← all repositories
cyberkaida/reverse-engineering-assistant

Teaching LLMs to reverse engineer without hallucinating

A Ghidra extension that feeds AI models small, structured tools instead of dumping entire binaries into context.

743 stars Java Coding AssistantsAgents
reverse-engineering-assistant
Velocity · 7d
+0.7
★ / day
Trend
steady
star history

What it does

ReVa is a Ghidra extension that exposes the reverse engineering toolkit as an MCP server. AI assistants like Claude Code can call discrete tools to inspect functions, strings, cross-references, and decompilation output—rather than trying to ingest a whole binary at once. It runs either inside the Ghidra UI for interactive work, or headless for CI/CD and automation pipelines.

The interesting bit

The project treats LLM context as a scarce resource. Instead of handing the model a firehose of disassembly, ReVa serves small, schema-guided fragments with reinforcement and links to related data. It also tolerates sloppy LLM inputs, corrects them, and feeds the corrected output back—effectively training the model on the fly without the model knowing it. The README claims this reduces “context rot” and lets the assistant handle firmware-sized binaries.

Key highlights

  • MCP server architecture means it composes with other tools (GitHub source lookup, web search via Kagi, etc.)
  • Headless mode auto-manages ephemeral Ghidra projects in .reva/projects/
  • Ships with Claude Code marketplace plugins for binary triage, crypto analysis, and CTF workflows
  • Supports PyGhidra for Python-driven automation
  • Requires Ghidra 12.0+; Java/Gradle build

Caveats

  • Only supports Ghidra 12.0 and above; no Binary Ninja or IDA integration despite the topic tag
  • The “state of the art techniques” claim is hand-wavy; no benchmarks or comparisons provided
  • Assistant mode requires manual plugin activation in two separate Ghidra configuration dialogs

Verdict

Worth a look if you’re already in the Ghidra ecosystem and want an AI pair programmer that actually understands cross-references. Skip it if you’re hoping for a drop-in replacement for IDA’s decompiler or if your Ghidra install is pinned to an older version.

heatdrop uses Google Analytics to see which pages get read — nothing else. Your call. How we handle data.