# ghidra-headless

This skill drives Ghidra's headless analyzer to pull functions, strings, symbols and call graphs out of a binary. Useful when there is no source to read.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 507 installs · ★ 520
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills-curated/tree/HEAD/plugins/ghidra-headless/skills/ghidra-headless/SKILL.md
- Updated: 2026-07-14
- HTML: https://affpapa.org/en/nevibecode/skills/ghidra-headless

## What it does

The skill wraps Ghidra's `analyzeHeadless`: it imports a binary, runs auto-analysis, decompiles functions to C and writes the results to files. Inside are wrapper scripts and a set of Java exporters. `ExportAll.java` returns a summary, decompilation, function list, strings and functions matching security-relevant patterns in one pass. `ExportCalls.java` handles the call graph, `ExportSymbols.java` covers imports, exports and internal symbols.

You run it through `{baseDir}/scripts/ghidra-analyze.sh`. Flags: `-o` for the output directory, `-s` for a post-analysis script, `-p` for the processor, `--timeout` to cap time per file, `--no-analysis` to skip auto-analysis when you want speed. Firmware usually needs the architecture spelled out, e.g. `-p "ARM:LE:32:v7"`. The script looks for Ghidra in common install paths and reads `GHIDRA_HOME` when it sits somewhere else.

Ghidra itself and Java (OpenJDK 17+) have to be in place first. Check that before the first run, because the wrapper will not start without them. Decompiled output does not always match the original, so cross-reference it with disassembly. .NET assemblies and Java bytecode are out of scope here.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills-curated --skill ghidra-headless -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/ghidra-headless/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/ghidra-headless/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills-curated --skill ghidra-headless -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/ghidra-headless/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills-curated --skill ghidra-headless -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/ghidra-headless/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills-curated ghidra-headless
```

2. **Manually: put the files in place**
- File: `.github/skills/ghidra-headless/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills-curated --skill ghidra-headless -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills-curated --path plugins/ghidra-headless/skills/ghidra-headless
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/ghidra-headless/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills-curated --skill ghidra-headless -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills-curated/tree/HEAD/plugins/ghidra-headless/skills/ghidra-headless/SKILL.md

## When to use it
- decompile a binary into C pseudocode for review
- extract strings and symbols from an executable
- map a call graph to follow control flow
- triage a firmware image with no source
- batch-analyze several binaries and compare them

## Example prompts
- analyze ./unknown_binary with ghidra-headless and show me the summary
- decompile firmware.bin, architecture ARM:LE:32:v7
- grep the decompiled output for strcpy and sprintf calls

## Similar
- [ghidra](https://affpapa.org/en/nevibecode/skills/ghidra.md) — skill · 652 installs
- [analyzing-golang-malware-with-ghidra](https://affpapa.org/en/nevibecode/skills/analyzing-golang-malware-with-ghidra.md) — skill · 441 installs
- [binary-analysis-patterns](https://affpapa.org/en/nevibecode/skills/binary-analysis-patterns.md) — skill · 10900 installs
- [reverse-engineering](https://affpapa.org/en/nevibecode/skills/mohitmishra786-reverse-engineering.md) — skill · 350 installs
- [code-obfuscation-deobfuscation](https://affpapa.org/en/nevibecode/skills/code-obfuscation-deobfuscation.md) — skill · 4000 installs
- [reverse-engineer](https://affpapa.org/en/nevibecode/skills/reverse-engineer.md) — skill · 892 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md