{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/BENCHMARKS.md",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/pyproject.toml",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/kong/__main__.py",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/kong/agent/deobfuscator.py",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/kong/llm/tools.py",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/kong/evals/metrics.py",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/.github/workflows/ci.yml",
    "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/LICENSE",
    "https://github.com/amruth-sn/kong/releases/tag/v0.2.2",
    "https://pypi.org/project/kong-re/0.2.2/",
    "https://github.com/amruth-sn/kong/compare/v0.2.2...8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2"
  ],
  "category": "agent-workflows",
  "description_en": "Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.",
  "description_zh": "命令行分析流水线，通过 PyGhidra 在进程内运行 Ghidra，请 Claude、OpenAI 或兼容 OpenAI 接口的模型为去符号二进制文件中的函数、类型和参数命名，并沿调用图自底向上处理，使调用者能看到已命名的被调函数。它先匹配已知库函数与密码算法特征，再把反编译结果疑似混淆的函数交给可调用工具、借助 z3 化简的去混淆环节，将结果应用到 Ghidra 程序中，并导出带注释的 C 代码和 analysis.json 文件。README 称其为首个智能体逆向工程师，这一说法以及其中的准确性和成本数据均为作者陈述。",
  "entry_url": "https://awesomerea.org/resources/kong-agentic-reverse-engineer/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/kong-agentic-reverse-engineer/",
  "evidence_url": "https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/README.md",
  "group": "agents",
  "id": "kong-agentic-reverse-engineer",
  "json_url": "https://awesomerea.org/resources/kong-agentic-reverse-engineer/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/kong-agentic-reverse-engineer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/kong-agentic-reverse-engineer/index.md",
  "name": "Kong",
  "name_zh": "Kong：基于 Ghidra 的大模型去符号二进制分析流水线",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "The reviewed main commit is 25 commits after the v0.2.2 release of 2026-03-18, which matches kong-re 0.2.2 on PyPI; those later commits add an unreleased Rust kong-ml crate and XDA model-training scripts that the README does not describe. Kong needs Python 3.11+ with uv, a local Ghidra installation and JDK 21+, which it detects or reads from GHIDRA_INSTALL_DIR and JAVA_HOME. Its commands are kong setup, analyze, info and eval, with a Textual interface or --headless output.",
    "Analysis needs an Anthropic or OpenAI API key, or an OpenAI-compatible endpoint passed with --base-url, and sends each function’s decompilation with its cross-references, strings and neighbouring signatures to that service; Kong tracks token use and estimated cost per model. Users supply the binary to analyse, and the repository ships no target binaries.",
    "The README rates its confidence by architecture and source language: high for C and C++ on x86, x86-64, ARM and AArch64, medium or low for Go, Rust, MIPS and PowerPC, and lower as binaries grow. Obfuscation is detected by patterns in the decompiled text before the deobfuscation pass. BENCHMARKS.md reports a single run with claude-opus-4-6 on a stripped liblzma.so.5.4.1 from the backdoored XZ Utils 5.6.1 (CVE-2024-3094): 355 of 396 queued functions analysed in 15 minutes for $6.63, with the five core implant functions found at model-reported confidence of 90–95%. These are author results.",
    "The kong eval command scores analysis.json against ground-truth source, using word-based Jaccard matching for names and signature-component scoring for types; no evaluation results are published. CI runs the pytest suite on Python 3.11 to 3.14 for pull requests.",
    "Apache-2.0 per LICENSE and pyproject.toml; Ghidra, model services and analysed binaries keep their own terms. The README names KeygraphHQ’s Shannon web-pentesting pipeline as its inspiration."
  ],
  "requirements_zh": [
    "所审阅的 main 提交位于 2026-03-18 发布的 v0.2.2 之后 25 个提交，该版本与 PyPI 上的 kong-re 0.2.2 一致；之后的提交加入了尚未发布的 Rust kong-ml crate 和 XDA 模型训练脚本，README 未作介绍。Kong 需要 Python 3.11+ 与 uv、本地安装的 Ghidra 以及 JDK 21+，它会自动检测，也可从 GHIDRA_INSTALL_DIR 和 JAVA_HOME 读取。命令包括 kong setup、analyze、info 和 eval，可使用 Textual 界面或 --headless 输出。",
    "分析需要 Anthropic 或 OpenAI API 密钥，或通过 --base-url 指定兼容 OpenAI 接口的端点，并会把每个函数的反编译结果连同其交叉引用、字符串和相邻函数签名发送给该服务；Kong 按模型统计 token 用量和估算费用。待分析的二进制文件由使用者自备，仓库不附带目标二进制文件。",
    "README 按架构和源语言给出可信度：x86、x86-64、ARM 和 AArch64 上的 C 与 C++ 为高，Go、Rust、MIPS 和 PowerPC 为中或低，且二进制越大可信度越低。混淆是在去混淆环节之前按反编译文本中的模式检测的。BENCHMARKS.md 报告了一次使用 claude-opus-4-6 的运行，对象是来自被植入后门的 XZ Utils 5.6.1、已去符号的 liblzma.so.5.4.1（CVE-2024-3094）：15 分钟内花费 6.63 美元分析了排队的 396 个函数中的 355 个，并以模型自报 90–95% 的置信度找出五个核心植入函数。这些均为作者结果。",
    "kong eval 命令以真实源码为基准为 analysis.json 打分，名称采用基于词的 Jaccard 匹配，类型按签名组成部分评分；仓库未公开评测结果。CI 在拉取请求上以 Python 3.11 至 3.14 运行 pytest 测试套件。",
    "LICENSE 与 pyproject.toml 标明采用 Apache-2.0；Ghidra、模型服务及被分析的二进制文件各有其条款。README 称其灵感来自 KeygraphHQ 的 Shannon 网页渗透测试流水线。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/amruth-sn/kong",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}