OGhidra逆向分析助手

Prerequisites

1. Python 3.12+ - Check version: python --version 2. Ghidra 12.0.3 (Recommended) - Download from Ghidra Releases - Minimum supported: Ghidra 11.0.3+ - Tested with: Ghidra 11.0.3, 11.3.2, 12.0.2, 12.0.3 3. Java 17+ - Required for Ghidra: java -version 4. Ollama (for local models) - Install from ollama.com

Install dependencies (choose one)

uv sync # Using UV (recommended) pip install -r requirements.txt # Using pip

Installation

```bash

Setup Ghidra Plugin

The OGhidraMCP plugin supports both Ghidra 11.3.2+ and Ghidra 12.0.3 (recommended). There's also a YouTube video tutorial: https://www.youtube.com/watch?v=hBD92FUgR0Y

Building the GhidraMCP Extension

As a developer, you'll need to build the GhidraMCP extension before installing it in Ghidra:

1. Prerequisites: - Ghidra 12.0.3 (or compatible version) installed - Gradle (run gradle -v to verify it's installed) - Java 21 (required for Ghidra 12.0.3)

2. Option 1: Using the automated build scripts: - Windows:

     # Set the path to your Ghidra installation (will attempt to find last run copy of Ghidra if not set)
     set GHIDRA_INSTALL_DIR=C:\path\to\ghidra_12.0_PUBLIC

     # Run the build script
     build_ghidra_plugin.bat
     

• Unix/Linux/Mac:

     # Set the path to your Ghidra installation (will attempt to find last run copy of Ghidra if not set)
     export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.0_PUBLIC

     # Run the build script (make it executable first if needed)
     chmod +x build_ghidra_plugin.sh
     ./build_ghidra_plugin.sh
     

3. Option 2: Manual build process: - Create/update OGhidraMCP/gradle.properties with:

     GHIDRA_INSTALL_DIR=C:/path/to/ghidra_12.0_PUBLIC
     

- Navigate to the OGhidraMCP directory and run the build:

     cd OGhidraMCP
     gradle buildExtension
     

4. Locate the built extension: - The extension zip file is created in OGhidraMCP/dist/ - The filename will be something like ghidra_12.0_PUBLIC_YYYYMMDD_OGhidraMCP.zip

Installing the GhidraMCP Extension

Once you've successfully built the extension:

1. Install in Ghidra: - Open Ghidra -> File -> Install Extensions - Click Add Extension (green plus icon) - Browse to your OGhidraMCP/dist/ directory - Select the newly built extension zip file (e.g., ghidra_12.0_PUBLIC_YYYYMMDD_OGhidraMCP.zip) - Restart Ghidra

2. Enable the plugin: - Open a Ghidra project - File → Configure → Enable Developer - Check the box to enable - The server will start on http://localhost:8080/methods

YOU NEED TO HAVE CODE BROWSER OPEN

Note: The plugin is compatible with Ghidra 11.0.3+ and optimized for Ghidra 12.0.3

Quick Start

Configure environment

cp .env.example .env

Edit .env with your settings

```

Configuration

Edit .env to configure your AI provider:

Option 1: Local Models (Ollama)

LLM_PROVIDER=ollama
OLLAMA_BASE_URL=http://localhost:11434/
OLLAMA_MODEL=gemma3:27b
OLLAMA_EMBEDDING_MODEL=nomic-embed-text

Option 2: External APIs

LLM_PROVIDER=external
EXTERNAL_PROVIDER=google
EXTERNAL_API_KEY=your-api-key-here
EXTERNAL_MODEL=gemini-3.1-flash-lite-preview
EXTERNAL_EMBEDDING_MODEL=gemini-embedding-001

Option 3: Custom OpenAI-Compatible API

LLM_PROVIDER=custom_api
CUSTOM_API_URL=https://api.example.com/v1/chat/completions
CUSTOM_API_KEY=your-api-key-here
CUSTOM_API_MODEL=your-model-name
CUSTOM_API_EMBEDDING_MODEL=your-embedding-model

Context Management Settings

Adjust based on your model's context window:

```env

Execution settings

MAX_EXECUTION_STEPS=5 # Steps per planning cycle MAX_AGENTIC_CYCLES=3 # How many plan-execute-review loops AGENTIC_LOOP_ENABLED=true # Enable adaptive replanning ```

---

Enable in .env

RESULT_CACHE_ENABLED=true TIERED_CONTEXT_ENABLED=true ```

Benefits: - Remember previous analysis across sessions - Find similar functions semantically - Reduce redundant LLM calls

Common Workflows

Verify plugin is loaded

Alternative models

ollama pull gpt-oss:120b # High quality (80GB RAM) ollama pull devstral-2:123b # High quality (80GB RAM) ollama pull devstral-2:123b-cloud # Cloud Model ```

Troubleshooting