Reversecore MCP逆向工程服务

📋 Prerequisites

Ghidra (Required for Decompilation)

Ghidra is required for advanced decompilation features. The installation scripts automatically install Ghidra to <project>/Tools directory.

Option 1: Automatic Installation (Recommended)

```powershell

Install dependencies

pip install -r requirements-dev.txt

💻 System Requirements

Docker (Recommended)

```bash

🐳 Docker Deployment

Manual Docker build (works for all architectures)

docker build -t reversecore-mcp:latest .

Or using Docker Compose

docker compose up -d ```

🚀 Quick Start

Example 1: One-Shot JSON Submission

generate_malware_submission( file_path="wannacry.exe", analyst_name="Hunter", tags="ransomware,critical" )

Example 2: Interactive Session Workflow

get_system_time() start_analysis_session(sample_path="malware.exe") add_session_ioc("ips", "192.168.1.100") add_session_mitre("T1059.001", "PowerShell", "Execution") end_analysis_session(summary="Ransomware detected") create_analysis_report(template_type="full_analysis") send_report_email(to="security-team@company.com") ```

With custom version/path (optional)

.\scripts\install-ghidra.ps1 -Version "11.4.3" -InstallDir "C:\CustomPath"

With custom version/path (optional)

./scripts/install-ghidra.sh -v 11.4.3 -d /custom/path

**What the scripts do:**
- Downloads Ghidra 11.4.3 from GitHub (~400MB)
- Extracts to `<project>/Tools/ghidra_11.4.3_PUBLIC_YYYYMMDD`
- Sets `GHIDRA_INSTALL_DIR` environment variable
- Updates project `.env` file

**Option 2: Manual Installation**

1. **Download**: [Ghidra 11.4.3](https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.4.3_build)
2. **Extract** to `<project>/Tools/` or any directory
3. **Set environment variable**:
   

# Windows (PowerShell - permanent) [Environment]::SetEnvironmentVariable("GHIDRA_INSTALL_DIR", "C:\path\to\ghidra", "User") ``` Or add to .env file (copy from .env.example)

⚠️ Note: JDK 17+ is required for Ghidra. Download from Adoptium if needed.

MCP Client Configuration (Cursor AI)

Step 1: Build Docker Image

The unified Dockerfile automatically detects your system architecture:

```bash

Environment Variables

📚 API Reference

📊 Analysis Workflow

📥 Upload → 🔍 Triage → 🔗 X-Refs → 🏗️ Structures → 📝 Decompile → 🛡️ Defense

Use built-in prompts for guided analysis:

• full_analysis_mode - Comprehensive malware analysis with 6-phase expert reasoning and evidence classification
• basic_analysis_mode - Quick triage for fast initial assessment
• game_analysis_mode - Game client analysis with cheat detection guidance
• firmware_analysis_mode - IoT/Firmware security analysis with embedded system focus
• report_generation_mode - Professional report generation workflow with MITRE ATT&CK mapping

💡 AI Reasoning Enhancement: Analysis prompts use expert persona priming, Chain-of-Thought checkpoints, structured reasoning phases, and evidence classification (OBSERVED/INFERRED/POSSIBLE) to maximize AI analysis capabilities and ensure thorough documentation.