Structured extraction
- Useful functions, symbols, strings and references
- Decompiled pseudo-code and function relationships
- Compact, portable and inspectable JSON
- Segmentation suited to context limits
- Outputs reusable across multiple backends
← All projects
Defensive reverse engineering · LLM · Open source
Ghidra LLM Reverse Pipeline
A pipeline that turns Ghidra's rich output into compact context for local or hosted models, then produces analysis connected to its supporting evidence.
binary → Ghidra project
functions → decompile + references
compact.json → token-aware context
LLM → local / hosted backend
report → cited evidence
InputGhidra project / binary
IntermediateCompact JSON
ModelsLocal or API
LicenseApache-2.0
Problem
Give the model the right context.
A binary contains far more information than a model can analyze at once. The pipeline must compact it without erasing provenance.
Defensive analysis
- Summary of observable behavior
- Prioritization for manual review
- Hypotheses separated from factual evidence
- References preserved in the report
- Private environments supported with local models
Pipeline
01Extract
Functions, graphs, strings and references.
02Compact
Normalize without losing provenance.
03Analyze
Query the selected LLM backend.
04Verify
Return to evidence in Ghidra.
Design choices
AI assists; the analyst concludes.
The report accelerates navigation through a binary. It does not turn a model hypothesis into a fact.
Local or hosted
The backend is configurable so users can balance local confidentiality, model capability and environment constraints.
Evidence-first
References to source functions and artifacts let the analyst verify each important conclusion in the analysis tool.
Public code