agentsclimarketplace
Sign in

Scripting ghidra headless analysis

Skill meltedinhex/analyst-ai-pack/skills/scripting-ghidra-headless-analysis

Automates batch reverse engineering by generating Ghidra analyzeHeadless commands and post-analysis script skeletons to import, auto-analyze, and export results for many samples without the GUI. Activates for requests to script Ghidra headless analysis, batch-analyze samples with Ghidra, or generate an analyzeHeadless command and post-script.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill scripting-ghidra-headless-analysis

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.9 KB, 485 tokens by cl100k_base, as published. Nobody here has run it

Scripting Ghidra Headless Analysis

When to Use

  • You need to auto-analyze many samples (or re-run a consistent analysis) without the Ghidra GUI.
  • You want to generate the analyzeHeadless command and a post-script that exports functions, strings, or decompiled output.

Do not use this to run untrusted samples — Ghidra analyzes binaries statically and never executes them, but keep the import directory isolated. This skill prepares automation, it does not run the binary.

Prerequisites

  • A Ghidra installation (analyzeHeadless in support/) and the samples to import.

Safety & Handling

  • Ghidra does not execute the sample; still store imports in an isolated, defanged directory.

Workflow

Step 1: Generate the headless command

python scripts/analyst.py command --project /proj --name Batch --import ./samples --script export.py

Builds an analyzeHeadless invocation with project path, import directory, post-script, and common flags (-recursive, -overwrite, -deleteProject optional).

Step 2: Generate a post-analysis script skeleton

python scripts/analyst.py postscript --out export.py --emit functions,strings

Emits a Ghidra Python (Jython) script that iterates functions/strings and writes JSON next to the program.

Step 3: Run and collect

Execute the generated command, then aggregate the per-sample JSON exports.

Step 4: Review

Spot-check a few exports to confirm analysis completeness before scaling up.

Validation

  • The generated command references a valid project path, import dir, and existing post-script.
  • The post-script uses real Ghidra API calls (currentProgram, getFunctionManager).
  • Output JSON is produced per imported program.

Pitfalls

  • Forgetting -overwrite/-recursive, causing skipped or duplicate imports.
  • Jython 2 syntax constraints in post-scripts (no f-strings).
  • Project lock conflicts when running multiple headless jobs on one project.

References

What ships with it: 3 files

5.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.