weirdmachine64/GhidraGPT

Integrate LLM models directly into Ghidra for AI-enhanced reverse engineering.

What it solves

Reverse engineering decompiled C code is often tedious and difficult to understand. GhidraGPT simplifies this process by integrating large language models (LLMs) directly into the Ghidra workflow, allowing users to quickly understand, document, and audit functions without leaving the tool.

How it works

As a Ghidra extension, the plugin allows users to right-click a specific function in the Decompiler or Listing views. It sends the decompiled C code of that single function to a chosen LLM provider. The model's response is then streamed back into a dedicated console within Ghidra. The tool operates on a per-function basis and does not perform whole-program or interprocedural analysis.

Who it’s for

It is designed for reverse engineers and security researchers who use Ghidra and want to leverage AI to speed up the analysis of binary code.

Highlights

  • Explain: Generates natural-language summaries of a function's purpose.
  • Rewrite: Automatically recovers descriptive names for functions and variables, infers types, and applies these changes directly to the Ghidra database.
  • Audit: Scans decompiled code for potential security vulnerabilities like integer overflows or unbounded copies.
  • Pluggable Providers: Supports a wide range of LLMs including OpenAI, Anthropic, Google Gemini, Mistral, DeepSeek, and local models via Ollama.
  • Streaming Interface: Responses are delivered token-by-token in a dedicated console panel.

Related

  • Project
    llnl/OGhidra

    OGhidra is a genuine open‑source project that adds large‑language‑model assistance to the Ghidra reverse‑engineering platform. It lets users ask natural‑language questions, runs AI‑driven analysis (function renaming, malware pattern detection, report generation), and supports both local Ollama models and cloud APIs while keeping binaries private.

  • Project
    cellebrite-labs/ghidra-rpc

    An agentic skill that gives LLMs access to Ghidra via a CLI and background daemon, enabling autonomous reverse engineering and binary analysis.

  • Project
    Dryxio/auto-re-agent

    An AI-powered reverse-engineering agent that uses Ghidra and LLMs to reconstruct and validate C/C++ functions from compiled binaries through an autonomous reverser-checker pipeline.

  • Project
    JusticeRage/Gepetto

    A Python plugin for IDA Pro that uses LLMs to explain decompiled functions and automatically rename variables to aid reverse engineering.

  • Project
    radareorg/r2ai

    A set of plugins for radare2 that integrates LLMs to assist in reverse engineering tasks such as function explanation, vulnerability discovery, and augmented decompilation.