/decompile

Ghidra headless decompilation with function analysis

ogrodev@ogrodev

GitHub

From plugin

fsociety

2063 skills7 agents63 commands

Install

$ npx -y skills add ogrodev/fsociety --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/decompile

Context preview

What this command does when you run it.

Ghidra headless decompilation with function analysis

Command definition

decompile.md

description: Ghidra headless decompilation with function analysis
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep
argument-hint: <path-to-binary> [--function <name>]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Ghidra Headless Decompilation

Parse `$ARGUMENTS` for the binary path and optional `--function <name>` flag.

Pre-flight

1. Verify Ghidra is installed:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/tool-checker.js" check ghidra

If missing, inform user and suggest: `sudo apt install -y ghidra`

2. Locate `analyzeHeadless`:

   find /opt/ghidra* /usr/share/ghidra -name analyzeHeadless 2>/dev/null | head -1

Step 1 — Create Project Directory

mkdir -p extracted/ghidra-projects

Step 2 — Run Headless Analysis

analyzeHeadless extracted/ghidra-projects ProjectName \
  -import <binary> \
  -overwrite \
  -analysisTimeoutPerFile 300 \
  -postScript ExportDecompilation.java \
  -scriptPath /path/to/scripts

If ExportDecompilation script is not available, use radare2 as fallback:

r2 -qc 'aaa; pdd @main' <binary>      # Decompile main
r2 -qc 'aaa; afl~[0]' <binary>        # List function addresses
r2 -qc 'aaa; pdd @<addr>' <binary>    # Decompile specific function

Step 3 — Targeted Decompilation

If `--function <name>` was specified:

r2 -qc 'aaa; s <name>; pdd' <binary>

Step 4 — Key Function Identification

Focus on functions that reference:

**Network**: `WSAStartup`, `connect`, `send`, `recv`, `InternetOpen`, `HttpSendRequest`
**File I/O**: `CreateFile`, `WriteFile`, `DeleteFile`, `CopyFile`
**Process**: `CreateProcess`, `VirtualAlloc`, `WriteProcessMemory`, `CreateRemoteThread`
**Registry**: `RegCreateKey`, `RegSetValue`, `RegOpenKey`
**Crypto**: `CryptEncrypt`, `CryptDecrypt`, `BCryptGenRandom`
**Anti-Debug**: `IsDebuggerPresent`, `NtQueryInformationProcess`, `CheckRemoteDebuggerPresent`