Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

github.com

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#61

Post by gcormier »

xerzes wrote: post #2

Hi HN, I built this because reverse engineering software across multiple versions is painful. You spend hours annotating functions in version 1.07, then version 1.08 drops and every address has shifted — all your work invisible. The core idea is a normalized function hashing system. It hashes functions by their logical structure — mnemonics, operand categories, control flow — not raw bytes or absolute addresses. When…

Was hoping to kick the tires but seem to be spinning my wheels trying to get Ghidra to see the plugin. Is GH Discussions your preferred means of communications?

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#62

Post by popinman322 »

joecarpenter wrote: post #60

Reverse engineering with LLMs is very underrated for some reason. I'm working on a hobby project - reverse-engineering a 30 year old game. Passing a single function disassembly + Ghidra decompiler output + external symbol definitions RAG-style to an agent with a good system prompt does wonders even with inexpensive models such as Gemini 3 Flash. Then chain decompilation agent outputs to a coding agent, and produced c…

I've found that Gemini models often produce pseudocode that seems good at first glance but is typically wrong or incomplete, especially for larger or more complex functions. It might produce pseudocode for 70% of the function, then silently drop the last 30%. Or it might elide the inside of switch blocks or if statements, only including a comment explaining what should happen.

Alternatively, Claude Opus generally output actual code that included more of the original functionality. Even Qwen3-30B-A3B performs better than Gemini, in my experience.

It's honestly really frustrating. The huge context size available with Gemini makes the model family seem like a boon for this task; PCode is very verbose, impinging on the headroom needed for the model's response.

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#64

Post by bobbycrocodilo »

xerzes wrote: post #2

Hi HN, I built this because reverse engineering software across multiple versions is painful. You spend hours annotating functions in version 1.07, then version 1.08 drops and every address has shifted — all your work invisible. The core idea is a normalized function hashing system. It hashes functions by their logical structure — mnemonics, operand categories, control flow — not raw bytes or absolute addresses. When…

How does it compare to other Ghidra MCP servers?

- pyghidra-mcp - ReVa - GhidrAssistMCP - GhydraMCP - etc...

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#66

Post by joecarpenter »

popinman322 wrote: post #62
joecarpenter wrote: post #60

Reverse engineering with LLMs is very underrated for some reason. I'm working on a hobby project - reverse-engineering a 30 year old game. Passing a single function disassembly + Ghidra decompiler output + external symbol definitions RAG-style to an agent with a good system prompt does wonders even with inexpensive models such as Gemini 3 Flash. Then chain decompilation agent outputs to a coding agent, and produced c…

I've found that Gemini models often produce pseudocode that seems good at first glance but is typically wrong or incomplete, especially for larger or more complex functions. It might produce pseudocode for 70% of the function, then silently drop the last 30%. Or it might elide the inside of switch blocks or if statements, only including a comment explaining what should happen. Alternatively, Claude Opus generally out…

In my case I'm decompiling into C and it does a pretty good job at translation. There were situations where it missed an important implementation detail. For example, there is an RLE decompressor and Gemini generated plausible, but slightly incorrect code. Gemini 3 Pro was not able to find the bug and produced code that was similar to Gemini 3 Flash.

The bug was one-shotted by GPT 5.2.

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#67

Post by startupsfail »

chfritz wrote: post #65

Reverse engineering is illegal in many cases. Aren't you afraid you might be automating the process for your users to get into (legal) trouble? Will your tool warn the user if they are about to violate laws?

Claude is already known for its attempts to send emails to FBI ;)

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#68

Post by sintax »

Retr0id wrote: post #34
xerzes wrote: post #2

Hi HN, I built this because reverse engineering software across multiple versions is painful. You spend hours annotating functions in version 1.07, then version 1.08 drops and every address has shifted — all your work invisible. The core idea is a normalized function hashing system. It hashes functions by their logical structure — mnemonics, operand categories, control flow — not raw bytes or absolute addresses. When…

What does your function-hashing system offer over ghidra's built in FunctionID, or the bindiff plugin[0]? [0] https://github.com/google/bindiff

or Binary Ninja's WARP : https://docs.binary.ninja/guide/warp.html // https://github.com/vector35/warp

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#69

Post by TheGoddessInari »

DonHopkins wrote: post #33
jakozaur wrote: post #4

Funny coincidence, I'm working on a benchmark showcasing AI capabilities in binary analysis. Actually, AI has huge potential for superhuman capabilities in reverse engineering. This is an extremely tedious job with low productivity. Currently reserved, primarily when there is no other option (e.g., malware analysis). AI can make binary analysis go mainstream for proactive audits to secure against supply-chain attacks…

Great point! Not just binary analysis, plus even self-analysis! (See skill-snitch analyze and snitch on itself below!) MOOLLM's Anthropic skill scanning and monitoring "skill-snitch" skill has superhuman capabilities in reviewing and reverse engineering and monitoring the behavior of untrusted Anthropic and MOOLLM skills, and is also great for debugging and optimizing skills. It composes with the "cursor-mirror" skil…

Haven't dived deep into it yet, but dabbled in similar areas last year (trying to get various bits to reliably "run" in-context).

My immediate thought was to want to apply it to the problem I've been having lately: could it be adapted to soothe the nightmare of bloated llm code environments where the model functionally forgets how to code/follow project guidelines & just wants to complete everything with insecure tutorial style pattern matching?

Re: Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering

#70

Post by cgfjtynzdrfht »

Retr0id wrote: post #34
xerzes wrote: post #2

Hi HN, I built this because reverse engineering software across multiple versions is painful. You spend hours annotating functions in version 1.07, then version 1.08 drops and every address has shifted — all your work invisible. The core idea is a normalized function hashing system. It hashes functions by their logical structure — mnemonics, operand categories, control flow — not raw bytes or absolute addresses. When…

What does your function-hashing system offer over ghidra's built in FunctionID, or the bindiff plugin[0]? [0] https://github.com/google/bindiff

[dead]
Post reply on HN