Reverse Engineering Skill Skill

Reverse Engineering Skill

Binary analysis and reverse engineering via MCP servers for Ghidra, IDA Pro, radare2, and angr.

Trigger Conditions

User asks to analyze binaries, disassemble code, decompile functions
Questions about malware analysis, vulnerability research, CTF challenges
Binary diffing, patch analysis, firmware extraction
Symbol recovery, function identification, control flow analysis

MCP Servers

1. GhidrAssistMCP (Ghidra - Free)

Repository: https://github.com/jtang613/GhidrAssistMCP
Stars: High activity
Transport: HTTP/SSE on port 8080

Installation:

# Download from releases page
# In Ghidra: File → Install Extensions → Add Extension
# Enable: File → Configure → Configure Plugins → GhidrAssistMCP

31 Built-in Tools: | Category | Tools | |----------|-------| | Program Analysis | get_program_info, list_functions, list_data, list_strings, list_imports, list_exports, list_segments | | Function Analysis | get_function_info, decompile_function, disassemble_function, function_xrefs, search_functions | | Navigation | get_current_address, xrefs_to, xrefs_from, get_current_function | | Modification | rename_function, rename_variable, set_function_prototype, set_local_variable_type, set_disassembly_comment | | Advanced | auto_create_struct |

2. LaurieWired/GhidraMCP (Popular Alternative)

Repository: https://github.com/LaurieWired/GhidraMCP
Transport: Python bridge to Ghidra

3. IDA Pro MCP Servers

mrexodia/ida-pro-mcp (Most active):

git clone https://github.com/mrexodia/ida-pro-mcp
cd ida-pro-mcp
pip install -e .

MxIris-Reverse-Engineering/ida-mcp-server (473 stars):

git clone https://github.com/MxIris-Reverse-Engineering/ida-mcp-server

fdrechsler/mcp-server-idapro:

git clone https://github.com/fdrechsler/mcp-server-idapro

4. radare2-mcp (Official)

Repository: https://github.com/radareorg/radare2-mcp
Transport: stdio

# Install radare2 first
brew install radare2  # macOS
# or: apt install radare2  # Linux

git clone https://github.com/radareorg/radare2-mcp
cd radare2-mcp
pip install -e .

MCP Config:

{
  "mcpServers": {
    "radare2": {
      "command": "r2-mcp",
      "args": []
    }
  }
}

5. rand-tech/pcm (Multi-tool)

Repository: https://github.com/rand-tech/pcm
MCP for reverse engineering combining multiple backends.

Workflows

Basic Binary Analysis

1. Load binary into Ghidra/IDA
2. Start MCP server
3. Query: "List all functions" → list_functions
4. Query: "Decompile main" → decompile_function
5. Query: "Find xrefs to this address" → xrefs_to

Malware Analysis Pattern

1. get_program_info → Architecture, compiler, entry point
2. list_imports → Suspicious API calls (CreateRemoteThread, VirtualAlloc)
3. list_strings → C2 URLs, encryption keys, debug strings
4. search_functions "crypt" → Find encryption routines
5. decompile_function → Understand algorithm
6. auto_create_struct → Recover data structures

Vulnerability Research

1. list_functions → Function list with sizes
2. search_functions "parse|read|copy" → Input handlers
3. decompile_function → Find buffer operations
4. xrefs_to → Trace data flow
5. set_decompiler_comment → Annotate findings

CTF Binary Exploitation

1. get_program_info → Check protections (PIE, RELRO, canary)
2. list_functions → Find win/flag functions
3. decompile_function → Understand vulnerability
4. xrefs_from → Control flow analysis
5. list_segments → Memory layout for ROP

CLI Quick Reference

radare2 Commands

r2 binary                    # Open binary
aaa                          # Analyze all
afl                          # List functions
pdf @ main                   # Disassemble function
pdc @ main                   # Decompile (r2ghidra)
axt @ addr                   # Xrefs to
axf @ addr                   # Xrefs from
iz                           # List strings
ii                           # List imports

Ghidra Headless

analyzeHeadless /tmp/project ProjectName \
  -import binary.exe \
  -postScript ExportDecompilation.java \
  -deleteProject

Resources

r2con Speaker Repositories

Key repositories from r2con 2016-2025 speakers for process tree and binary analysis:

Core radare2 Team

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Sergi Alvarez | pancake | github.com/trufae | radare2 creator, r2pipe | | Anton Kochkov | xvilka | github.com/XVilka | UEFI, radeco decompiler | | Florian Märkl | thestr4ng3r | github.com/thestr4ng3r | Cutter/Rizin founder | | condret | condret | github.com/condret | ESIL core, SIOL I/O | | wargio | wargio | github.com/wargio | GSoC mentor | | maijin | maijin | github.com/maijin | r2 book maintainer |

ESIL & Symbolic Execution

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Chase Kanipe | alkalinesec | github.com/alkalinesec | ESILSolve symbolic exec | | Sylvain Pelissier | Pelissier_S | N/A | ESIL side-channel simulation | | Abel Valero | skuater | github.com/skuater | r2wars, ESIL plugins | | Gerardo García | killabytenow | github.com/killabytenow | ESIL limits |

Frida Integration (r2frida)

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Ole André Ravnås | oleavr | github.com/oleavr | Frida creator, NowSecure | | Giovanni Rocca | iGio90 | github.com/iGio90 | Dwarf debugger | | Grant Douglas | hexploitable | github.com/hexploitable | r2frida mobile | | Alex Soler | as0ler | N/A | r2frida Kung Fu, r2env |

Malware & Security Analysis

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Axelle Apvrille | cryptax | github.com/cryptax | Malware, r2ai, droidlysis | | Tim Blazytko | mr_phrazer | github.com/mrphrazer | MBA deobfuscation, msynth | | Julien Voisin | jvoisin | github.com/jvoisin | Security tooling | | cmatthewbrooks | cmatthewbrooks | N/A | Windows malware |

Signatures & Similarity

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Barton Rhodes | bmorphism | github.com/bmorphism | r2 Zignatures (2020) | | swoops | swoops | github.com/swoops | libc_zignatures, dr_pebber | | Fernando Dominguez | FernandoDoming | github.com/FernandoDoming | diaphora similarity |

Mobile Security (OWASP MSTG)

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Carlos Holguera | cpholguera | github.com/cpholguera | OWASP MSTG co-author | | Eduardo Novella | enovella | github.com/enovella | NowSecure, r2frida | | Francesco Tamagni | mrmacete | github.com/mrmacete | NowSecure iOS |

Decompilation & Analysis

| Speaker | Handle | Repository | Specialty | |---------|--------|------------|-----------| | Ahmed Abd El Mawgood | oddcoder | github.com/oddcoder | RAIR (Radare In Rust) | | Antide Petit | xarkes | github.com/xarkes | Cutter development | | Arnau Gamez | arnaugamez | github.com/arnaugamez | Side-channel attacks |

Key Tool Repositories

# radare2 ecosystem
git clone https://github.com/radareorg/radare2      # Core framework
git clone https://github.com/radareorg/r2ghidra     # Ghidra decompiler
git clone https://github.com/radareorg/radare2-mcp  # MCP server
git clone https://github.com/radareorg/esil-rs      # ESIL in Rust

# Rizin fork (Cutter backend)
git clone https://github.com/rizinorg/rizin         # Rizin framework
git clone https://github.com/rizinorg/cutter        # GUI
git clone https://github.com/rizinorg/rz-ghidra     # Ghidra integration

# Frida ecosystem
git clone https://github.com/frida/frida-core       # Core library
git clone https://github.com/frida/frida-gum        # Instrumentation
git clone https://github.com/frida/cryptoshark      # Code tracer

# Speaker tools
git clone https://github.com/swoops/libc_zignatures # libc signatures
git clone https://github.com/swoops/dr_pebber       # Fake TEB/PEB for ESIL
git clone https://github.com/mrphrazer/msynth       # MBA simplification
git clone https://github.com/cryptax/droidlysis     # Android analysis
git clone https://github.com/iGio90/Dwarf           # Frida debugger
git clone https://github.com/condret/r2premium      # r2 premium features

Process Tree Analysis Perspectives

Each speaker brings unique analysis perspective:

| Speaker | Focus | Process Tree Approach | |---------|-------|----------------------| | pancake | Core r2 | r2 -d pid://PID attach, sandbox escape surfaces | | xvilka | UEFI/radeco | Chromium shmem handles, decompile GPU process | | condret | ESIL | Each PID as ESIL context, trace IPC parsing | | Pelissier_S | Side-channel | Timing oracles in --time-ticks-* params | | alkalinesec | ESILSolve | Symbolic exec on sandbox constraints | | iGio90 | r2frida | frida -U -n 'process' + r2 integration | | thestr4ng3r | Cutter | GUI attach, graph shader pipeline | | cryptax | Malware | Persistence via flox-watchdog, LOLbins | | bmorphism | Zignatures | zg signature generation across renderer variants | | swoops | dr_pebber | Fake PEB structures for Windows emulation | | mr_phrazer | Deobfuscation | MBA expressions in obfuscated binaries |

Example Session

User: Analyze this binary for buffer overflow vulnerabilities

Agent:
1. Starting GhidraMCP server...
2. Loading binary and auto-analyzing...
3. [list_functions] Found 47 functions
4. [search_functions "strcpy|sprintf|gets"] Found 3 dangerous calls:
   - sub_401234: uses strcpy with stack buffer
   - sub_401456: sprintf without bounds
5. [decompile_function "sub_401234"] 
   
   void vuln_func(char *input) {
       char buffer[64];
       strcpy(buffer, input);  // VULNERABLE: no bounds check
       ...
   }

6. [xrefs_to "sub_401234"] Called from main+0x45
7. Vulnerability confirmed: Stack buffer overflow in sub_401234

End-of-Skill Interface

Integration with Gay.jl Colors

Assign deterministic colors to binary analysis domains:

using Gay

# Trit classification for RE tools
GHIDRA_TRIT = 0      # ZERO - foundational analysis
IDA_TRIT = 1         # PLUS - commercial/advanced  
RADARE2_TRIT = -1    # MINUS - lightweight/CLI

# Color functions by complexity
function color_function(cyclomatic_complexity::Int, seed::UInt64)
    Gay.color_at(cyclomatic_complexity, seed)
end

# Color control flow graph nodes
function color_cfg_node(block_id::Int, func_seed::UInt64)
    Gay.color_at(block_id, func_seed)
end

Related Skills

effective-topos: radare2 integration
mcp-tripartite: Binary analysis trit (-1 MINUS)
binsec: Symbolic execution tutorials
gay-mcp: Deterministic coloring for CFG visualization

Agent Skills: Reverse Engineering Skill

Install this agent skill to your local

Skill Files