OGhidra bridges the gap between Large Language Models (LLMs) and the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. It empowers engineers and researchers to interact with binaries conversationally, automate complex reverse engineering workflows, and maintain complete privacy by running AI models locally via Ollama.

How It Works

OGhidra employs an adaptive agentic loop for analysis, comprising Planning, Execution, and Review phases. User queries initiate a planning phase, followed by an execution phase where LLMs interact with Ghidra tools. Results are then reviewed, potentially triggering further information gathering or refinement in a replanning loop before a final response is generated. This approach allows for dynamic, context-aware analysis and automation of tasks like function renaming, pattern detection, and report generation.

Quick Start & Requirements

• Primary Install: Clone the repository (git clone https://github.com/LLNL/OGhidra.git), navigate to the directory, and install dependencies using uv sync (recommended) or pip install -r requirements.txt. Configure environment variables by copying .env.example to .env.
• Prerequisites: Python 3.12+, Ghidra 11.0.3+ (12.0.3 recommended), Java 17+ (Java 21 required for Ghidra 12.0.3 builds), and Ollama for local LLM execution.
• Ghidra Plugin: Requires building the GhidraMCP extension using Gradle and Java 21, then installing it within Ghidra. Automated build scripts are provided.
• AI Models: Pull desired models via Ollama (e.g., ollama pull gemma3:27b).
• Launch: Run uv run main.py --ui for GUI mode or uv run main.py --interactive for CLI.
• Links: YouTube Setup Tutorial: https://www.youtube.com/watch?v=hBD92FUgR0Y.

Highlighted Details

• Smart Tool Buttons: One-click GUI access to common reverse engineering tasks like analyzing/renaming functions, analyzing strings/imports, and generating reports.
• Task Modes: Specialized analysis modes for malware, vulnerability research, or general reverse engineering.
• Malware Pattern Detection: Automatically identifies over 12 common malware techniques (e.g., Anti-Debug, Process Injection) with MITRE ATT&CK mappings.
• Smart Enumeration: Builds queryable knowledge graphs from binary analysis, extracting structured metadata and optimizing for semantic search.
• Session Management: Persists analysis state, including RAG vectors and UI configurations, allowing sessions to be saved and restored.
• RAG Integration: Leverages vector embeddings for semantic search across analyzed functions, improving context recall and reducing redundant LLM calls.

Maintenance & Community

The project is primarily authored by Enoch Wang. Community interaction is facilitated through GitHub Issues and Discussions. Direct contact is available via enochsurge@gmail.com.

Licensing & Compatibility

OGhidra is distributed under the BSD 3-Clause license, with a commercial license alternative available. The BSD 3-Clause license is generally permissive for commercial use and integration.

Limitations & Caveats

Connection issues with Ghidra or Ollama require verifying running services and plugin configurations. Performance can be impacted by model size and context window; users may need to adjust context budgets, use smaller models, or tune execution settings. The pyghidra backend requires specifying a valid Ghidra project and program name for analysis.