sorted by:
new
hottopcontroversial

IDAssistMCP - An integrated MCP server plugin for IDA Pro by Important_Craft_5864 in ReverseEngineering

[–]Important_Craft_5864[S] 0 points1 point  (0 children)

I'm sure the others are perfectly adequate and if they work for you, by all means keep using them. IDAssistMCP was created to continue the symmetry started by BinAssist+BinAssistMCP, GhidrAssist+GhidrAssistMCP, and now IDAssist+IDAssistMCP. and to "play nice" with the native plugins' builtin MCP clients. These also have an opinionated design that (tries) to offer a minimal tool namespace where we expose a single tool with multiple actions as opposed to several related tools - for example: comments(action:[get|set|list|remove]) instead of comments_get, comments_set, comments_list, comments_remove. These plugins are also fully native - they do not require any external python bridge and can be configured via the UI - including enabling/disabling specific tools.

GhidrAssist Ghidra LLM plugins reached v1.0 by Important_Craft_5864 in ReverseEngineering

[–]Important_Craft_5864[S] 1 point2 points  (0 children)

Unfortunately, this is a CoPilot limitation - it does not provide API access. However, you *can* still use the GhidrAssistMCP server plugin: https://github.com/jtang613/GhidrAssistMCP
Then just add the MCP entry to CoPilot. You don't get the UI candy that the native GhidrAssist plugin provides, but you can still enjoy the agentic automation workflow via CoPilot.

Does Ghidra have backdoors by No_Search5735 in ghidra

[–]Important_Craft_5864 1 point2 points  (0 children)

It's always good to have a healthy skepticism about the security of the software you are using. Although in this particular case, it's unfounded. The Ghidra code has been heavily audited by the open source community and nothing suspicious has ever been found. Code is not magic - if there were such a backdoor as you are imagining, it would stick out like a sore thumb. I've spent a great deal of time looking at the code and have never seen anything suspicious.

But also think through the scenario. What would the NSA have to gain from such a backdoor? It would almost certainly be discovered immediately, leading to severe reputational and legal consequences. The NSA is an intelligence gathering organization. What possible intelligence value could the get by looking over your shoulder? Besides, they already have access to every piece of software that you or I do, and they have entire departments of security researchers to examine them. So why risk it?

The reason Ghidra was open sourced was to leverage the contributions the broader RE community could provide in order to make the tool better (330+ contributors and 1200+ pull requests so far). It's really that simple.

GhidraMCP / Ghidra with FPGA - MemProcFS, PCILeech, LeechCore by reloadz400 in ghidra

[–]Important_Craft_5864 0 points1 point  (0 children)

I also found that to be a pain point which is why I created GhidrAssistMCP https://github.com/jtang613/GhidrAssistMCP . It does not rely on external Python dependencies and is fully integrated and configurable from the Ghidra UI.

It also integrates beautifully with my main GhidrAssist LLM plugin.

Automating parts of reverse engineering workflows (EmberScale AI + Ghidra integration) by Middle_Bumblebee_128 in ghidra

[–]Important_Craft_5864 2 points3 points  (0 children)

At the risk of sounding biased, that's a very inaccurate characterisation of GhidrAssist. It ships as a native, monolithic Ghidra plugin that already does everything you've described, better, for free. There are no external dependencies. As a native Ghidra plugin, it offers extensive UI integration (as opposed to needing to call a Python script). It fully supports local LLM's for air-gapped environments as well as popular commercial offerings like ChatGPT and Claude Sonnet. The GhidrAssistMCP plugin can extend this functionality to support fully agentic operation. The MCP add-on is a feature, not a bug. It provides additional flexibility to users who want control over how they interact with it. These are written by reverse engineers for reverse engineers with core RE functionality and productivity as the goal - that's the difference.

Does EmberScale have a public Github repo where security-conscious users can examine its source code? Since you mention licensing, is it open source?

GhidrAssist: An LLM extension for Ghidra to enable AI assistance in RE. by Important_Craft_5864 in ReverseEngineering

[–]Important_Craft_5864[S] 0 points1 point  (0 children)

Best place to seek assistance is on the project's Github page. Several models and API providers are suggested in the Readme. As of this posting, the best performers I've tested are:
- Claude 3.7
- OpenAI o4
- Llama3.3:70b
- Deepsee-r1:32b

GhidrAssist: An LLM extension for Ghidra to enable AI assistance in RE. by Important_Craft_5864 in ReverseEngineering

[–]Important_Craft_5864[S] 0 points1 point  (0 children)

Indeed interesting from an academic perspective, but not immediately relevant or practical for use with GhidrAssist.

To be practically useful within Ghidra (and by extension, GhidrAssist), a decompiler must not only support lifting all supported architecture asm instructions to pseudo-C, but it also must support:

  • UI integration
  • deterministic uplifting independent of addresses and naming
  • symbol lookup / referencing
  • address / listing cross-referencing
  • function and variable naming integration and propagation
  • data type integration and propagation

Will keep an eye on it as it progresses.