Noelo-Lab/kuna

An agent-first decompiler designed to be refined by other agents. Kuna is written in Rust and was originally ported from Ghidra.

What it solves

Kuna is a high-performance decompiler designed specifically for the era of LLM-driven reverse engineering. It addresses the inefficiency of traditional decompilers when used by AI agents, prioritizing decompilation text quality and execution speed over traditional GUI features to better serve agents that analyze binaries and report findings to humans.

How it works

Written in Rust and originally ported from Ghidra, Kuna uses a phase-based pipeline where each stage of the decompilation process is well-defined. This architecture allows LLM agents to easily locate and modify specific parts of the logic. The project employs an "autonomous refinement" loop where agents use datasets and metrics (via DecBench) to iteratively improve the decompiler's own code. It also provides a built-in "skill" that can be installed into agent frameworks like Claude Code or Codex to guide them on how to use the tool efficiently.

Who it’s for

  • Reverse Engineers: Those who need a fast, high-quality decompiler for optimized C.
  • AI Agent Developers: Developers building autonomous security tools that require a tunable, agent-optimized backend for binary analysis.
  • Security Researchers: Users who want to integrate a high-performance decompiler into the Ghidra GUI or use it via a web browser.

Highlights

  • Agent-First Design: Optimized for text output and speed to minimize bottlenecks for LLM agents.
  • Autonomous Refinement: Designed to be iteratively improved by the AI agents that use it.
  • High Performance: Capable of decompiling a 140MB binary in under 3 minutes and ranks top on DecBench for optimized C.
  • Flexible Deployment: Available as a CLI tool, a WebAssembly-powered browser app, or a backend plugin for the Ghidra GUI.
  • Tunable: Features can be toggled and configured to suit different needs, such as high-level code for reversers or low-level code for exploit developers.

Related

  • Project
    weirdmachine64/GhidraGPT

    A Ghidra extension that integrates LLMs into the decompiler workflow to explain, rename, and audit decompiled C functions.

  • Project
    llnl/OGhidra

    OGhidra is a genuine open‑source project that adds large‑language‑model assistance to the Ghidra reverse‑engineering platform. It lets users ask natural‑language questions, runs AI‑driven analysis (function renaming, malware pattern detection, report generation), and supports both local Ollama models and cloud APIs while keeping binaries private.

  • Project
    lucasjinreal/Crane

    Crane is a Rust‑based inference framework (built on candle) that runs LLMs, vision‑language models, OCR, ASR, TTS and music transcription fast on CPU, CUDA, Metal and experimental ROCm. It loads GGUF checkpoints directly, provides a clean Rust API and an OpenAI‑compatible HTTP server, and ships ready‑to‑use demo binaries for chat, image chat, OCR, speech, etc.

  • Project
    echoVic/orca-agent

    A DeepSeek-native coding agent for the terminal that can read code, edit files, and run commands to autonomously solve development tasks.

  • Project
    morluto/rea

    An agent-driven reverse engineering framework that allows AI agents to investigate app behavior and native binaries using tools like Hopper and Ghidra to explain and recreate software features.