Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Integration

Kong

Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.

Targets
Binary
Category
Independent agent workflows
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • The reviewed main commit is 25 commits after the v0.2.2 release of 2026-03-18, which matches kong-re 0.2.2 on PyPI; those later commits add an unreleased Rust kong-ml crate and XDA model-training scripts that the README does not describe. Kong needs Python 3.11+ with uv, a local Ghidra installation and JDK 21+, which it detects or reads from GHIDRA_INSTALL_DIR and JAVA_HOME. Its commands are kong setup, analyze, info and eval, with a Textual interface or --headless output.
  • Analysis needs an Anthropic or OpenAI API key, or an OpenAI-compatible endpoint passed with --base-url, and sends each function’s decompilation with its cross-references, strings and neighbouring signatures to that service; Kong tracks token use and estimated cost per model. Users supply the binary to analyse, and the repository ships no target binaries.
  • The README rates its confidence by architecture and source language: high for C and C++ on x86, x86-64, ARM and AArch64, medium or low for Go, Rust, MIPS and PowerPC, and lower as binaries grow. Obfuscation is detected by patterns in the decompiled text before the deobfuscation pass. BENCHMARKS.md reports a single run with claude-opus-4-6 on a stripped liblzma.so.5.4.1 from the backdoored XZ Utils 5.6.1 (CVE-2024-3094): 355 of 396 queued functions analysed in 15 minutes for $6.63, with the five core implant functions found at model-reported confidence of 90–95%. These are author results.
  • The kong eval command scores analysis.json against ground-truth source, using word-based Jaccard matching for names and signature-component scoring for types; no evaluation results are published. CI runs the pytest suite on Python 3.11 to 3.14 for pull requests.
  • Apache-2.0 per LICENSE and pyproject.toml; Ghidra, model services and analysed binaries keep their own terms. The README names KeygraphHQ’s Shannon web-pentesting pipeline as its inspiration.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · amruth-sn/kong · Revision 8c4ee4b
  2. BENCHMARKS.md GitHub · amruth-sn/kong · Revision 8c4ee4b
  3. pyproject.toml GitHub · amruth-sn/kong · Revision 8c4ee4b
  4. kong/__main__.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  5. kong/agent/deobfuscator.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  6. kong/llm/tools.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  7. kong/evals/metrics.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  8. .github/workflows/ci.yml GitHub · amruth-sn/kong · Revision 8c4ee4b
  9. LICENSE GitHub · amruth-sn/kong · Revision 8c4ee4b
  10. https://github.com/amruth-sn/kong/releases/tag/v0.2.2
  11. https://pypi.org/project/kong-re/0.2.2/
  12. https://github.com/amruth-sn/kong/compare/v0.2.2...8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2

More in Agents and MCP

All 87 entries in Agents and MCP

↑↓ move↵ open⌘↵ new tab