Dryxio/auto-re-agent

Open-source AI reverse-engineering agent using Ghidra and LLMs to reconstruct and validate C/C++ functions from binaries.

What it solves

auto-re-agent automates the tedious process of reverse-engineering compiled binaries into reconstructible C/C++ source code. While traditional decompilers provide pseudocode, this tool aims to generate valid, buildable, and testable candidate implementations that can be integrated into a project's source tree.

How it works

The tool orchestrates an autonomous pipeline that combines program analysis with LLM-driven reconstruction:

  1. Evidence Gathering: It uses ghidra-ai-bridge to extract decompilation, assembly, control flow graphs (CFG), P-code, and structural data (structs, enums, vtables) from Ghidra.
  2. Reverser/Checker Loop: A "reverser" LLM generates a candidate implementation, which is then reviewed by an independent "checker" LLM. This loop continues for a bounded number of rounds until the code is accepted or the limit is reached.
  3. Conservative Verification: The agent employs a structural verifier to find mismatches between the generated code and the binary evidence, and runs 11 built-in heuristic parity signals to flag issues like missing source or call-count mismatches.
  4. Validation Gates: It can automatically run project-specific build and test commands (e.g., via CMake and CTest) in a temporary project copy to ensure the generated code actually compiles and passes tests.

Who it’s for

Software reverse engineers and developers working on legacy binaries or closed-source projects who need to reconstruct high-quality C/C++ functions at scale.

Highlights

  • Multi-LLM Support: Compatible with Claude (API/CLI), OpenAI-compatible APIs, and Codex CLI.
  • Autonomous Workflow: Handles function selection, evidence gathering, and iterative refinement without constant human intervention.
  • Build-Verified: Integrates with actual build systems to ensure candidates are not just syntactically correct but functionally viable.
  • Knowledge Graph: Maintains a persistent knowledge-graph.json connecting functions, calls, and globals to provide context for the LLMs.
  • Non-Destructive: Generates candidates in overlays and temporary directories rather than modifying the original source tree directly.

Related

  • Project
    cellebrite-labs/ghidra-rpc

    An agentic skill that gives LLMs access to Ghidra via a CLI and background daemon, enabling autonomous reverse engineering and binary analysis.

  • Project
    morluto/rea

    An agent-driven reverse engineering framework that allows AI agents to investigate app behavior and native binaries using tools like Hopper and Ghidra to explain and recreate software features.

  • Project
    weirdmachine64/GhidraGPT

    A Ghidra extension that integrates LLMs into the decompiler workflow to explain, rename, and audit decompiled C functions.

  • Project
    llnl/OGhidra

    OGhidra is a genuine open‑source project that adds large‑language‑model assistance to the Ghidra reverse‑engineering platform. It lets users ask natural‑language questions, runs AI‑driven analysis (function renaming, malware pattern detection, report generation), and supports both local Ollama models and cloud APIs while keeping binaries private.

  • Project
    cyberkaida/reverse-engineering-assistant

    ReVa is a Ghidra MCP server that enables AI models to interact with reverse engineering tools, allowing LLMs to perform deep binary analysis and automation while minimizing hallucinations.