GhidraGPT

A powerful Ghidra plugin that integrates Large Language Models (LLMs) directly into Ghidra to enhance reverse engineering workflows with code analysis and enhancement capabilities.

🚀 Features

Actions (right-click a function ▸ GhidraGPT)

Explain: generates a natural-language summary of what the selected function does, derived from its decompiled code.

Rewrite: recovers a descriptive function name, renames local variables and parameters, infers their types, updates the function prototype, and adds inline comments, then applies that markup back into the Ghidra database.

Audit: reviews the selected function's decompiled code for likely security issues (e.g. unbounded copies, integer overflows, unchecked returns). This is a best-effort, single-function review by the model, not sound static analysis: it has no cross-function dataflow or call-graph context, so treat findings as leads to verify, not proof.

Integration

Decompiler & Listing integration: actions are available from the right-click GhidraGPT submenu in both the Decompiler and Listing views.

Streaming console: responses stream token-by-token into a dedicated GhidraGPT console panel.

Pluggable providers: switch provider and model from the configuration panel; for most providers the available models can be fetched live.

Configurable requests: model, temperature, max tokens, and request timeout are all adjustable.

🛠️ Installation

Clone the repository:

git clone https://github.com/weirdmachine64/GhidraGPT.git

cd GhidraGPT

Build the extension:

GHIDRA_INSTALL_DIR=/path/to/ghidra mvn clean package

The packaged extension is written to target/GhidraGPT-<version>.zip.

Install in Ghidra:

File → Install Extensions

Click +, select target/GhidraGPT-<version>.zip, and restart Ghidra.

Enable the plugin when prompted, or via File → Configure → GhidraGPT → GhidraGPTPlugin.

Configure a provider:

Open the GhidraGPT configuration panel, pick a provider and model, and enter an API key (not required for Ollama).

Note on key storage: the key is saved locally in ~/.ghidragpt/config.properties, lightly obfuscated with XOR, which is not encryption and should not be treated as secure at-rest storage. Prefer a scoped, rotatable key and protect the file accordingly.

📋 Supported providers

Provider Notes

OpenAI GPT models

Anthropic Claude models

Google Gemini Gemini models (OpenAI-compatible endpoint)

Cohere Command models

Mistral AI Mistral models

DeepSeek DeepSeek models

Grok (xAI) Grok models

OpenRouter Single key, routed access to many providers' models

Ollama Local models; no API key required

OpenAI-compatible Any endpoint implementing the OpenAI chat-completions API (custom base URL)