ghidra-core-recon

Files (1)

• SKILL.md

SKILL.md (first lines)

# Ghidra Core Recon

Run a structured first pass that answers: what is this binary, what are the obvious hot spots, and where should deeper analysis begin?

## Workflow

1. Activate the relevant tools with `discover_tools` using a query like `ghidra reverse engineering functions strings imports exports`.
2. Open or select the target program/project.
3. Collect the following baseline inventory:
   - function list
   - imports and exports
   - strings
   - namespaces/classes if present
   - entry points and suspicious external references
4. Cluster findings into likely subsystems:
   - loader / startup
   - networking / crypto
   - UI / CLI
   - persistence / filesystem
   - anti-analysis / protection
5. Promote only the highest-value functions into the next phase.

## Tool Families to Prefer

- `ghidra_headless_function.list`
- `ghidra_headless_external.imports.list`
- `ghidra_headless_external.exports.list`
- `ghidra_headless_search.text`
- `ghidra_headless_symbol.list`
- `ghidra_headless_reference.to` and `ghidra_headless_reference.from`

If the active child server exposes GhidraMCP-style names instead, use the equivalent live tools:

- list functions / methods
- list imports / exports
- list strings
- get xrefs to / from

## Recon Questions

- Which imports reveal the platform surface or runtime stack?
- Which strings indicate protocols, file formats, paths, registry keys, mutexes, or command channels?
- Which functions are large, highly connected, or referenced by many call sites?
- Which exports define the public interface?
- Which entry paths appear responsible for unpacking, initialization, configuration, or dispatch?

## Deliverable Format

Produce a compact recon brief with:

1. Binary purpose hypothesis
2. Top 10 functions to inspect next
3. High-signal strings
4. High-signal imports/exports
5. Three likely pivots for deeper semantic recovery

From mattmre/EVOKORE-MCP-PUBLIC, MIT.

More from mattmre/EVOKORE-MCP-PUBLIC