/decompile

description: Ghidra headless decompilation with function analysis
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep
argument-hint: <path-to-binary> [--function <name>]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Ghidra Headless Decompilation

Parse `$ARGUMENTS` for the binary path and optional `--function <name>` flag.

Pre-flight

1. Verify Ghidra is installed:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/tool-checker.js" check ghidra

If missing, inform user and suggest: `sudo apt install -y ghidra`

2. Locate `analyzeHeadless`:

   find /opt/ghidra* /usr/share/ghidra -name analyzeHeadless 2>/dev/null | head -1

Step 1 — Create Project Directory

mkdir -p extracted/ghidra-projects

Step 2 — Run Headless Analysis

analyzeHeadless extracted/ghidra-projects ProjectName \
  -import <binary> \
  -overwrite \
  -analysisTimeoutPerFile 300 \
  -postScript ExportDecompilation.java \
  -scriptPath /path/to/scripts

If ExportDecompilation script is not available, use radare2 as fallback:

r2 -qc 'aaa; pdd @main' <binary>      # Decompile main
r2 -qc 'aaa; afl~[0]' <binary>        # List function addresses
r2 -qc 'aaa; pdd @<addr>' <binary>    # Decompile specific function

Step 3 — Targeted Decompilation

If `--function <name>` was specified:

r2 -qc 'aaa; s <name>; pdd' <binary>

Step 4 — Key Function Identification

Focus on functions that reference:

• **Network**: `WSAStartup`, `connect`, `send`, `recv`, `InternetOpen`, `HttpSendRequest`
• **File I/O**: `CreateFile`, `WriteFile`, `DeleteFile`, `CopyFile`
• **Process**: `CreateProcess`, `VirtualAlloc`, `WriteProcessMemory`, `CreateRemoteThread`
• **Registry**: `RegCreateKey`, `RegSetValue`, `RegOpenKey`
• **Crypto**: `CryptEncrypt`, `CryptDecrypt`, `BCryptGenRandom`
• **Anti-Debug**: `IsDebuggerPresent`, `NtQueryInformationProcess`, `CheckRemoteDebuggerPresent`

Step 5 — Save Output

Save decompiled code to `extracted/decompiled-<binary-name>/`. Generate summary with key functions annotated.