{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/getting-started.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/index.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/tabs/settings-tab.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/tabs/symgraph-tab.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/tabs/query-tab.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/docs/tabs/actions-tab.md",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/build.gradle",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/src/main/java/ghidrassist/apiprovider/APIProvider.java",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/src/main/java/ghidrassist/tools/approval/ToolApprovalService.java",
    "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/LICENSE",
    "https://github.com/symgraph/GhidrAssist/releases/tag/2.2.0",
    "https://github.com/symgraph/GhidrAssistMCP/blob/b575acc1412cafcfd4dc9fedb7f99ecf219c68ab/README.md"
  ],
  "category": "agent-workflows",
  "description_en": "Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. Its tabs explain decompiled or disassembled functions with a security summary, keep persistent chats with context macros, MCP tool calling and an optional ReAct agent mode, propose function and variable renames, retypes and structures for review before they are applied, and build a semantic knowledge graph of functions, calls and security features with community detection, alongside Lucene retrieval over reference documents the analyst adds. A SymGraph tab imports and publishes names, types, graph data and documents through the hosted symgraph.ai service.",
  "description_zh": "由 GhidrAssistMCP 作者 Jason Tang 开发的 Ghidra 扩展，在 CodeBrowser 中加入多标签页的 GhidrAssist 窗口，借助大语言模型分析当前打开的程序。各标签页可解释反编译或反汇编后的函数并附安全摘要，保存支持上下文宏、MCP 工具调用和可选 ReAct 智能体模式的持久对话，为函数和变量提出重命名、类型修改及结构体建议并在审阅后应用，还能构建涵盖函数、调用关系和安全特征的语义知识图谱并进行社区检测，同时可借助 Lucene 检索分析人员添加的参考文档。SymGraph 标签页则通过托管的 symgraph.ai 服务导入和发布名称、类型、图谱数据及文档。",
  "entry_url": "https://awesomerea.org/resources/ghidrassist/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidrassist/",
  "evidence_url": "https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/README.md",
  "group": "agents",
  "id": "ghidrassist",
  "json_url": "https://awesomerea.org/resources/ghidrassist/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/ghidrassist/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidrassist/index.md",
  "name": "GhidrAssist",
  "name_zh": "GhidrAssist Ghidra 大模型辅助分析扩展",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "Latest release at review: 2.2.0, published 2026-05-29 with extension zips for Ghidra 12.0 and 12.1 Public; the reviewed master commit is three commits later and only updates model guidance and max-token handling. The README and getting-started guide state a Ghidra 11.0 minimum, but release zips are built per Ghidra version and recent ones cover only 12.x. Installation goes through File → Install Extensions, after which the plugin is enabled under CodeBrowser's File → Configure → Miscellaneous; source builds use Gradle with GHIDRA_INSTALL_DIR.",
    "Analysis needs at least one configured LLM provider. The reviewed provider types cover Anthropic, OpenAI, Azure OpenAI, Gemini and xAI APIs, OpenAI and Gemini subscription sign-in through OAuth, the local Claude Code CLI, a LiteLLM proxy, and local Ollama, LM Studio or Open WebUI endpoints; the documentation's provider tables also list an Anthropic OAuth type that the source does not define. Explanations, chats, Actions, agent runs and the graph's Semantic Analysis step send pseudocode or disassembly to the active provider, so only a local or self-hosted endpoint keeps code on the machine, while graph re-indexing and Security Analysis run without the model. Chats, explanations, graph data and feedback are kept in local SQLite databases and a Lucene index whose paths are set in Settings.",
    "Programs come from the user's own Ghidra projects. Actions suggestions are applied only for the rows the user checks. Chats can reach MCP servers over SSE or streamable HTTP or launch them over stdio; built-in tools read the current function and address, apply the Actions edits and query the semantic graph, and the README pairs the plugin with GhidrAssistMCP for decompilation, cross-reference and other Ghidra-specific tools. Calls to tools whose names do not look read-only wait for an allow-once, allow-for-session or deny decision, and this classification relies on tool-name keywords.",
    "The SymGraph tab looks up the program by SHA-256 without a key, but importing, publishing and uploading need a SymGraph API key, and publishing uploads the raw binary itself when the service does not already hold it. The repository has no tests or CI workflows.",
    "MIT, per LICENSE and the README; Ghidra, model providers and SymGraph keep their own terms. The repository moved from jtang613/GhidrAssist."
  ],
  "requirements_zh": [
    "审阅时最新版本为 2.2.0，于 2026-05-29 发布，提供适用于 Ghidra 12.0 和 12.1 Public 的扩展 zip；所审阅的 master 分支提交比它晚三个提交，仅更新了模型建议和最大 token 数处理。README 和入门指南写明最低需要 Ghidra 11.0，但发布的 zip 按 Ghidra 版本分别构建，近期版本只覆盖 12.x。通过 File → Install Extensions 安装后，需在 CodeBrowser 的 File → Configure → Miscellaneous 中启用插件；从源码构建使用 Gradle，并需设置 GHIDRA_INSTALL_DIR。",
    "分析需要至少配置一个大模型服务。所审阅的服务类型包括 Anthropic、OpenAI、Azure OpenAI、Gemini 和 xAI 的 API，通过 OAuth 登录的 OpenAI 与 Gemini 订阅，本地 Claude Code CLI，LiteLLM 代理，以及本地 Ollama、LM Studio 或 Open WebUI 端点；文档的服务类型表还列出了一个源码中并未定义的 Anthropic OAuth 类型。解释、对话、Actions、智能体运行以及图谱的 Semantic Analysis 步骤都会把伪代码或反汇编发送给当前服务，只有本地或自托管端点才能让代码不离开本机；图谱重建索引和 Security Analysis 则无需调用模型。对话、解释、图谱数据和反馈保存在本地 SQLite 数据库和 Lucene 索引中，路径可在 Settings 中设置。",
    "待分析程序来自用户自己的 Ghidra 项目。Actions 的建议只对用户勾选的行生效。对话可通过 SSE 或 streamable HTTP 连接 MCP 服务器，也可通过 stdio 启动；内置工具可读取当前函数和地址、执行 Actions 修改并查询语义图谱，README 建议搭配 GhidrAssistMCP 获取反编译、交叉引用等 Ghidra 专用工具。名称看起来并非只读的工具，调用前需等待用户选择允许一次、本会话允许或拒绝，而这种分类依赖工具名称中的关键词。",
    "SymGraph 标签页无需密钥即可按 SHA-256 查询程序，但导入、发布和上传需要 SymGraph API 密钥；若服务中尚无该二进制，发布时会上传原始二进制文件本身。仓库没有测试或 CI 工作流。",
    "依据 LICENSE 和 README 采用 MIT 许可；Ghidra、各模型服务和 SymGraph 仍受各自条款约束。仓库已从 jtang613/GhidrAssist 迁移。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/symgraph/GhidrAssist",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}