llnl/OGhidra

OGhidra – AI‑Powered Reverse Engineering for Ghidra

What it is

• OGhidra is a bridge between large‑language‑model (LLM) providers and the open‑source reverse‑engineering suite Ghidra. It lets analysts ask natural‑language questions about a binary, have the AI drive Ghidra’s tools, and receive concise, privacy‑preserving answers.

How it works

• A planning‑execution‑review loop (the agentic loop) takes a user query, decides which Ghidra actions to run, calls the LLM for guidance, executes the chosen Ghidra commands, then reviews the results. The loop can repeat until the AI is satisfied, after which a final response is shown.
• The system can run with local models via Ollama or connect to cloud APIs (OpenAI, Gemini, Anthropic). All LLM calls happen on the user’s machine unless an external provider is selected, keeping proprietary binaries private.

Key capabilities

Feature	What you get
Natural‑language analysis	Ask “What does this function do?” or “List all network‑related calls” and receive AI‑generated explanations.
Automated workflows	One‑click actions such as renaming functions, bulk renaming, import/string analysis, and full security reports.
Malware pattern detection	Built‑in detectors for >12 common evasion, injection, persistence, and privilege‑escalation techniques (MITRE ATT&CK mapped).
Smart enumeration & knowledge graph	The AI builds a searchable vector store of function metadata, enabling semantic search and RAG (retrieval‑augmented generation).
Multi‑instance & parallel analysis	Run several Ghidra instances simultaneously for faster batch processing.
Configurable back‑ends	Use the original GhidraMCP HTTP server or the headless PyGhidra backend, whichever fits your workflow.
Session persistence	Save and reload analysis sessions, preserving AI context, embeddings, and UI state.

Installation at a glance

1. Prerequisites – Python 3.12+, Ghidra 12.0.3 (or compatible), Java 21, optional Ollama for local models.
2. Clone and install Python dependencies (via uv sync or pip install -r requirements.txt).
3. Build the GhidraMCP plugin (build_ghidra_plugin.sh / .bat) and install it through Ghidra’s Install Extensions dialog.
4. Pull an LLM model for Ollama (e.g., ollama pull gemma3:27b) or set API keys for a cloud provider in the generated .env file.
5. Launch OGhidra:

   uv run main.py --ui          # graphical UI (recommended)
   # or
   uv run main.py --interactive # CLI mode
   

Typical workflow

1. Open a binary in Ghidra and enable the OGhidraMCP plugin.
2. Start OGhidra (GUI or CLI) and select a task mode – e.g., malware for threat analysis.
3. Run Smart Enumeration (or bulk rename) to let the AI scan the binary and populate its knowledge base.
4. Pose questions in plain English, such as:
   • “Which functions look like they perform network communication?”
   • “Are there any anti‑debug tricks?”
5. Click Generate Report to obtain a structured security assessment (executive summary, function inventory, detected patterns, recommendations).

Configuration highlights

• Choose a provider (LLM_PROVIDER=ollama or external) and set model names in .env.
• Tune the context budget (CONTEXT_BUDGET) and agentic loop limits (MAX_EXECUTION_STEPS, MAX_AGENTIC_CYCLES) to match your model’s token window.
• Enable/disable RAG, logging, and context compression via simple boolean flags.

Who might use it

• Malware analysts who need rapid, AI‑assisted triage of unknown binaries.
• Vulnerability researchers looking to auto‑rename functions and surface risky code paths.
• Reverse‑engineering teams that must keep binaries on‑premise while still leveraging powerful LLMs.

Contributing The project welcomes additions such as new malware‑pattern signatures, extra LLM integrations, UI tweaks, and performance improvements. See the CODE_OF_CONDUCT.md for community guidelines.

License

• BSD‑3‑Clause (with an optional commercial license).