Teaching Ghidra to read its own decompiler output

What it does GhidraGPT is a Ghidra plugin that pipes decompiled functions through large language models to automate reverse-engineering busywork. It adds right-click menu items and a console panel inside Ghidra for rewriting code—renaming functions, inferring types, adding comments—plus explaining logic and flagging potential vulnerabilities. The plugin supports a laundry list of providers, from OpenAI and Anthropic to local Ollama endpoints, and encrypts API keys locally.

The interesting bit The real convenience is keeping everything in-context: right-click a function and watch streaming responses appear in a dedicated console instead of copy-pasting pseudocode into a browser tab. That tight UI integration is what separates it from using ChatGPT manually.

Key highlights

• Supports nine LLM backends including local Ollama and generic OpenAI-compatible APIs
• Rewrites decompiled output via automated renaming, type inference, and contextual commenting
• Adds a dedicated console and right-click context menu directly into Ghidra’s UI
• Encrypts and stores API keys locally through a built-in configuration panel
• Requires Ghidra 10.0+ and Java 11+

Caveats

• The README advertises “vulnerability detection” but offers no detail on methodology, accuracy, or scope—treat it as assisted analysis, not an audit.
• You must build the extension from source with Maven; the README does not mention pre-built releases.

Verdict Worth a look if you spend hours in Ghidra and want an AI assistant that stays inside the tool. Skip it if you expect fully automated reverse engineering or prefer not to trust API keys to a plugin.