Reverse Engineering

Reverse Engineering Skill

Binary analysis and reverse engineering via MCP servers for Ghidra, IDA Pro, radare2, and angr.

Trigger Conditions

• User asks to analyze binaries, disassemble code, decompile functions
• Questions about malware analysis, vulnerability research, CTF challenges
• Binary diffing, patch analysis, firmware extraction
• Symbol recovery, function identification, control flow analysis

MCP Servers

1. GhidrAssistMCP (Ghidra - Free)

Repository: https://github.com/jtang613/GhidrAssistMCP
Stars: High activity
Transport: HTTP/SSE on port 8080

Installation:

# Download from releases page
# In Ghidra: File → Install Extensions → Add Extension
# Enable: File → Configure → Configure Plugins → GhidrAssistMCP

31 Built-in Tools:

2. LaurieWired/GhidraMCP (Popular Alternative)

Repository: https://github.com/LaurieWired/GhidraMCP
Transport: Python bridge to Ghidra

3. IDA Pro MCP Servers

mrexodia/ida-pro-mcp (Most active):

git clone https://github.com/mrexodia/ida-pro-mcp
cd ida-pro-mcp
pip install -e .

MxIris-Reverse-Engineering/ida-mcp-server (473 stars):

git clone https://github.com/MxIris-Reverse-Engineering/ida-mcp-server

fdrechsler/mcp-server-idapro:

git clone https://github.com/fdrechsler/mcp-server-idapro

4. radare2-mcp (Official)

Repository: https://github.com/radareorg/radare2-mcp
Transport: stdio

# Install radare2 first
brew install radare2  # macOS
# or: apt install radare2  # Linux

git clone https://github.com/radareorg/radare2-mcp
cd radare2-mcp
pip install -e .

MCP Config:

{
  "mcpServers": {
    "radare2": {
      "command": "r2-mcp",
      "args": []
    }
  }
}

5. rand-tech/pcm (Multi-tool)

Repository: https://github.com/rand-tech/pcm
MCP for reverse engineering combining multiple backends.

Workflows

Basic Binary Analysis

1. Load binary into Ghidra/IDA
2. Start MCP server
3. Query: "List all functions" → list_functions
4. Query: "Decompile main" → decompile_function
5. Query: "Find xrefs to this address" → xrefs_to

Malware Analysis Pattern

1. get_program_info → Architecture, compiler, entry point
2. list_imports → Suspicious API calls (CreateRemoteThread, VirtualAlloc)
3. list_strings → C2 URLs, encryption keys, debug strings
4. search_functions "crypt" → Find encryption routines
5. decompile_function → Understand algorithm
6. auto_create_struct → Recover data structures

Vulnerability Research

1. list_functions → Function list with sizes
2. search_functions "parse|read|copy" → Input handlers
3. decompile_function → Find buffer operations
4. xrefs_to → Trace data flow
5. set_decompiler_comment → Annotate findings

CTF Binary Exploitation

1. get_program_info → Check protections (PIE, RELRO, canary)
2. list_functions → Find win/flag functions
3. decompile_function → Understand vulnerability
4. xrefs_from → Control flow analysis
5. list_segments → Memory layout for ROP

CLI Quick Reference

radare2 Commands

r2 binary                    # Open binary
aaa                          # Analyze all
afl                          # List functions
pdf @ main                   # Disassemble function
pdc @ main                   # Decompile (r2ghidra)
axt @ addr                   # Xrefs to
axf @ addr                   # Xrefs from
iz                           # List strings
ii                           # List imports

Ghidra Headless

analyzeHeadless /tmp/project ProjectName \
  -import binary.exe \
  -postScript ExportDecompilation.java \
  -deleteProject

Resources

• Awesome Reverse Engineering
• CTF Wiki - Reverse
• Ghidra Scripting
• radare2 Book

r2con Speaker Repositories

Key repositories from r2con 2016-2025 speakers for process tree and binary analysis:

Core radare2 Team

ESIL & Symbolic Execution

Frida Integration (r2frida)

Malware & Security Analysis

Signatures & Similarity

Mobile Security (OWASP MSTG)

Decompilation & Analysis

Key Tool Repositories

# radare2 ecosystem
git clone https://github.com/radareorg/radare2      # Core framework
git clone https://github.com/radareorg/r2ghidra     # Ghidra decompiler
git clone https://github.com/radareorg/radare2-mcp  # MCP server
git clone https://github.com/radareorg/esil-rs      # ESIL in Rust

# Rizin fork (Cutter backend)
git clone https://github.com/rizinorg/rizin         # Rizin framework
git clone https://github.com/rizinorg/cutter        # GUI
git clone https://github.com/rizinorg/rz-ghidra     # Ghidra integration

# Frida ecosystem
git clone https://github.com/frida/frida-core       # Core library
git clone https://github.com/frida/frida-gum        # Instrumentation
git clone https://github.com/frida/cryptoshark      # Code tracer

# Speaker tools
git clone https://github.com/swoops/libc_zignatures # libc signatures
git clone https://github.com/swoops/dr_pebber       # Fake TEB/PEB for ESIL
git clone https://github.com/mrphrazer/msynth       # MBA simplification
git clone https://github.com/cryptax/droidlysis     # Android analysis
git clone https://github.com/iGio90/Dwarf           # Frida debugger
git clone https://github.com/condret/r2premium      # r2 premium features

Process Tree Analysis Perspectives

Each speaker brings unique analysis perspective:

Example Session

User: Analyze this binary for buffer overflow vulnerabilities

Agent:
1. Starting GhidraMCP server...
2. Loading binary and auto-analyzing...
3. [list_functions] Found 47 functions
4. [search_functions "strcpy|sprintf|gets"] Found 3 dangerous calls:
   - sub_401234: uses strcpy with stack buffer
   - sub_401456: sprintf without bounds
5. [decompile_function "sub_401234"] 
   
   void vuln_func(char *input) {
       char buffer[64];
       strcpy(buffer, input);  // VULNERABLE: no bounds check
       ...
   }

6. [xrefs_to "sub_401234"] Called from main+0x45
7. Vulnerability confirmed: Stack buffer overflow in sub_401234

End-of-Skill Interface

Integration with Gay.jl Colors

Assign deterministic colors to binary analysis domains:

using Gay

# Trit classification for RE tools
GHIDRA_TRIT = 0      # ZERO - foundational analysis
IDA_TRIT = 1         # PLUS - commercial/advanced  
RADARE2_TRIT = -1    # MINUS - lightweight/CLI

# Color functions by complexity
function color_function(cyclomatic_complexity::Int, seed::UInt64)
    Gay.color_at(cyclomatic_complexity, seed)
end

# Color control flow graph nodes
function color_cfg_node(block_id::Int, func_seed::UInt64)
    Gay.color_at(block_id, func_seed)
end

Related Skills

• effective-topos: radare2 integration
• mcp-tripartite: Binary analysis trit (-1 MINUS)
• binsec: Symbolic execution tutorials
• gay-mcp: Deterministic coloring for CFG visualization