symgraph/GhidrAssist

What it solves

Reverse engineering binaries is a labor-intensive process that requires manually tracing complex assembly and decompiled code. GhidrAssist reduces this effort by integrating Large Language Models (LLMs) directly into Ghidra, automating code explanation, vulnerability detection, and structural analysis of binaries.

How it works

It functions as a Ghidra plugin that connects to OpenAI-compatible APIs (local or cloud). It employs several advanced AI techniques:

• Graph-RAG: It builds a hierarchical semantic knowledge graph (Statement $\rightarrow$ Block $\rightarrow$ Function $\rightarrow$ Module $\rightarrow$ Binary) stored in SQLite, allowing for fast, LLM-free searches and structural exploration.
• ReAct Agentic Mode: An autonomous agent uses a "Think-Act-Observe" loop to propose investigation steps, execute tools, and synthesize findings.
• MCP Integration: It uses the Model Context Protocol to allow LLMs to call specific Ghidra tools for navigation and analysis.
• Security Extraction: It statically scans for network, file I/O, and crypto APIs to assign risk levels and activity profiles to functions.

Who it’s for

Security researchers, malware analysts, and reverse engineers who use Ghidra and want to accelerate their analysis using AI-driven automation and semantic search.

Highlights

• Interactive AI Assistance: Provides code explanations for disassembly and pseudo-C, along with a multi-turn chat interface.
• Autonomous Investigation: Agentic mode can independently navigate binaries, rename variables, and trace data flows.
• Semantic Knowledge Graph: Uses the Leiden algorithm for community detection to automatically group related functions into logical modules.
• Custom Context: Supports RAG via Lucene-based search to inject custom documentation or exploit notes into queries.
• Reasoning Control: Allows users to adjust the "effort level" (Low, Medium, High) for models that support extended thinking.