Automating the tedium of turning FUN_00401a30 into parse_http_header

What it does

Kong ingests a stripped, often obfuscated binary and runs a fully autonomous analysis pipeline inside Ghidra. It triages functions, builds call graphs and cross-reference context, then walks the graph bottom-up so leaf functions get named and typed before their callers do. Each function’s decompilation is enriched with neighbor signatures, string references, and data-flow hints, normalized to remove noise, and sent to an LLM for symbol recovery. The results—function names, parameter types, structs, and calling conventions—are written directly back into Ghidra’s program database.

The interesting bit

The value is in the plumbing: Kong constructs prompts from Ghidra’s relational database and orchestrates analysis in dependency order, so the model reasons about callees that have already been resolved. It also runs an agentic deobfuscation pass using symbolic tools when it detects control-flow flattening or VM protection, cleaning up the decompiler output before the LLM ever sees it.

Key highlights

• In-process Ghidra: Runs inside Ghidra’s JVM via PyGhidra and JPype with no RPC overhead, giving direct access to the program database.
• Bottom-up analysis: Names leaf functions first so callers inherit resolved context, improving accuracy through the call graph.
• Agentic deobfuscation: Detects obfuscation patterns like control-flow flattening and VM protection, then uses symbolic analysis to simplify decompiler output before LLM ingestion.
• Semantic synthesis: A post-analysis pass unifies naming conventions and synthesizes struct definitions from field-access patterns across the whole binary.
• Cost tracking: Monitors token spend and provider pricing across Anthropic and OpenAI models.

Caveats

• Recovery confidence drops sharply for Go and Rust binaries outside x86/x86-64, and the README explicitly warns that larger binaries mean higher cost, longer runtime, and lower confidence.
• Requires a Ghidra installation and a paid Anthropic or OpenAI API key; there is no mention of local or offline LLM support.

Verdict

Security researchers and reverse engineers who routinely face stripped C or C++ binaries will save hours of manual annotation. If you do not work with compiled binaries or lack a Ghidra setup, this is not your tool.