reverse-engineering-assistant

概述

ReVa 是一个成熟的 Ghidra 扩展，实现了模型上下文协议（MCP），使 AI 语言模型能够与 Ghidra 的逆向工程能力交互。它采用工具驱动方法，为 LLM 在逆向工程任务中的有效使用设计专用功能。该服务器通过提供带有强化链接和小型关键片段来减少上下文腐化和幻觉，并报告额外上下文以引导模型探索二进制文件。

试试问 AI

装完之后，这里有 3 个你可以让 AI 做的事：

• examine_programs

  Examine programs in the project and explain relationships

  试试:Examine the programs in this project and explain the relationship between the main binary and the shared libraries
• find_interesting_strings

  Find interesting strings in the program

  试试:What are the interesting strings in this program?
• analyze_encryption

  Analyze program for encryption usage

  试试:Does this program use encryption? Write a markdown report on the encryption and where it is used
• generate_class_diagram

  Generate a class diagram using plantuml syntax

  试试:Draw a class diagram using plantuml syntax
• analyze_main

  Start from main and examine the program in detail

  试试:Start from main, examine the program in detail. Rename variables as you go and provide a summary of the program
• explain_segment

  Explain the purpose of a program segment

  试试:Explain the purpose of the `__mod_init` segment
• analyze_function

  Analyze a function at a specific address

  试试:What does the function at address 0x80000 do?
• analyze_mmap

  Analyze the mmap function behavior

  试试:What does `mmap` return?
• create_ctf_script

  Create a pwntools script for CTF problems

  试试:This is a CTF problem. Write a pwntools script to get the flag
• binary_triage

  Perform binary triage to identify key components

  试试:Perform a binary triage to identify the main functionality
• deep_analysis

  Perform deep analysis of the binary

  试试:Perform a deep analysis of this binary to identify key algorithms
• cryptography_analysis

  Analyze cryptographic implementations

  试试:Analyze the cryptography used in this binary

可对比工具

安装

export GHIDRA_INSTALL_DIR=/path/to/ghidra
g radle install

claude mcp add --scope user --transport http ReVa -- http://localhost:8080/mcp/message

{
  "mcp": {
    "servers": {
      "ReVa Assistant": {
        "type": "http",
        "url": "http://localhost:8080/mcp/message"
      }
    }
  }
}

reverse-engineering-assistant 对比