OGhidra: Bringing Large‑Language‑Model AI to Ghidra for Reverse Engineering

Tool Overview

OGhidra is an open‑source project that bridges large‑language‑model (LLM) back‑ends via Ollama to the Ghidra reverse‑engineering platform, enabling natural‑language interaction with binaries while keeping models local.

GitHub repository:

https://github.com/llnl/OGhidra

Core Features

Natural‑language analysis

Users can ask everyday English questions about functions, strings, imports, etc., e.g., “What does this function do?” “Does it have a buffer‑overflow vulnerability?” “Which functions call it?” “Show network‑related code”.

Automated workflow

Analyze current function : deep analysis of the selected function’s behavior.

Rename current function : AI suggests meaningful names based on analysis.

Batch rename all functions : supports rename‑only, smart enumeration, and full enumeration modes.

Analyze import table : identifies libraries and external dependencies.

Analyze strings : finds URLs, credentials, configuration data.

Generate report : produces a comprehensive security assessment report.

Local AI model (privacy‑first)

Ollama : runs LLMs on local hardware.

Cloud APIs : supports OpenAI, Google Gemini, Anthropic Claude, etc.

Custom endpoints : any OpenAI‑compatible API can be integrated.

Malware detection (12+ built‑in rules)

Anti‑analysis: PEB walking, dynamic API resolution, anti‑debug, anti‑VM.

Injection: local/remote process injection.

Persistence: registry and filesystem hooks.

Obfuscation: string encoding, API hashing.

Privilege escalation: token manipulation, UAC bypass.

Detected threats trigger warnings with MITRE ATT&CK mappings.

Intelligent enumeration

Structured metadata extraction (code lines, complexity, operation types).

Semantic‑search optimisation.

Multi‑vector support for precise retrieval.

Session save and restore.

Agentic loop

After each execution cycle the AI reviews results, decides whether to gather more information or optimise the analysis, and then produces the final response.

System Requirements

Python 3.12+

Ghidra 12.0.3 (recommended); also supports 11.0.3, 11.3.2, 12.0.2

Java 21 (required to build Ghidra 12.0.3 extensions)

Ollama (optional, for local model deployment)

Recommended model: gemma3:27b (~20 GB RAM) with nomic-embed-text for RAG embeddings. Alternative large models: gpt-oss:120b, devstral-2:123b (~80 GB RAM).

Installation & Configuration

Step 1: Clone the repository

git clone https://github.com/llnl/OGhidra.git
cd OGhidra

Step 2: Install dependencies

# Recommended
uv sync
# Or
pip install -r requirements.txt

Step 3: Configure environment

cp .env.example .env
# Edit .env to set the AI provider

Local model (Ollama) example:

LLM_PROVIDER=ollama
OLLAMA_BASE_URL=http://localhost:11434/
OLLAMA_MODEL=gemma3:27b
OLLAMA_EMBEDDING_MODEL=nomic-embed-text

Cloud API (Google Gemini) example:

LLM_PROVIDER=external
EXTERNAL_PROVIDER=google
EXTERNAL_API_KEY=YOUR_API_KEY
EXTERNAL_MODEL=gemini-3.1-flash-lite-preview

Step 4: Build the Ghidra plugin

# Set Ghidra installation path
export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.0.3_PUBLIC
chmod +x build_ghidra_plugin.sh
./build_ghidra_plugin.sh

Resulting extension zip is placed in OGhidraMCP/dist/.

Step 5–7: Install, enable, and run the plugin

Open Ghidra → File → Install Extensions .

Click Add Extension and browse to OGhidraMCP/dist/.

Select the zip, restart Ghidra.

Open a project, then File → Configure → Enable Developer → OGhidraMCP .

The server starts at http://localhost:8080/methods (CodeBrowser window must be open).

Pull the AI model locally, e.g. ollama pull gemma3:27b and ollama pull nomic-embed-text.

Run the UI: uv run main.py --ui or the interactive CLI: uv run main.py --interactive.

Usage Examples

Analyzing a suspicious binary

Load the binary in Ghidra and open CodeBrowser.

Enable the OGhidraMCP plugin.

Start OGhidra with uv run main.py --ui.

Select the “malware” task mode.

Click “Rename All Functions” → “Smart Enumeration”.

Ask questions such as “Which functions are high‑risk?” or “Show network‑related code”.

Generating a security report

Click “Generate Report” in the GUI. The report includes an executive summary, renamed function list, security analysis (high‑risk functions, detected patterns), import table analysis, string analysis, and remediation suggestions.

Investigating a specific function

Navigate to the target function in Ghidra.

Click “Analyze Current Function”.

Ask follow‑up questions such as “What does this function do?”, “Does it have a buffer‑overflow vulnerability?”, “Which other functions call it?”.

Dual Backend Support

MCP : integrates with the GhidraMCP server and requires the Ghidra client at runtime.

PyGhidra : headless analysis without the Ghidra client, suitable for automation.

Example to select the PyGhidra backend:

uv run main.py --ui --ghidra-backend=pyghidra --pyghidra-binary=/path/to/binary

Advanced Features

RAG (Retrieval‑Augmented Generation)

Enable vector embeddings for semantic search:

RESULT_CACHE_ENABLED=true
TIERED_CONTEXT_ENABLED=true

Context optimisation

CURRENT_LOOP_MAX_CHARS=2000   # Latest loop: full details
PREV_LOOP_MAX_CHARS=400       # Previous loop: summary
OLDER_LOOP_MAX_CHARS=100      # Older loops: references only

Logging

LLM_LOGGING_ENABLED=true
LLM_LOG_FILE=logs/llm_interactions.log
LLM_LOG_FORMAT=json

Troubleshooting

Ghidra connection issues : curl http://localhost:8080/methods Ollama connection issues :

ollama list
curl http://localhost:11434/api/tags
ollama serve  # restart Ollama service

Empty response / context overflow :

CONTEXT_BUDGET=50000
COMPACTION_ENABLED=true
COMPACTION_THRESHOLD=0.75