GhidrAssist Documentation

GhidrAssist is a comprehensive LLM-powered plugin for Ghidra that enhances reverse engineering workflows through intelligent automation.

What is GhidrAssist?

GhidrAssist integrates large language models directly into your Ghidra workflow. Instead of switching between tools or copying code snippets, you can ask questions, generate explanations, and receive intelligent suggestions without leaving CodeBrowser.

The plugin supports local LLMs (Ollama, LM Studio) and cloud providers (OpenAI, Anthropic), letting you choose between privacy, cost, and performance.

Core Capabilities

GhidrAssist is organized into seven tabs, each focused on a specific aspect of LLM-assisted analysis:

Key Features

MCP Tool Integration

GhidrAssist supports the Model Context Protocol (MCP), allowing LLMs to interact with Ghidra through tool calls. When MCP is enabled, the LLM can:

• Navigate to functions and addresses
• Retrieve decompiled code and disassembly
• Query cross-references
• Access the semantic graph
• Use external MCP servers for specialized tooling

See the Query Workflow for details on using MCP tools.

ReAct Autonomous Agent

For complex investigations, GhidrAssist includes a ReAct (Reasoning + Acting) agent that can autonomously:

1. Plan an investigation based on your question
2. Execute multiple tool calls to gather information
3. Reflect on findings and adapt its approach
4. Synthesize a comprehensive answer

This is useful for exploratory questions like “What does this binary do?” or “Trace the data flow from user input.”

Extended Thinking

For models that support it (Claude Sonnet 4+, OpenAI o1/o3, local reasoning models), GhidrAssist provides reasoning effort control:

Higher reasoning effort allows the model more “thinking time” but increases latency and cost.

Semantic Graph

Build a rich knowledge graph of your binary that captures:

• Function summaries and purposes
• Call relationships
• Security flags (network, file I/O, crypto, etc.)
• Taint flow paths for vulnerability detection
• Function communities and modules

The graph can be queried directly or used to enhance LLM responses.

SymGraph Cloud Sharing

Share your analysis with the community through SymGraph:

• Push function names, types, and semantic graph data
• Pull existing analysis from other researchers
• Resolve conflicts between local and cloud symbols

Supported LLM Providers

GhidrAssist supports a wide range of LLM providers:

Recommended Models

• Reasoning-intensive tasks: Claude Sonnet 4+, OpenAI GPT-5.2, gpt-oss (extended thinking)
• General analysis: GPT-5.2-Codex, Claude Sonnet 3.5, DeepSeek, Llama-based models
• Local/private analysis: Ollama with gpt-oss, qwen2.5-coder, or codellama

Architecture Overview

GhidrAssist uses a Model-View-Controller architecture:

• Views: Swing-based UI components for each tab
• Controllers: Business logic and LLM orchestration
• Services: Reusable services for settings, analysis storage, RAG, and more

All LLM operations run in background tasks so the UI stays responsive, with streaming for real-time output.

Getting Started

Ready to start using GhidrAssist? See the Getting Started Guide for installation and configuration instructions.

Common Workflows

• Building Context with the Explain Tab
• Interactive Queries and the ReAct Agent
• Building a Semantic Graph

Tab Reference

• Explain Tab
• Query Tab
• Actions Tab
• Semantic Graph Tab
• RAG Tab
• Settings Tab