aeondave/ghidra
offensive-tools/re/ghidra/SKILL.md
NSA's open-source reverse engineering suite with disassembler, decompiler, and scripting. Use when statically analyzing malware, firmware, or binaries to understand logic, find vulnerabilities, or recover algorithms.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill ghidraInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 31, 2026, 9:22 PM59.4s1 file scanned
SKILL.md
- name:
- ghidra
- description:
- NSA's open-source reverse engineering suite with disassembler, decompiler, and scripting. Use when statically analyzing malware, firmware, or binaries to understand logic, find vulnerabilities, or recover algorithms.
- license:
- MIT
- compatibility:
- Java 11+; Linux/macOS/Windows; GUI; github.com/NationalSecurityAgency/ghidra
- author:
- AeonDave
- version:
- 1.0
Ghidra
NSA open-source RE suite — disassembler + decompiler + scripting for static analysis.
Quick Start
- Download from ghidra-sre.org
./ghidraRun(Linux/macOS) orghidraRun.bat(Windows)- New Project → Import File → target binary
- Double-click to open CodeBrowser → Analyze (auto-analysis)
Key Windows
| Window | Purpose | |--------|---------| | Symbol Tree | Functions, labels, imports | | Decompiler | C pseudocode of selected function | | Listing | Assembly view | | Data Type Manager | Struct/enum definitions | | Program Trees | Segments/sections | | References | Cross-references to/from |
Common Analysis Tasks
Find interesting functions:
Search > For Strings → look for "password", "exec", "http"
Window > Symbol Tree > Functions → filter by name
Rename and annotate:
Right-click function → Edit Function → rename
Right-click variable → Rename Variable
Scripting (Python/Java):
# Script Manager > New Script (Python)
from ghidra.program.flatapi import FlatProgramAPI
api = FlatProgramAPI(currentProgram)
funcs = list(api.getFunctions(True))
print([f.getName() for f in funcs[:10]])
Common Workflows
Malware static analysis:
- Import sample → auto-analyze
- Symbol Tree → Imports: check suspicious APIs (VirtualAlloc, CreateRemoteThread)
- Decompile each suspicious function
Find hardcoded credentials:
Search > For Strings → password/key/secret
Double-click result → decompile surrounding function
Resources
| File | When to load |
|------|--------------|
| references/ | Script examples and struct recovery tips |
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026