llnl/oghidraOGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. Interact with Ghidra using conversational queries and automate complex reverse engineering workflows.
For the version using a Claude-inspired Orchestrator, see https://github.com/llnl/OGhidra/tree/orchestrator
OGhidra bridges Large Language Models with Ghidra's reverse engineering platform, enabling AI-driven binary analysis through natural language. Analyze binaries conversationally, automate complex workflows, and maintain complete privacy with local AI models.
YouTube Setup Tutorial
OGhidra enhances Ghidra with AI capabilities, allowing you to:
graph TD
A[User Query] --> B[Planning Phase]
B --> C{Execution Phase}
C -- Tool Calls --> D[Ghidra/LLM]
D --> C
C --> E[Review Phase]
E -- Agentic Loop --> B
E --> F[Final Response]
style E fill:#f9f,stroke:#333,stroke-width:2px
style B fill:#bbf,stroke:#333,stroke-width:2pxAgentic Loop: OGhidra uses an adaptive planning system. After each execution cycle, results are reviewed and the AI can choose to gather more information or refine its analysis before providing the final response.
python --versionjava -version# Clone repository
git clone https://github.com/LLNL/OGhidra.git
cd OGhidra
# Install dependencies (choose one)
uv sync # Using UV (recommended)
pip install -r requirements.txt # Using pip
# Configure environment
cp .env.example .env
# Edit .env with your settings
The OGhidraMCP plugin build steps below target Ghidra 12.0.3 (recommended). There's also a YouTube video tutorial: https://www.youtube.com/watch?v=hBD92FUgR0Y
As a developer, you'll need to build the GhidraMCP extension before installing it in Ghidra:
Prerequisites:
Option 1: Using the automated build scripts:
Windows:
# Set the path to your Ghidra installation (will attempt to find last run copy of Ghidra if not set)
set GHIDRA_INSTALL_DIR=C:\path\to\ghidra_12.0.3_PUBLIC
# Run the build script
build_ghidra_plugin.bat
Unix/Linux/Mac:
# Set the path to your Ghidra installation (will attempt to find the last run copy of Ghidra if not set)
export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.0.3_PUBLIC
# Run the build script (make it executable first if needed)
chmod +x build_ghidra_plugin.sh
./build_ghidra_plugin.sh
Option 2: Manual build process:
Create/update OGhidraMCP/gradle.properties with your Ghidra install path:
GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.0.3_PUBLIC
On Unix/Linux/macOS:
cd OGhidraMCP
$GHIDRA_INSTALL_DIR/support/gradle/gradlew buildExtension --info
On Windows:
cd OGhidraMCP
"%GHIDRA_INSTALL_DIR%\support\gradle\gradlew.bat" buildExtension --info
Locate the built extension:
OGhidraMCP/dist/ghidra_12.0.3_PUBLIC_YYYYMMDD_OGhidraMCP.zipOnce you've successfully built the extension:
Install in Ghidra:
OGhidraMCP/dist/ directoryghidra_12.0.3_PUBLIC_YYYYMMDD_OGhidraMCP.zip)Enable the plugin:
OGhidraMCP pluginhttp://localhost:8080/methodsYOU NEED TO HAVE CODE BROWSER OPEN
# For Ollama (local models)
ollama pull gemma3:27b # Good balance (20GB RAM)
ollama pull nomic-embed-text # Embedding model for RAG
# Alternative models
ollama pull gpt-oss:120b # High quality (80GB RAM)
ollama pull devstral-2:123b # High quality (80GB RAM)
ollama pull devstral-2:123b-cloud # Cloud Model
# GUI Mode (recommended)
uv run main.py --ui
# Interactive CLI
uv run main.py --interactive
# In interactive CLI, test connection
health
If you launched GUI mode, use:
curl http://localhost:8080/methods
Edit .env to configure your AI provider:
LLM_PROVIDER=ollama
OLLAMA_BASE_URL=http://localhost:11434/
OLLAMA_MODEL=gemma3:27b
OLLAMA_EMBEDDING_MODEL=nomic-embed-text
LLM_PROVIDER=external
EXTERNAL_PROVIDER=google
EXTERNAL_API_KEY=your-api-key-here
EXTERNAL_MODEL=gemini-3.1-flash-lite-preview
EXTERNAL_EMBEDDING_MODEL=gemini-embedding-001
LLM_PROVIDER=custom_api
CUSTOM_API_URL=https://api.example.com/v1/chat/completions
CUSTOM_API_KEY=your-api-key-here
CUSTOM_API_MODEL=your-model-name
CUSTOM_API_EMBEDDING_MODEL=your-embedding-model
Adjust based on your model's context window:
# Context budget in tokens (adjust to your model's limit)
CONTEXT_BUDGET=100000 # 100K tokens for mid-size models
# 200K+ for frontier models
# Execution settings
MAX_EXECUTION_STEPS=5 # Steps per planning cycle
MAX_AGENTIC_CYCLES=3 # How many plan-execute-review loops
AGENTIC_LOOP_ENABLED=true # Enable adaptive replanning
One-click access to common reverse engineering tasks:
| Tool | Description |
|---|---|
| Analyze Current Function | Deep dive into selected function's behavior |
| Rename Current Function | AI suggests meaningful names based on analysis |
| Rename All Functions | Bulk rename with Smart/Full/Rename-Only options |
| Analyze Imports | Identify libraries and external dependencies |
| Analyze Strings | Find URLs, credentials, configuration data |
| Generate Report | Comprehensive security assessment |
Set specialized analysis goals:
# In GUI: Use "Task Mode" dropdown
# In CLI: set task_mode <mode>
task_mode malware # Malware analysis with pattern detection
task_mode vuln # Vulnerability research focus
task_mode general # General reverse engineering
Automatic detection of 12+ malware patterns:
Patterns trigger automatic alerts in the AI's context with MITRE ATT&CK mappings.
Build rich, queryable knowledge from binary analysis:
# Enumerate all functions with AI summaries
# Choose from:
- Rename Only: Only process generic function names
- Smart Enumeration: Focus on security-relevant functions
- Full Enumeration: Analyze every function in the binary
Features:
Save and restore analysis sessions:
# Save progress
File → Save Session
# Load previous work
File → Load Session
# Auto-save after bulk operations
# Sessions include:
- Analyzed functions with summaries
- RAG vectors for semantic search
- Performance statistics
- UI state
OGhidra supports two backend types:
Use the following command-line option to choose a backend:
--ghidra-backend={http,pyghidra}
| Backend Option | Description |
|---|---|
http | Uses the GhidraMCP backend |
pyghidra | Uses the PyGhidra backend |
Specify a Ghidra project file (.gpr) when launching OGhidra:
--pyghidra-project=/path/to/project.gpr
PyGhidra requires a valid Ghidra project in order to launch OGhidra.
Specify which binary inside the Ghidra project should be analyzed:
--pyghidra-program=<program_name>
example call for selecting a program in a Ghidra project:
uv run main.py --ui --ghidra-backend=pyghidra --pyghidra-project=/path/to/project.gpr --pyghidra-program=<program_name>
Requirements:
You can also provide a binary path directly:
--pyghidra-binary=/path/to/binary
When this option is used, PyGhidra automatically:
.gpr)example call for launching a binary directly:
uv run main.py --ui --ghidra-backend=pyghidra --pyghidra-binary=/path/to/binary
uv run main.py --ui# In GUI: Click "Generate Report" button
# Report includes:
- Executive Summary
- Function Inventory (renamed functions with behavior)
- Security Analysis (high-risk functions, patterns)
- Import Analysis
- String Analysis
- Recommendations
OGhidra uses vector embeddings for semantic search over analyzed functions:
# Enable in .env
RESULT_CACHE_ENABLED=true
TIERED_CONTEXT_ENABLED=true
Benefits:
Tiered context compression keeps relevant information:
CURRENT_LOOP_MAX_CHARS=2000 # Recent: full detail
PREV_LOOP_MAX_CHARS=400 # Previous: summaries
OLDER_LOOP_MAX_CHARS=100 # Older: references only
Track all AI interactions for debugging:
LLM_LOGGING_ENABLED=true
LLM_LOG_FILE=logs/llm_interactions.log
LLM_LOG_FORMAT=json
# Verify plugin is loaded
# Open up codebrowser!
# Check server is running
curl http://localhost:8080/methods
# Verify Ollama is running
ollama list
# Check connectivity
curl http://localhost:11434/api/tags
# Restart Ollama service
ollama serve
# Reduce context budget
CONTEXT_BUDGET=50000
# Enable compaction
COMPACTION_ENABLED=true
COMPACTION_THRESHOLD=0.75
gemma3:9bmax_workers=2 in bulk operationsRESULT_CACHE_ENABLED=falseCUSTOM_API_REQUEST_DELAY=2.0┌─────────────────────────────────────────────────────────────┐
│ OGhidra UI │
│ (GUI / Interactive CLI) │
└────────────────────────┬────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Bridge (src/bridge.py) │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ • Agentic Loop: Plan → Execute → Review → Replan │ │
│ │ • Tool Router: Ghidra client, LLM client, CAG manager │ │
│ │ • Context Manager: Budget allocation, compression │ │
│ └────────────────────────────────────────────────────────┘ │
└───────────┬────────────────────────┬────────────────────────┘
│ │
▼ ▼
┌───────────────────────┐ ┌─────────────────────────┐
│ Ghidra Client │ │ LLM Clients │
│ • GhidraMCP Plugin │ │ • Ollama (local) │
│ • Binary operations │ │ • External APIs │
│ • Decompilation │ │ • Custom endpoints │
└───────────────────────┘ └─────────────────────────┘
│ │
└────────────┬───────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ CAG Manager (Knowledge System) │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ • Vector Store: Semantic search over functions │ │
│ │ • Pattern Detector: 12+ malware techniques │ │
│ │ • Metadata Extractor: Structured function analysis │ │
│ │ • Session Store: Persistent analysis state │ │
│ └────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
We welcome contributions! Areas of interest:
See CODE_OF_CONDUCT.md for community guidelines.
If you use OGhidra in your research, please cite:
@software{oghidra2025,
title = {OGhidra: AI-Powered Reverse Engineering with Ghidra},
author = {Enoch Wang},
year = {2025},
url = {https://github.com/LLNL/OGhidra}
}
OGhidra builds upon excellent open-source projects:
OGhidra is distributed under the terms of the BSD 3-Clause license with a commercial license alternative.
LLNL-CODE-2013290