GhidraGPT
Author: Mohamed Benchikh
GhidraGPT is a Ghidra extension that brings large language models into the decompiler workflow. You right-click a function; the plugin sends that function's decompiled C to an LLM provider of your choice and streams the response back into a dedicated console. Depending on the action, it explains the function, recovers meaningful names/types/comments and writes them back into the program, or reviews the code for likely security issues.
All actions operate on a single function at a time, using its current decompiler output as the only context; there is no interprocedural or whole-program analysis.
🎥 Demo
🚀 Features
Actions (right-click a function ▸ GhidraGPT)
- Explain: generates a natural-language summary of what the selected function does, derived from its decompiled code.
- Rewrite: recovers a descriptive function name, renames local variables and parameters, infers their types, updates the function prototype, and adds inline comments, then applies that markup back into the Ghidra database.
- Audit: reviews the selected function's decompiled code for likely security issues (e.g. unbounded copies, integer overflows, unchecked returns). This is a best-effort, single-function review by the model, not sound static analysis: it has no cross-function dataflow or call-graph context, so treat findings as leads to verify, not proof.
Integration
- Decompiler & Listing integration: actions are available from the right-click
GhidraGPTsubmenu in both the Decompiler and Listing views. - Streaming console: responses stream token-by-token into a dedicated GhidraGPT console panel.
- Pluggable providers: switch provider and model from the configuration panel; for most providers the available models can be fetched live.
- Configurable requests: model, temperature, max tokens, and request timeout are all adjustable.
🛠️ Installation
-
Clone the repository:
git clone https://github.com/weirdmachine64/GhidraGPT.git cd GhidraGPT -
Build the extension:
GHIDRA_INSTALL_DIR=/path/to/ghidra mvn clean packageThe packaged extension is written to
target/GhidraGPT-.zip. -
Install in Ghidra:
File → Install Extensions- Click
+, selecttarget/GhidraGPT-.zip, and restart Ghidra. - Enable the plugin when prompted, or via
File → Configure → GhidraGPT → GhidraGPTPlugin.
-
Configure a provider:
- Open the GhidraGPT configuration panel, pick a provider and model, and enter an API key (not required for Ollama).
- Note on key storage: the key is saved locally in
~/.ghidragpt/config.properties, lightly obfuscated with XOR, which is not encryption and should not be treated as secure at-rest storage. Prefer a scoped, rotatable key and protect the file accordingly.
📋 Supported providers
| Provider | Notes |
|---|---|
| OpenAI | GPT models |
| Anthropic | Claude models |
| Google Gemini | Gemini models (OpenAI-compatible endpoint) |
| Cohere | Command models |
| Mistral AI | Mistral models |
| DeepSeek | DeepSeek models |
| Grok (xAI) | Grok models |
| OpenRouter | Single key, routed access to many providers' models |
| Ollama | Local models; no API key required |
| OpenAI-compatible | Any endpoint implementing the OpenAI chat-completions API (custom base URL) |
🤝 Contributing
Issues, feature requests, and pull requests are welcome.
📄 License
Licensed under the terms in the LICENSE file.
🔗 Requirements
- Ghidra: 12.1.x (the extension declares compatibility with the Ghidra version it is built against)
- JDK: 21+ (required to run Ghidra 12.x)
- Maven: build system
- Network access to the configured provider's API (except Ollama, which runs locally)
GhidraGPT: LLM-assisted reverse engineering, inside Ghidra.