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py```### 4. MCP (if configured)```text□ Confirm the ghidra MCP port (commonly 8765; tool-index is authoritative)□ Pull decompilation / xrefs via MCP tools; do not guess ports```## Toolchain| Tool | Purpose | Bootstrap ||------|------|------|| Ghidra | Primary decompiler | Manual release / package manager || ghidra-mcp | AI bridge | bootstrap capability name `ghidra-mcp` || ghidriff | Patch diffing | See `patch-diff-exploit` |## References- `references/ghidra-cheatsheet.md`- `../ida-reverse/` `../radare2/` `../binary-diff/`## Routing Context**Upstream**: MASTER R22 **Downstream**: dynamic validation → Frida/GDB; exploitation → `pwn-chain` **Peers**: `ida-reverse` (commercial deep digging)## Task Completion Self-Check- [ ] Based on real Ghidra/tool-index paths?- [ ] Function addresses and renames annotated?- [ ] Reproducible steps present?- [ ] Checklist / journal?

Frequently asked questions

Ghidra Reverse