ghidra-headless — Claude Code skill: reverse binaries without the GUI
This skill drives Ghidra's headless analyzer to pull functions, strings, symbols and call graphs out of a binary. Useful when there is no source to read.
npx skills add trailofbits/skills-curated --skill ghidra-headless -a claude-codeWhat ghidra-headless does
The skill wraps Ghidra's analyzeHeadless: it imports a binary, runs auto-analysis, decompiles functions to C and writes the results to files. Inside are wrapper scripts and a set of Java exporters. ExportAll.java returns a summary, decompilation, function list, strings and functions matching security-relevant patterns in one pass. ExportCalls.java handles the call graph, ExportSymbols.java covers imports, exports and internal symbols.
You run it through {baseDir}/scripts/ghidra-analyze.sh. Flags: -o for the output directory, -s for a post-analysis script, -p for the processor, --timeout to cap time per file, --no-analysis to skip auto-analysis when you want speed. Firmware usually needs the architecture spelled out, e.g. -p "ARM:LE:32:v7". The script looks for Ghidra in common install paths and reads GHIDRA_HOME when it sits somewhere else.
Ghidra itself and Java (OpenJDK 17+) have to be in place first. Check that before the first run, because the wrapper will not start without them. Decompiled output does not always match the original, so cross-reference it with disassembly. .NET assemblies and Java bytecode are out of scope here.
What it helps with
- decompile a binary into C pseudocode for review
- extract strings and symbols from an executable
- map a call graph to follow control flow
- triage a firmware image with no source
- batch-analyze several binaries and compare them
Example prompts for the agent
- analyze ./unknown_binary with ghidra-headless and show me the summary
- decompile firmware.bin, architecture ARM:LE:32:v7
- grep the decompiled output for strcpy and sprintf calls
How to install ghidra-headless
1Skills CLI (Vercel)
npx skills add trailofbits/skills-curated --skill ghidra-headless -a claude-code2Manually: put the files in place
~/.claude/skills/ghidra-headless/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/ghidra-headless/
1Skills CLI (Vercel)
npx skills add trailofbits/skills-curated --skill ghidra-headless -a codex2Manually: put the files in place
.agents/skills/ghidra-headless/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills-curated --skill ghidra-headless -a cursor2Manually: put the files in place
.cursor/skills/ghidra-headless/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills-curated ghidra-headless2Manually: put the files in place
.github/skills/ghidra-headless/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills-curated --skill ghidra-headless -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills-curated --path plugins/ghidra-headless/skills/ghidra-headlessManually: put the files in place
.devin/skills/ghidra-headless/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills-curated --skill ghidra-headless -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about ghidra-headless
How do I install ghidra-headless in Claude?
Run npx skills add trailofbits/skills-curated --skill ghidra-headless -a claude-code. The skill file then lands at ~/.claude/skills/ghidra-headless/SKILL.md.
What does ghidra-headless do?
It runs Ghidra's headless analyzer and exports decompiled C, functions, strings, symbols and a call graph from a binary. No GUI involved.
What do I need before using it?
Ghidra installed and Java (OpenJDK 17+) available. If Ghidra lives outside the usual paths, set the GHIDRA_HOME environment variable.
