skilly. Buy ad slot
All skills
Community / AGENT SKILL

scripting-ghidra-headless-analysis

meltedinhex/analyst-ai-pack
0 installs 22 GitHub stars
0

Automates batch reverse engineering by generating Ghidra analyzeHeadless commands and post-analysis script skeletons to import, auto-analyze, and export results for many samples without the GUI. Activates for requests to script Ghidra headless analysis, batch-analyze samples with Ghidra, or generate an analyzeHeadless command and post-script.

BEFORE YOU INSTALL

Understand the trade-offs.

SECURITY REVIEW

Not yet assessed

Review the original instructions and requested permissions before installing.

No security review is available for this catalog entry yet.

SKILL QUALITY

Not yet assessed

How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.

No quality assessment is available for this catalog entry yet.

The full skill.

Original instructions from the publisher’s SKILL.md

# Scripting Ghidra Headless Analysis

## When to Use

- You need to auto-analyze many samples (or re-run a consistent analysis) without the Ghidra GUI.
- You want to generate the `analyzeHeadless` command and a post-script that exports functions,
  strings, or decompiled output.

**Do not use** this to run untrusted samples — Ghidra analyzes binaries statically and never
executes them, but keep the import directory isolated. This skill prepares automation, it does not
run the binary.

## Prerequisites

- A Ghidra installation (`analyzeHeadless` in `support/`) and the samples to import.

## Safety & Handling

- Ghidra does not execute the sample; still store imports in an isolated, defanged directory.

## Workflow

### Step 1: Generate the headless command

```bash
python scripts/analyst.py command --project /proj --name Batch --import ./samples --script export.py
```

Builds an `analyzeHeadless` invocation with project path, import directory, post-script, and common
flags (`-recursive`, `-overwrite`, `-deleteProject` optional).

### Step 2: Generate a post-analysis script skeleton

```bash
python scripts/analyst.py postscript --out export.py --emit functions,strings
```

Emits a Ghidra Python (Jython) script that iterates functions/strings and writes JSON next to the
program.

### Step 3: Run and collect

Execute the generated command, then aggregate the per-sample JSON exports.

### Step 4: Review

Spot-check a few exports to confirm analysis completeness before scaling up.

## Validation

- The generated command references a valid project path, import dir, and existing post-script.
- The post-script uses real Ghidra API calls (`currentProgram`, `getFunctionManager`).
- Output JSON is produced per imported program.

## Pitfalls

- Forgetting `-overwrite`/`-recursive`, causing skipped or duplicate imports.
- Jython 2 syntax constraints in post-scripts (no f-strings).
- Project lock conflicts when running multiple headless jobs on one project.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the generator.
- Ghidra analyzeHeadless and API docs (linked in frontmatter).