This repository has no description
skills: add reverse-engineering skill for Ghidra + GDB
Teaches the agent how to:
- Use ghidra-analyzeHeadless for static analysis and decompilation
- Write custom Ghidra scripts for targeted analysis
- Use GDB in batch mode to debug running processes
- Combine both for full reverse engineering workflows
author
lassulus
date
(Mar 29, 2026, 12:28 PM CEST)
commit
7a004042
7a004042a5aca991ffe050c75ad6d21506c5ad38
parent
68eaaad6
68eaaad61201f9282b2abd0d543ab7f9698b3c18
+216
+195
skills/reverse-engineering/SKILL.md
+195
skills/reverse-engineering/SKILL.md
···
1
+
---
2
+
name: reverse-engineering
3
+
description: Reverse engineer and debug binaries using Ghidra (static analysis, decompilation) and GDB (live debugging of running processes). Use when the user wants to analyze binaries, decompile functions, debug running processes, set breakpoints, or inspect memory.
4
+
---
5
+
6
+
# Reverse Engineering & Debugging Skill
7
+
8
+
Use Ghidra for static analysis/decompilation and GDB for live debugging of running processes.
9
+
10
+
All commands use `nix shell` to get the tools without installing them globally.
11
+
12
+
## Ghidra Headless Analysis
13
+
14
+
Use `ghidra-analyzeHeadless` for static analysis without the GUI.
15
+
16
+
### Import and analyze a binary
17
+
18
+
```bash
19
+
nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects MyProject \
20
+
-import /path/to/binary -overwrite
21
+
22
+
# With specific processor (e.g., ARM, MIPS)
23
+
nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects MyProject \
24
+
-import /path/to/binary -processor x86:LE:64:default -overwrite
25
+
```
26
+
27
+
### Run analysis scripts
28
+
29
+
Ghidra ships with many built-in scripts. Use `-postScript` to run them after analysis.
30
+
31
+
```bash
32
+
# Decompile all functions
33
+
nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects MyProject \
34
+
-process binary_name -postScript DecompileAllFunctions.java \
35
+
-noanalysis -readOnly -scriptlog /dev/stdout 2>/dev/null
36
+
37
+
# List all functions
38
+
nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects MyProject \
39
+
-process binary_name -postScript ListFunctions.java \
40
+
-noanalysis -readOnly -scriptlog /dev/stdout 2>/dev/null
41
+
```
42
+
43
+
### Custom Ghidra scripts (Java)
44
+
45
+
Write a custom script to extract specific information. Save as `.java` and pass with `-postScript`:
46
+
47
+
```java
48
+
// SaveTo: /tmp/ghidra_scripts/DecompileFunction.java
49
+
import ghidra.app.script.GhidraScript;
50
+
import ghidra.app.decompiler.*;
51
+
import ghidra.program.model.listing.*;
52
+
53
+
public class DecompileFunction extends GhidraScript {
54
+
@Override
55
+
public void run() throws Exception {
56
+
String targetName = getScriptArgs()[0];
57
+
DecompInterface decomp = new DecompInterface();
58
+
decomp.openProgram(currentProgram);
59
+
60
+
FunctionManager fm = currentProgram.getFunctionManager();
61
+
for (Function f : fm.getFunctions(true)) {
62
+
if (f.getName().contains(targetName)) {
63
+
DecompileResults res = decomp.decompileFunction(f, 30, monitor);
64
+
if (res.decompileCompleted()) {
65
+
println("=== " + f.getName() + " at " + f.getEntryPoint() + " ===");
66
+
println(res.getDecompiledFunction().getC());
67
+
}
68
+
}
69
+
}
70
+
decomp.dispose();
71
+
}
72
+
}
73
+
```
74
+
75
+
```bash
76
+
nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects MyProject \
77
+
-process binary_name \
78
+
-postScript /tmp/ghidra_scripts/DecompileFunction.java "main" \
79
+
-scriptPath /tmp/ghidra_scripts -noanalysis -readOnly \
80
+
-scriptlog /dev/stdout 2>/dev/null
81
+
```
82
+
83
+
### Workflow: Analyze an unknown binary
84
+
85
+
1. Import: `nix shell nixpkgs#ghidra -c ghidra-analyzeHeadless /tmp/ghidra_projects Proj -import /path/to/binary -overwrite`
86
+
2. List functions to find interesting targets
87
+
3. Decompile specific functions of interest
88
+
4. Look for strings, cross-references, and data structures
89
+
90
+
## GDB Live Debugging
91
+
92
+
Use GDB to attach to running processes, set breakpoints, and inspect state.
93
+
94
+
### Attach to a running process
95
+
96
+
```bash
97
+
# By PID
98
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "bt"
99
+
100
+
# By name (find PID first)
101
+
nix shell nixpkgs#gdb -c gdb -batch -p $(pidof process_name) -ex "bt"
102
+
```
103
+
104
+
### Non-interactive GDB commands
105
+
106
+
Use `-batch` and `-ex` for scripted debugging:
107
+
108
+
```bash
109
+
# Get backtrace of a running process
110
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "thread apply all bt"
111
+
112
+
# Print a variable
113
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "print some_global_var"
114
+
115
+
# Dump memory region
116
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "x/100x 0x7fff12345678"
117
+
118
+
# List all threads
119
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "info threads"
120
+
121
+
# Show loaded shared libraries
122
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "info sharedlibrary"
123
+
124
+
# Get register state
125
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "info registers"
126
+
127
+
# Set breakpoint and continue until hit
128
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> \
129
+
-ex "break function_name" \
130
+
-ex "continue" \
131
+
-ex "bt" \
132
+
-ex "info locals"
133
+
134
+
# Multiple commands
135
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> \
136
+
-ex "info threads" \
137
+
-ex "thread apply all bt" \
138
+
-ex "info registers"
139
+
```
140
+
141
+
### GDB with binary (not attached)
142
+
143
+
```bash
144
+
# Run with arguments
145
+
nix shell nixpkgs#gdb -c gdb -batch -ex "run" -ex "bt" --args ./binary arg1 arg2
146
+
147
+
# Run until crash, get backtrace
148
+
nix shell nixpkgs#gdb -c gdb -batch -ex "run" -ex "bt full" -ex "info registers" --args ./binary
149
+
150
+
# Set breakpoint before running
151
+
nix shell nixpkgs#gdb -c gdb -batch \
152
+
-ex "break main" \
153
+
-ex "run" \
154
+
-ex "step 10" \
155
+
-ex "info locals" \
156
+
-ex "bt" \
157
+
--args ./binary
158
+
```
159
+
160
+
### GDB Python scripting
161
+
162
+
For complex analysis, use GDB's Python API:
163
+
164
+
```bash
165
+
sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "python
166
+
import gdb
167
+
for thread in gdb.inferiors()[0].threads():
168
+
thread.switch()
169
+
frame = gdb.newest_frame()
170
+
print(f'Thread {thread.num}: {frame.name()} at {frame.pc():#x}')
171
+
"
172
+
```
173
+
174
+
### Workflow: Debug a running process
175
+
176
+
1. Find the process: `ps aux | grep process_name` or `pidof process_name`
177
+
2. Get overview: `sudo nix shell nixpkgs#gdb -c gdb -batch -p <PID> -ex "info threads" -ex "thread apply all bt"`
178
+
3. Check specific state: inspect variables, registers, memory
179
+
4. Set breakpoints if needed for dynamic analysis
180
+
5. Combine with Ghidra: decompile the binary to understand what functions do, then use GDB to observe runtime behavior
181
+
182
+
## Combining Ghidra + GDB
183
+
184
+
1. Find the binary path: `readlink -f /proc/<PID>/exe`
185
+
2. Import into Ghidra for static analysis: understand the code structure
186
+
3. Use GDB to observe runtime behavior: set breakpoints at interesting functions found in Ghidra
187
+
4. Cross-reference: Ghidra gives you function names and decompiled code, GDB shows you actual runtime values
188
+
189
+
## Tips
190
+
191
+
- Ghidra headless output goes to scriptlog; use `-scriptlog /dev/stdout` to capture it
192
+
- Use `-noanalysis -readOnly` when running scripts on already-analyzed projects
193
+
- GDB `-batch` mode is essential for non-interactive use — it runs commands and exits
194
+
- `sudo` is typically needed for GDB to attach to processes you don't own
195
+
- Check `/proc/sys/kernel/yama/ptrace_scope` if attach fails (set to 0 for debugging)
+16
skills/reverse-engineering/default.nix
+16
skills/reverse-engineering/default.nix
···
1
+
{ stdenv, ... }:
2
+
3
+
stdenv.mkDerivation {
4
+
pname = "reverse-engineering-skill";
5
+
version = "0.1.0";
6
+
src = ./.;
7
+
8
+
installPhase = ''
9
+
mkdir -p $out/share/reverse-engineering
10
+
cp SKILL.md $out/share/reverse-engineering/SKILL.md
11
+
'';
12
+
13
+
meta = {
14
+
description = "Reverse engineer and debug binaries using Ghidra and GDB";
15
+
};
16
+
}
+5
tools/pi/flake-module.nix
+5
tools/pi/flake-module.nix
···
74
74
self.legacyPackages.${pkgs.system}.skills.hedgedoc
75
75
}/share/hedgedoc $out/lib/node_modules/shitty-extensions/skills/hedgedoc
76
76
77
+
# Add reverse-engineering skill
78
+
ln -s ${
79
+
self.legacyPackages.${pkgs.system}.skills.reverse-engineering
80
+
}/share/reverse-engineering $out/lib/node_modules/shitty-extensions/skills/reverse-engineering
81
+
77
82
# Patch permission extension to use pw-play for peon sounds on Linux
78
83
${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
79
84
${pkgs.python3}/bin/python3 ${./patch-permission-sound.py} \