This commit implements a complete Rust CLI tool for Ghidra reverse engineering,
optimized for Claude Code and AI agents.
Core Features:
- Universal query command supporting all Ghidra data types (functions, strings, imports, exports, memory, etc.)
- Advanced filter language with comparison, string, and logical operators
- Multiple output formats (JSON, CSV, Table, minimal) optimized for LLM token efficiency
- Field selection and pagination for precise data extraction
- Windows-first design with cross-platform compatibility
Architecture:
- Filter parser using Pest grammar for robust expression parsing
- Modular design with separate filter, format, query, and Ghidra integration layers
- Headless Ghidra integration with built-in Python scripts for data extraction
- Configuration system with environment variable and file support
- Auto-detection of Ghidra installation on Windows
LLM Optimizations:
- Count-first workflow to check result sizes before fetching
- Aggressive server-side filtering to reduce data transfer
- Field selection to minimize token usage
- Compact output formats (json-compact, minimal, ids)
- Pagination support for large datasets
Documentation:
- Comprehensive README with examples and troubleshooting
- Claude skill document (CLAUDE_SKILL.md) for agent integration
- Subagent markdown (SUBAGENT.md) for Task tool integration
- Inline code documentation and examples
Commands Implemented:
- ghidra query <data-type> - Universal query interface
- ghidra import/analyze - Binary import and analysis
- ghidra fn/strings/mem - Specialized command shortcuts
- ghidra dump - Export data (imports, exports, functions, strings)
- ghidra decompile - Function decompilation
- ghidra project - Project management
- ghidra config - Configuration management
- ghidra init/doctor/version - Setup and diagnostics
Built-in Ghidra Scripts:
- Function listing with call graphs
- Decompilation
- String extraction
- Import/Export tables
- Memory map
- Cross-references
- Program information
The CLI is designed to be succinct and efficient, with commands like:
ghidra query functions --program=malware.exe --filter="size>1000 AND name~crypt" --format=json-compact
Windows Support:
- Auto-detection of Ghidra installation
- Path handling for both Unix and Windows styles
- Support for .exe, .dll, .sys formats
This implementation provides a powerful, token-efficient interface for binary
analysis that integrates seamlessly with Claude Code and other AI agents.
