Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.

Ghidra Headless Analysis Skill Perform automated reverse engineering using Ghidra's analyzeHeadless tool. Import binaries, run analysis, decompile to C code, and extract useful information. Quick Reference Task Command Full analysis with all exports ghidra analyze.sh s ExportAll.java o ./output binary Decompile to C code ghidra analyze.sh s ExportDecompiled.java o ./output binary List functions ghidra analyze.sh s ExportFunctions.java o ./output binary Extract strings ghidra analyze.sh s ExportStrings.java o ./output binary Get call graph ghidra analyze.sh s ExportCalls.java o ./output binary Export symbols ghidra analyze.sh s ExportSymbols.java o ./output binary Find Ghidra path find ghidra.sh Prerequisites Ghidra must be installed. On macOS: brew install cask ghidra Java (OpenJDK 17+) must be available The skill automatically locates Ghidra in common installation paths. Set GHIDRA HOME environment variable if Ghidra is installed in a non standard location. Main Wrapper Script Wrapper that handles project creation/cleanup and provides a simpler interface to analyzeHeadless . Options: o, output <dir Output directory for results (default: current dir) s, script <name Post analysis script to run (can be repeated) a, script args <args Arguments for the last specified script script path <path Additional script search path p, processor <id Processor/architecture (e.g., x86:LE:32:default ) c, cspec <id Compiler spec (e.g., gcc , windows ) no analysis Skip auto analysis (faster, but less info) timeout <seconds Analysis timeout per file keep project Keep the Ghidra project after analysis project dir <dir Directory for Ghidra project (default: /tmp) project name <name Project name (default: auto generated) v, verbose Verbose output Built in Export Scripts ExportAll.java Comprehensive export runs all other exports and creates a summary. Best for initial analysis. Output files: {name} summary.txt Overview: architecture, memory sections, function counts {name} decompiled.c All functions decompiled to C {name} functions.json Function list with signatures and calls {name} strings.txt All strings found {name} interesting.txt Functions matching security relevant patterns ExportDecompiled.java Decompile all functions to C pseudocode. Output: {name} decompiled.c ExportFunctions.java Export function list as JSON with addresses, signatures, parameters, and call relationships. Output: {name} functions.json ExportStrings.java Extract all strings (ASCII, Unicode) with addresses. Output: {name} strings.json ExportCalls.java Export function call graph showing caller/callee relationships. Output: {name} calls.json Includes: Full call graph Potential entry points (functions with no callers) Most frequently called functions ExportSymbols.java Export all symbols: imports, exports, and internal symbols. Output: {name} symbols.json Common Workflows Analyze an Unknown Binary Analyze Firmware Quick Function Listing Find Specific Patterns Analyze Multiple Binaries Architecture/Processor IDs Common processor IDs for the p option: Architecture Processor ID x86 32 bit x86:LE:32:default x86 64 bit x86:LE:64:default ARM 32 bit ARM:LE:32:v7 ARM 64 bit AARCH64:LE:64:v8A MIPS 32 bit MIPS:BE:32:default or MIPS:LE:32:default PowerPC PowerPC:BE:32:default Find all available processors: Troubleshooting Ghidra Not Found Analysis Takes Too Long Out of Memory Edit the analyzeHeadless script or set: Wrong Architecture Detected Explicitly specify the processor: Tips 1. Start with ExportAll.java It gives you everything and the summary helps orient you 2. Check the interesting.txt file It highlights security relevant functions automatically 3. Use jq for JSON parsing The JSON exports are designed to be machine readable 4. Decompilation isn't perfect Use it as a guide, cross reference with disassembly 5. Large binaries take time Use timeout and consider no analysis for quick scans