akiselev/ghidra-cli
178 stars · Last commit 2026-07-28
Automate Ghidra reverse engineering from the command line — headless analysis, decompilation, and structured JSON output for AI agents like Claude Code
README preview
# Ghidra CLI A Rust CLI for automating Ghidra reverse engineering tasks. Usable directly by hand or driven by an AI coding agent like Claude Code. ## Features - **Direct bridge architecture** - CLI connects directly to a Java bridge running inside Ghidra's JVM - **Auto-start bridge** - Import/analyze commands automatically start the bridge - **Fast queries** - Sub-second response times with Ghidra kept in memory - **Program analysis** - Functions, symbols, types, strings, cross-references - **Type system** - Create/edit structs, enums, typedefs; add/remove struct fields - **Function signatures** - Edit return types, calling conventions, full C signatures; retype variables - **Binary patching** - Modify bytes, NOP instructions, export patches - **Call graphs** - Generate caller/callee graphs, export to DOT format - **Search capabilities** - Find strings, bytes, functions, crypto patterns - **Script execution** - Run Java/Python Ghidra scripts, inline or from files - **Batch operations** - Execute multiple commands from a file - **Responsive job control** - Long analyses run on a serialized program lane while `ping`, `status`, `jobs`, and `cancel` stay live on a separate control plane - **Flexible output** - Human-readable, JSON, or pretty JSON formats - **Filtering** - Expression-based filtering with a small DSL (e.g., `size > 100 AND name ~ 'crypt'`)