From d467f23ac6e2960bd5436f43c2fa0198f0da669e Mon Sep 17 00:00:00 2001 From: Alexander Kiselev Date: Sun, 25 Jan 2026 23:01:20 -0800 Subject: [PATCH] fix skill.md --- .claude/skills/ghidra-cli/SKILL.md | 720 ++++++++--------------------- CLAUDE_SKILL.md | 699 ---------------------------- 2 files changed, 181 insertions(+), 1238 deletions(-) delete mode 100644 CLAUDE_SKILL.md diff --git a/.claude/skills/ghidra-cli/SKILL.md b/.claude/skills/ghidra-cli/SKILL.md index e98f325..59c3490 100644 --- a/.claude/skills/ghidra-cli/SKILL.md +++ b/.claude/skills/ghidra-cli/SKILL.md @@ -1,617 +1,259 @@ ----- +--- name: ghidra-cli description: > - CLI for exploring binaries using Ghidra and a query language ----- - -## Overview - -Ghidra CLI is a Rust-based command-line tool that provides programmatic access to Ghidra's reverse engineering capabilities. It's designed with AI agents in mind, featuring: - -- **Daemon architecture** for fast, conflict-free operations -- **Universal query system** for consistent data extraction -- **Automatic caching** to minimize redundant operations -- **Token-efficient output formats** for LLM consumption - + Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, and binary patching. + Activate when the user requests: + - Binary analysis or reverse engineering + - Decompilation or disassembly + - Function listing, inspection, or renaming + - Cross-reference or call graph analysis + - String or byte pattern searches + - Binary patching or modification + - Ghidra project management --- -## Quick Reference +# ghidra-cli -### Essential Commands +Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, and binary patching. + +## When to Use + +Activate when the user requests: +- Binary analysis or reverse engineering +- Decompilation or disassembly +- Function listing, inspection, or renaming +- Cross-reference or call graph analysis +- String or byte pattern searches +- Binary patching or modification +- Ghidra project management + +## Workflow + +### Pre-flight Check + +Before running queries, verify the environment: ```bash -# Daemon management -ghidra daemon start --project # Start background daemon -ghidra daemon stop --project # Stop daemon -ghidra daemon status --project # Check status +# Check if daemon is running for fast queries +ghidra daemon status --project -# Project operations -ghidra project create # Create new project -ghidra import --project # Import binary -ghidra analyze --project # Run analysis - -# Query data -ghidra query --project [--filter] [--limit] - -# Decompilation -ghidra decompile --project +# If not running, start it +ghidra daemon start --project --program ``` -### Common Data Types +### Quick Start (New Binary) -`functions`, `strings`, `imports`, `exports`, `symbols`, `memory`, `xrefs`, `types`, `comments` - ---- - -## Workflow Patterns - -### Pattern 1: First-Time Binary Analysis +For one-off analysis, use quick mode: ```bash -# 1. Create project and start daemon -ghidra project create analysis_2024 -ghidra daemon start --project analysis_2024 --foreground - -# 2. Import and analyze binary -ghidra import malware.exe --project analysis_2024 -ghidra analyze --project analysis_2024 - -# 3. Get high-level summary -ghidra summary --project analysis_2024 - -# 4. Query specific data as needed -ghidra query functions --project analysis_2024 --filter "size>500" +ghidra quick ./binary +ghidra daemon start --project quick-analysis --program binary ``` -### Pattern 2: Investigating Suspicious Behavior +### Full Project Setup + +For sustained analysis: ```bash -# Find crypto-related functions -ghidra query functions --project analysis \ - --filter 'name contains "crypt" or name contains "encrypt"' \ - --fields name,address,size - -# Check suspicious imports -ghidra query imports --project analysis \ - --filter 'name contains "Process" or name contains "Registry"' - -# Find suspicious strings -ghidra query strings --project analysis \ - --filter 'value contains "http" or value contains "cmd.exe"' \ - --limit 50 +ghidra project create myproject +ghidra import ./binary --project myproject +ghidra analyze --project myproject --program binary +ghidra daemon start --project myproject --program binary ``` -### Pattern 3: Function Analysis Deep Dive +## Command Reference + +### Querying Functions ```bash -# List all functions (count first!) -ghidra query functions --project analysis --count +# List all functions +ghidra function list --project

--program -# Get top 20 largest functions -ghidra query functions --project analysis \ - --sort -size --limit 20 \ - --fields name,address,size +# Filter functions by size or name +ghidra function list --filter "size > 500" +ghidra function list --filter "name contains 'crypt'" -# Decompile specific function -ghidra decompile suspicious_func --project analysis +# Get function details +ghidra function get main -# Find what calls this function -ghidra function xrefs suspicious_func --project analysis +# Decompile to pseudocode +ghidra function decompile main -# Find what this function calls -ghidra function calls suspicious_func --project analysis +# Disassemble +ghidra function disasm main + +# Cross-references +ghidra function xrefs main +ghidra function calls main ``` ---- - -## Token Optimization Strategies - -### 1. Always Count First - -Before fetching data, check the result size: +### Search Operations ```bash -# BAD: Might return 10,000 functions -ghidra query functions --project analysis +# Find functions by pattern +ghidra find function "*crypt*" -# GOOD: Check size first -ghidra query functions --project analysis --count -# Output: 10,247 functions +# Find strings +ghidra find string "password" -# Then refine with filter -ghidra query functions --project analysis \ - --filter 'not name starts_with "FUN_"' \ - --count -# Output: 156 functions +# Find byte patterns (hex) +ghidra find bytes "4883ec08" + +# Find crypto constants +ghidra find crypto + +# Find suspicious patterns (anti-analysis, obfuscation) +ghidra find interesting ``` -### 2. Use Field Selection - -Only request fields you need: +### Cross-References ```bash -# BAD: Returns all fields (name, address, size, body, callers, callees, etc.) -ghidra query functions --project analysis +# References TO an address +ghidra x-ref to 0x401000 -# GOOD: Select minimal fields -ghidra query functions --project analysis \ - --fields name,address,size \ - --format json +# References FROM an address +ghidra x-ref from 0x401000 ``` -### 3. Apply Filters Server-Side - -Filter in Ghidra, not in your code: +### Call Graphs ```bash -# BAD: Fetch all 10K functions, filter in LLM -ghidra query functions --project analysis | grep crypto +# Full call graph +ghidra graph calls -# GOOD: Filter on server -ghidra query functions --project analysis \ - --filter 'name contains "crypto"' +# Who calls this function (callers) +ghidra graph callers main --depth 3 + +# What does this function call (callees) +ghidra graph callees main --depth 3 + +# Export as DOT format +ghidra graph export dot ``` -### 4. Use Compact Formats +### Symbols and Strings ```bash -# For analysis/display ---format json # Full JSON with all fields +# List symbols +ghidra symbol list -# For LLM processing (RECOMMENDED) ---format minimal # Just name/address, space-separated ---format ids # Just addresses, one per line +# List strings +ghidra strings list --limit 100 -# For counting ---count # Just return the count +# References to a string +ghidra strings refs "error" ``` -### 5. Paginate Large Results +### Memory and Types ```bash -# Get first 50 results -ghidra query functions --project analysis --limit 50 +# Memory map +ghidra memory map -# Get next 50 results -ghidra query functions --project analysis --limit 50 --offset 50 +# Read memory at address +ghidra memory read 0x401000 64 + +# List data types +ghidra type list + +# Apply type to address +ghidra type apply 0x402000 "char[32]" ``` ---- - -## Filter Expression Reference - -### Comparison Operators +### Modifications ```bash -field == value # Exact match -field != value # Not equal -field > value # Greater than -field >= value # Greater or equal -field < value # Less than -field <= value # Less or equal +# Rename function +ghidra function rename sub_401000 decrypt_password + +# Add comment +ghidra comment set 0x401000 "Key derivation starts here" + +# Patch bytes +ghidra patch bytes 0x401000 "90909090" + +# NOP instructions +ghidra patch nop 0x401010 --count 5 + +# Export patched binary +ghidra patch export --output patched.bin ``` -### String Operators +### Scripting ```bash -field contains "text" # Case-insensitive substring -field starts_with "text" # Prefix match -field ends_with "text" # Suffix match -field matches "regex" # Regular expression +# Run Python script +ghidra script run analysis.py + +# Inline Python +ghidra script python "print(currentProgram.getName())" + +# Batch commands from file +ghidra batch commands.txt ``` -### Logical Operators +## Output Handling + +ghidra-cli outputs JSON by default. Parse the structured data: ```bash -condition1 and condition2 # Both must be true -condition1 or condition2 # Either must be true -not condition # Negation +# JSON output (default) +ghidra function list + +# Table format for display +ghidra function list --format table + +# Count only +ghidra function list --format count ``` -### Special Operators +When processing results, extract relevant fields from JSON rather than displaying raw output. + +## Common Patterns + +### Investigate a Function ```bash -exists(field) # Field exists and is not null -field in [val1,val2,val3] # Field is one of values +ghidra function get # Overview +ghidra function decompile # Pseudocode +ghidra function calls # What it calls +ghidra function xrefs # Who calls it +ghidra graph callers --depth 2 ``` -### Example Filters +### Find Interesting Code ```bash -# Large named functions -'size > 1000 and not name starts_with "FUN_"' - -# Crypto-related -'name contains "crypt" or name contains "hash" or name contains "encrypt"' - -# Network-related strings -'value contains "http" or value contains "socket" or value contains "connect"' - -# Public exported functions -'public == true and exists(export)' - -# Complex condition -'(size > 500 or callees > 10) and not thunk and exists(callers)' +ghidra find crypto # Crypto constants +ghidra find interesting # Suspicious patterns +ghidra find function "*alloc*" # Memory functions +ghidra strings list --filter "length > 50" ``` ---- - -## Output Format Guide - -### JSON (Default for Pipes) +### Trace Data Flow ```bash -ghidra query functions --project analysis --format json +ghidra x-ref to

# Who writes here +ghidra x-ref from
# What this references +ghidra graph callees --depth 3 ``` -```json -[ - { - "name": "main", - "address": "0x401000", - "size": 1024, - "body": "...", - "callers": ["0x402000"], - "callees": ["0x403000"] - } -] -``` - -### Minimal (Best for LLMs) - -```bash -ghidra query functions --project analysis --format minimal -``` - -``` -main 0x401000 -sub_401100 0x401100 -FUN_401200 0x401200 -``` - -### IDs Only - -```bash -ghidra query functions --project analysis --format ids -``` - -``` -0x401000 -0x401100 -0x401200 -``` - -### Table (For Display) - -```bash -ghidra query functions --project analysis --format table -``` - -``` -┌────────────┬──────────┬──────┐ -│ Name │ Address │ Size │ -├────────────┼──────────┼──────┤ -│ main │ 0x401000 │ 1024 │ -│ sub_401100 │ 0x401100 │ 256 │ -└────────────┴──────────┴──────┘ -``` - ---- - -## Common Tasks - -### Task: Find Entry Point - -```bash -# Method 1: Query for "entry" or "main" -ghidra query functions --project analysis \ - --filter 'name == "entry" or name == "main" or name == "_start"' - -# Method 2: Get program info -ghidra summary --project analysis | grep -i "entry" -``` - -### Task: Find Suspicious API Calls - -```bash -# Check imports -ghidra query imports --project analysis \ - --filter 'name contains "CreateProcess" or - name contains "WinExec" or - name contains "ShellExecute" or - name contains "URLDownload"' -``` - -### Task: Extract All Strings - -```bash -# Get count first -ghidra query strings --project analysis --count - -# If reasonable size, fetch all -ghidra query strings --project analysis \ - --fields value,address \ - --format minimal > strings.txt - -# If too large, filter -ghidra query strings --project analysis \ - --filter 'length > 10' \ - --limit 1000 -``` - -### Task: Analyze Function Behavior - -```bash -# 1. Get function info -ghidra function get suspicious_func --project analysis - -# 2. Decompile -ghidra decompile suspicious_func --project analysis - -# 3. See what it calls -ghidra function calls suspicious_func --project analysis - -# 4. See where it's called from -ghidra function xrefs suspicious_func --project analysis - -# 5. Check strings it references -ghidra query strings --project analysis \ - --filter 'xrefs contains "suspicious_func"' -``` - -### Task: Find Encrypted/Obfuscated Code - -```bash -# High entropy strings (likely encrypted) -ghidra query strings --project analysis \ - --filter 'length > 50' \ - --format minimal - -# Large functions (potential obfuscation) -ghidra query functions --project analysis \ - --filter 'size > 5000' \ - --sort -size - -# Functions with unusual call patterns -ghidra query functions --project analysis \ - --filter 'callees > 50 or callers > 20' -``` - ---- - -## Daemon Best Practices - -### When to Use Daemon - -**Always use daemon for:** -- Multiple queries on the same project -- Interactive analysis sessions -- Repeated decompilation requests -- Any workflow with >3 commands - -**Skip daemon for:** -- One-off quick analysis -- Different projects each time -- Simple import/analyze operations - -### Daemon Lifecycle - -```bash -# At session start -ghidra daemon start --project analysis - -# During session: all commands auto-route to daemon -ghidra query functions --project analysis -# ↑ Automatically uses daemon if running - -# At session end -ghidra daemon stop --project analysis -``` - -### Troubleshooting Daemon - -```bash -# Check if daemon is running -ghidra daemon status --project analysis - -# Test daemon responsiveness -ghidra daemon ping --project analysis - -# Restart if stuck -ghidra daemon restart --project analysis - -# Force stop (if needed) -pkill -f "ghidra daemon" -rm ~/.local/share/ghidra-cli/daemon-*.lock -``` - ---- - -## Error Handling - -### Common Errors - -**"Project not found"** -```bash -# List projects -ghidra project list - -# Create if needed -ghidra project create analysis -``` - -**"Daemon not running"** -```bash -# Start daemon -ghidra daemon start --project analysis --foreground - -# Check logs -tail -f ~/.local/share/ghidra-cli/daemon.log -``` - -**"Analysis incomplete"** -```bash -# Run analysis -ghidra analyze --project analysis - -# Check if binary is imported -ghidra project info analysis -``` - -**"Timeout"** -```bash -# Increase timeout in config -echo "timeout: 600" >> ~/.config/ghidra-cli/config.yaml - -# Or use environment variable -export GHIDRA_TIMEOUT=600 -``` - ---- - -## Performance Tips - -1. **Start with counts** - Always check result size before fetching -2. **Use daemon** - 100x faster for repeated operations -3. **Cache awareness** - Identical queries return instantly (5-min TTL) -4. **Filter aggressively** - Reduce data transfer -5. **Select minimal fields** - Less data = faster & fewer tokens -6. **Batch similar queries** - Group related operations together - ---- - -## Integration Examples - -### Example: Malware Analysis Report - -```bash -#!/bin/bash -PROJECT="malware_analysis" -BINARY="suspicious.exe" - -# Setup -ghidra project create $PROJECT -ghidra daemon start --project $PROJECT -ghidra import $BINARY --project $PROJECT -ghidra analyze --project $PROJECT - -# Gather intelligence -echo "=== SUMMARY ===" -ghidra summary --project $PROJECT - -echo -e "\n=== SUSPICIOUS IMPORTS ===" -ghidra query imports --project $PROJECT \ - --filter 'name contains "Process" or name contains "Registry"' - -echo -e "\n=== CRYPTO FUNCTIONS ===" -ghidra query functions --project $PROJECT \ - --filter 'name contains "crypt" or name contains "encrypt"' \ - --fields name,address - -echo -e "\n=== NETWORK STRINGS ===" -ghidra query strings --project $PROJECT \ - --filter 'value contains "http" or value contains "://"' \ - --limit 20 - -# Cleanup -ghidra daemon stop --project $PROJECT -``` - -### Example: Function Coverage Analysis - -```bash -# Count total functions -TOTAL=$(ghidra query functions --project analysis --count) - -# Count named functions -NAMED=$(ghidra query functions --project analysis \ - --filter 'not name starts_with "FUN_"' --count) - -# Calculate percentage -echo "Coverage: $NAMED / $TOTAL functions named" -echo "Percentage: $(( NAMED * 100 / TOTAL ))%" -``` - ---- - -## Appendix: Complete Command Reference - -### Daemon Commands - -```bash -ghidra daemon start [--project] [--port] [--foreground] -ghidra daemon stop [--project] -ghidra daemon restart [--project] [--port] -ghidra daemon status [--project] -ghidra daemon ping [--project] -ghidra daemon clear-cache [--project] -``` - -### Project Commands - -```bash -ghidra project create -ghidra project list -ghidra project delete -ghidra project info -``` - -### Analysis Commands - -```bash -ghidra import [--project] -ghidra analyze [--project] -ghidra summary [--project] -ghidra quick # import + analyze + summary -``` - -### Query Commands - -```bash -ghidra query [options] - --project - --filter - --fields - --format - --limit - --offset - --sort - --count -``` - -### Function Commands - -```bash -ghidra function list [options] -ghidra function get [options] -ghidra function decompile [options] -ghidra function calls [options] -ghidra function xrefs [options] -``` - -### Utility Commands - -```bash -ghidra doctor # Verify installation -ghidra init # Initialize configuration -ghidra config get -ghidra config set -ghidra version -``` - ---- - -## Tips for LLM Agents - -1. **Always check daemon status** before starting analysis -2. **Use `--count` liberally** to avoid overwhelming responses -3. **Start broad, then narrow** with filters -4. **Leverage caching** by grouping similar queries -5. **Use `--format minimal`** for token efficiency -6. **Handle errors gracefully** - daemon issues are common -7. **Clean up after sessions** - stop daemons when done -8. **Document your queries** - future you will thank you - ---- - -**Happy reverse engineering! 🔍** +## Error Recovery + +| Situation | Resolution | +| ------------------ | ------------------------------------------------------------- | +| Daemon not running | `ghidra daemon start --project

--program ` | +| No project exists | `ghidra project create ` or use `ghidra quick ` | +| Function not found | Use `ghidra find function "*pattern*"` to search | +| Address format | Use hex with 0x prefix: `0x401000` | +| Slow queries | Start daemon for sub-second response times | + +## Global Options + +All commands accept: +- `--project ` - Target project +- `--program ` - Target program within project +- `--format json|table|count` - Output format +- `--filter ` - Filter expression +- `--limit ` - Max results diff --git a/CLAUDE_SKILL.md b/CLAUDE_SKILL.md deleted file mode 100644 index 0d84299..0000000 --- a/CLAUDE_SKILL.md +++ /dev/null @@ -1,699 +0,0 @@ -# Ghidra CLI - Claude Code Skill - -This skill enables Claude Code and other AI agents to efficiently reverse engineer binaries using Ghidra through a powerful CLI interface. - -## Quick Reference - -### Most Common Commands - -```bash -# Count-first workflow (ALWAYS use this pattern) -ghidra query functions --program= --count -ghidra query functions --program= --filter="" --count -ghidra query functions --program= --filter="" --fields=name,address --format=json-compact - -# Query data types -ghidra query functions|strings|imports|exports|memory --program= [options] - -# Decompile -ghidra decompile --program= - -# Dump data -ghidra dump imports|exports|functions|strings --program= [options] -``` - -## Setup & Initialization - -```bash -# First time setup -ghidra init - -# Check installation -ghidra doctor - -# Import a binary -ghidra import --project= - -# Quick analysis (import + analyze + summary) -ghidra quick -``` - -## Universal Query Command - -The `query` command is your primary tool. It supports filtering, field selection, and multiple output formats. - -### Syntax - -```bash -ghidra query --program= [options] -``` - -### Data Types - -- `functions` - All functions -- `strings` - String literals -- `imports` - Imported functions -- `exports` - Exported functions -- `memory` - Memory regions -- `symbols` - Symbol table -- `xrefs` - Cross-references - -### Options - -```bash ---filter="" # Filter results ---fields= # Select specific fields (comma-separated) ---format= # Output format (json, json-compact, table, minimal, count) ---limit= # Max results ---offset= # Skip first n results ---sort= # Sort by field (prefix with - for descending) ---count # Just return count -``` - -## Filter Language - -### Comparison Operators - -```bash -field=value # Exact match -field!=value # Not equal -field>value # Greater than -field>=value # Greater or equal -field - -# Count functions -ghidra query functions --program= --count - -# Count named functions -ghidra query functions --program= --filter="NOT name^FUN_" --count - -# List named functions (minimal output) -ghidra query functions --program= \ - --filter="NOT name^FUN_" \ - --fields=name,address,size \ - --format=json-compact \ - --limit=50 -``` - -### 2. Finding Interesting Functions - -```bash -# Large functions -ghidra query functions --program= \ - --filter="size>1000" \ - --fields=name,address,size \ - --sort=-size \ - --limit=20 - -# Functions with specific keywords -ghidra query functions --program= \ - --filter="name~crypt OR name~encrypt OR name~password" \ - --fields=name,address \ - --format=json-compact - -# Functions that call specific APIs -ghidra query functions --program= \ - --filter="calls~WinExec OR calls~CreateProcess" \ - --format=json-compact -``` - -### 3. String Analysis - -```bash -# Count strings -ghidra query strings --program= --count - -# Find URLs -ghidra query strings --program= \ - --filter="value~http" \ - --fields=value,address \ - --format=minimal - -# Find long strings (potential paths/URLs) -ghidra query strings --program= \ - --filter="length>50" \ - --format=json-compact \ - --limit=20 - -# Find specific keywords -ghidra query strings --program= \ - --filter="value~password OR value~key OR value~token" \ - --format=json-compact -``` - -### 4. Import Analysis - -```bash -# List all imports -ghidra dump imports --program= --format=json-compact - -# Find suspicious imports -ghidra query imports --program= \ - --filter="name IN [CreateProcess,WinExec,ShellExecute,WriteFile,CreateRemoteThread]" \ - --format=json-compact - -# Find crypto imports -ghidra query imports --program= \ - --filter="name~Crypt" \ - --format=json-compact -``` - -### 5. Decompilation - -```bash -# Decompile by address -ghidra decompile 0x401000 --program= - -# Decompile by name -ghidra decompile main --program= - -# Decompile with minimal output -ghidra fn decompile 0x401000 --program= --format=compact -``` - -### 6. Cross-Reference Analysis - -```bash -# Find what calls a function -ghidra query xrefs --program= \ - --filter="to~WinExec" \ - --fields=from,from_function \ - --format=json-compact - -# Find all callers to an address -ghidra xref to 0x401000 --program= --format=json-compact -``` - -## Output Formats - -Choose the right format for your use case: - -- `count` - Just the number (best for checking result size) -- `json-compact` - Minimal JSON (best for LLMs) -- `minimal` - Just addresses/names (good for piping) -- `ids` - Just IDs (good for further queries) -- `table` - Human-readable table (good for display) -- `json` - Full JSON (when you need all data) - -## Best Practices for LLMs - -### 1. Always Count First - -```bash -# BAD: Fetching all data without knowing size -ghidra query functions --program= - -# GOOD: Count first, then filter -ghidra query functions --program= --count -ghidra query functions --program= --filter="size>1000" --count -ghidra query functions --program= --filter="size>1000" --format=json-compact -``` - -### 2. Use Aggressive Filtering - -```bash -# BAD: Fetching then filtering in code -ghidra query functions --program= --format=json - -# GOOD: Filter on Ghidra side -ghidra query functions --program= \ - --filter="size>1000 AND name~crypt" \ - --format=json-compact -``` - -### 3. Select Only Needed Fields - -```bash -# BAD: Getting all fields -ghidra query functions --program= - -# GOOD: Select only what you need -ghidra query functions --program= \ - --fields=name,address,size \ - --format=json-compact -``` - -### 4. Paginate Large Results - -```bash -# Get first page -ghidra query functions --program= --limit=50 - -# Get next page -ghidra query functions --program= --limit=50 --offset=50 -``` - -### 5. Use Appropriate Output Format - -```bash -# For analysis: json-compact -ghidra query functions --program= --format=json-compact - -# For display: table -ghidra query functions --program= --format=table - -# For piping: minimal or ids -ghidra query functions --program= --format=ids -``` - -## Common Analysis Patterns - -### Pattern 1: Find Entry Points - -```bash -# Find main or WinMain -ghidra query functions --program= \ - --filter="name~main OR name~WinMain OR name~DllMain" \ - --format=json-compact -``` - -### Pattern 2: Find Crypto Functions - -```bash -# By name -ghidra query functions --program= \ - --filter="name~crypt OR name~cipher OR name~hash OR name~aes OR name~rsa" \ - --format=json-compact - -# By imports -ghidra query imports --program= \ - --filter="name~Crypt" \ - --format=json-compact -``` - -### Pattern 3: Find Network Functions - -```bash -# By imports -ghidra query imports --program= \ - --filter="name~socket OR name~connect OR name~send OR name~recv OR name~http" \ - --format=json-compact -``` - -### Pattern 4: Find File Operations - -```bash -ghidra query imports --program= \ - --filter="name~File OR name~Read OR name~Write OR name~Create" \ - --format=json-compact -``` - -### Pattern 5: Find Suspicious Strings - -```bash -# Registry keys -ghidra query strings --program= \ - --filter="value~HKEY OR value~Software" \ - --format=json-compact - -# URLs -ghidra query strings --program= \ - --filter="value~http" \ - --format=json-compact - -# Credentials -ghidra query strings --program= \ - --filter="value~password OR value~username OR value~token" \ - --format=json-compact -``` - -## Error Handling - -### Common Errors - -1. **Program not specified**: Use `--program=` or set default with `ghidra set-default program ` -2. **Ghidra not found**: Run `ghidra init` or set `GHIDRA_INSTALL_DIR` -3. **Analysis timeout**: Increase with `set GHIDRA_TIMEOUT=600` -4. **Project not found**: Create with `ghidra project create ` - -### Troubleshooting - -```bash -# Check installation -ghidra doctor - -# List available projects -ghidra project list - -# Show current configuration -ghidra config list -``` - -## Configuration - -### Set Defaults - -```bash -# Set default program (so you don't have to pass --program each time) -ghidra set-default program - -# Set default project -ghidra set-default project -``` - -### Environment Variables - -```bash -# Windows -set GHIDRA_INSTALL_DIR=C:\ghidra\ghidra_11.0 -set GHIDRA_DEFAULT_PROGRAM=malware.exe - -# Unix -export GHIDRA_INSTALL_DIR=/opt/ghidra -export GHIDRA_DEFAULT_PROGRAM=malware.elf -``` - -## Example Workflow - -Here's a complete analysis workflow: - -```bash -# 1. Import and analyze -ghidra import suspicious.exe --project=analysis - -# 2. Get overview -ghidra summary --program=suspicious.exe - -# 3. Count functions -ghidra query functions --program=suspicious.exe --count -# Output: 1247 - -# 4. Count named functions -ghidra query functions --program=suspicious.exe --filter="NOT name^FUN_" --count -# Output: 89 - -# 5. Get named functions -ghidra query functions --program=suspicious.exe \ - --filter="NOT name^FUN_" \ - --fields=name,address,size \ - --format=json-compact - -# 6. Find suspicious imports -ghidra dump imports --program=suspicious.exe \ - --filter="name~Exec OR name~Create OR name~Write" \ - --format=json-compact - -# 7. Find interesting strings -ghidra query strings --program=suspicious.exe \ - --filter="value~http OR value~password" \ - --format=json-compact - -# 8. Decompile interesting functions -ghidra decompile 0x401000 --program=suspicious.exe -``` - -## Tips - -1. **Always count before fetching** - Prevents overwhelming your context -2. **Use filters aggressively** - Pre-filter on Ghidra side -3. **Select minimal fields** - Reduces token usage -4. **Use json-compact format** - Most efficient for LLMs -5. **Set defaults** - Avoids repeating `--program` and `--project` -6. **Paginate large results** - Use `--limit` and `--offset` -7. **Cache results** - Store commonly-used queries in variables - -## Advanced: Chaining Commands - -```bash -# Get list of function addresses, then decompile each -FUNCS=$(ghidra query functions --program= \ - --filter="name~suspicious" \ - --format=ids) - -for addr in $FUNCS; do - ghidra decompile $addr --program= --format=compact -done -``` - -## Daemon Mode - -The daemon keeps Ghidra loaded in memory for fast, interactive analysis. This is recommended for most workflows. - -### Starting the Daemon - -```bash -# Start daemon for a specific program -ghidra daemon start --program= - -# Check daemon status -ghidra daemon status - -# Stop daemon -ghidra daemon stop - -# Clear daemon cache -ghidra daemon clear-cache -``` - -### Daemon-Mode Commands - -When the daemon is running, these commands execute instantly without reloading Ghidra: - -## Symbol Operations - -```bash -# List all symbols -ghidra symbol list - -# List symbols with filter -ghidra symbol list --filter="main" - -# Get symbol details -ghidra symbol get - -# Create a symbol at address -ghidra symbol create

- -# Delete a symbol -ghidra symbol delete - -# Rename a symbol -ghidra symbol rename -``` - -## Type Operations - -```bash -# List all data types -ghidra type list - -# Get type definition -ghidra type get - -# Create a new struct type -ghidra type create - -# Apply a type to an address -ghidra type apply
-``` - -## Comment Operations - -```bash -# List all comments -ghidra comment list - -# Get comments at address -ghidra comment get
- -# Set a comment at address -ghidra comment set
"" - -# Set a specific comment type (pre, post, eol, plate) -ghidra comment set
"" --type=pre - -# Delete comment at address -ghidra comment delete
-``` - -## Graph Operations - -```bash -# Get call graph (with optional limit) -ghidra graph calls --limit=100 - -# Get callers of a function (with depth) -ghidra graph callers --depth=2 - -# Get callees of a function -ghidra graph callees --depth=2 - -# Export call graph (dot, json, gml) -ghidra graph export --format=dot -``` - -## Find/Search Operations - -```bash -# Find strings matching pattern -ghidra find string "" - -# Find byte patterns (hex) -ghidra find bytes "90 90 90" - -# Find functions by pattern -ghidra find function "" - -# Find calls to a function -ghidra find calls - -# Find crypto constants (AES, DES, etc.) -ghidra find crypto - -# Find interesting functions (suspicious names) -ghidra find interesting -``` - -## Diff Operations - -```bash -# Compare two programs -ghidra diff programs -``` - -## Patch Operations - -```bash -# Patch bytes at address -ghidra patch bytes
- -# NOP instruction at address -ghidra patch nop
- -# Export patched binary -ghidra patch export -``` - -## Script Execution - -```bash -# Run a Python script file -ghidra script run [args...] - -# Execute inline Python code -ghidra script python "" - -# Execute inline Java code -ghidra script java "" - -# List available scripts -ghidra script list -``` - -## Disassembly - -```bash -# Disassemble at address -ghidra disasm
- -# Disassemble with instruction count -ghidra disasm
-n 20 -``` - -## Batch Operations - -```bash -# Run batch commands from file -ghidra batch -``` - -Batch file format (one command per line): -``` -query functions --count -decompile main -symbol list -``` - -## Statistics - -```bash -# Get program statistics -ghidra stats -``` - -Returns: function count, instruction count, data count, memory usage, etc. - -## Daemon-Mode Workflows - -### Pattern 1: Interactive Analysis - -```bash -# Start daemon -ghidra daemon start --program=suspicious.exe - -# Run queries (fast, no reload) -ghidra stats -ghidra symbol list -ghidra find crypto -ghidra decompile main - -# Stop when done -ghidra daemon stop -``` - -### Pattern 2: Symbol/Type Annotation - -```bash -# Start daemon -ghidra daemon start --program=target.exe - -# Add symbols -ghidra symbol create 0x401000 "decrypt_function" -ghidra symbol create 0x402000 "key_buffer" - -# Add comments -ghidra comment set 0x401000 "Main decryption routine" - -# Apply types -ghidra type apply 0x402000 "byte[32]" -``` - -### Pattern 3: Call Graph Analysis - -```bash -# Get full call graph -ghidra graph calls --limit=1000 - -# Trace callers to interesting function -ghidra graph callers "WinExec" --depth=5 - -# Trace callees from main -ghidra graph callees "main" --depth=3 -``` - -This skill gives you powerful, token-efficient access to Ghidra for binary analysis!