ghidra-cli/crackme/the_void/AGENTS.md

name, description

name

description

ghidra-cli-skill

Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, and binary patching. Activate when the user requests: - Binary analysis or reverse engineering - Decompilation or disassembly - Function listing, inspection, or renaming - Cross-reference or call graph analysis - String or byte pattern searches - Binary patching or modification - Ghidra project management

ghidra-cli

Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, and binary patching.

When to Use

Activate when the user requests:

• Binary analysis or reverse engineering
• Decompilation or disassembly
• Function listing, inspection, or renaming
• Cross-reference or call graph analysis
• String or byte pattern searches
• Binary patching or modification
• Ghidra project management

Workflow

Pre-flight Check

Before running queries, verify the environment:

# Check if daemon is running for fast queries
ghidra daemon status --project <project>

# If not running, start it
ghidra daemon start --project <project> --program <program>

Quick Start (New Binary)

For one-off analysis, use quick mode:

ghidra quick ./binary
ghidra daemon start --project quick-analysis --program binary

Full Project Setup

For sustained analysis:

ghidra project create myproject
ghidra import ./binary --project myproject
ghidra analyze --project myproject --program binary
ghidra daemon start --project myproject --program binary

Command Reference

Querying Functions

# List all functions
ghidra function list --project <p> --program <prog>

# Filter functions by size or name
ghidra function list --filter "size > 500"
ghidra function list --filter "name contains 'crypt'"

# Get function details
ghidra function get main

# Decompile to pseudocode
ghidra function decompile main

# Disassemble
ghidra function disasm main

# Cross-references
ghidra function xrefs main
ghidra function calls main

Search Operations

# Find functions by pattern
ghidra find function "*crypt*"

# Find strings
ghidra find string "password"

# Find byte patterns (hex)
ghidra find bytes "4883ec08"

# Find crypto constants
ghidra find crypto

# Find suspicious patterns (anti-analysis, obfuscation)
ghidra find interesting

Cross-References

# References TO an address
ghidra x-ref to 0x401000

# References FROM an address
ghidra x-ref from 0x401000

Call Graphs

# Full call graph
ghidra graph calls

# Who calls this function (callers)
ghidra graph callers main --depth 3

# What does this function call (callees)
ghidra graph callees main --depth 3

# Export as DOT format
ghidra graph export dot

Symbols and Strings

# List symbols
ghidra symbol list

# List strings
ghidra strings list --limit 100

# References to a string
ghidra strings refs "error"

Memory and Types

# Memory map
ghidra memory map

# Read memory at address
ghidra memory read 0x401000 64

# List data types
ghidra type list

# Apply type to address
ghidra type apply 0x402000 "char[32]"

Modifications

# Rename function
ghidra function rename sub_401000 decrypt_password

# Add comment
ghidra comment set 0x401000 "Key derivation starts here"

# Patch bytes
ghidra patch bytes 0x401000 "90909090"

# NOP instructions
ghidra patch nop 0x401010 --count 5

# Export patched binary
ghidra patch export --output patched.bin

Scripting

# Run Python script
ghidra script run analysis.py

# Inline Python
ghidra script python "print(currentProgram.getName())"

# Batch commands from file
ghidra batch commands.txt

Output Handling

ghidra-cli outputs JSON by default. Parse the structured data:

# JSON output (default)
ghidra function list

# Table format for display
ghidra function list --format table

# Count only
ghidra function list --format count

When processing results, extract relevant fields from JSON rather than displaying raw output.

Common Patterns

Investigate a Function

ghidra function get <name>           # Overview
ghidra function decompile <name>     # Pseudocode
ghidra function calls <name>         # What it calls
ghidra function xrefs <name>         # Who calls it
ghidra graph callers <name> --depth 2

Find Interesting Code

ghidra find crypto                   # Crypto constants
ghidra find interesting              # Suspicious patterns
ghidra find function "*alloc*"       # Memory functions
ghidra strings list --filter "length > 50"

Trace Data Flow

ghidra x-ref to <address>            # Who writes here
ghidra x-ref from <address>          # What this references
ghidra graph callees <func> --depth 3

Error Recovery

Situation	Resolution
Daemon not running	ghidra daemon start --project <p> --program <prog>
No project exists	ghidra project create <name> or use ghidra quick <binary>
Function not found	Use ghidra find function "*pattern*" to search
Address format	Use hex with 0x prefix: 0x401000
Slow queries	Start daemon for sub-second response times

Global Options

All commands accept:

• --project <name> - Target project
• --program <name> - Target program within project
• --format json|table|count - Output format
• --filter <expr> - Filter expression
• --limit <N> - Max results