SymGraph

On this page

Workflow: Interactive Queries and the ReAct Agent

This guide walks through using the Query tab for interactive analysis and autonomous investigation.

Overview

The Query tab supports:

Basic Query Workflow

Ask a Question

  1. Open the Query tab
  2. Type your question
  3. Click Submit

Use Context Macros

Macros insert context from Ghidra:

Macro Description
#func Current function code (decompiler or disassembly)
#addr Data at current address
#line Current line (decompiler or disassembly)
#range(start, end) Data in address range

Example:

What does #func do with user input?

Manage Conversations

MCP Tool Integration

When Use MCP Tools is enabled, the LLM can call tools to gather data.

Common tool usage: - Decompile or disassemble - Query cross-references - Navigate to addresses - Query the semantic graph

ReAct Agent Workflow

When to Use ReAct

Use agentic mode for:

Enabling ReAct

  1. Enable Use MCP Tools
  2. Enable Agentic Mode (ReAct)
  3. Ask your question

The Investigation Process

  1. Planning: Create a todo list of investigation steps
  2. Investigation: Call tools and gather evidence
  3. Reflection: Update the plan if needed
  4. Synthesis: Provide a final, evidence-based answer

Stopping Early

Click Stop to cancel the investigation. GhidrAssist will save partial findings in the chat history.

Extended Thinking

Configure reasoning depth in Settings:

Level Best For
None Quick responses
Low Light reasoning
Medium Moderate complexity
High Deep analysis

Higher levels improve quality but increase latency and cost.

Tips for Effective Queries