Individual skill
reverser-ghidra
Analyze an authorized binary through the active Ghidra runtime and verify navigation in the mirrored GUI.
packages/decepticon/decepticon/skills/standard/reverser/ghidra/SKILL.md
Source commit df879550544d36b6b1e69062f05adae28537adf2
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 8, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 6,567
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- cybersecurity Repository topic
- hacking Repository topic
- langchain Repository topic
- langgraph Repository topic
- llm Repository topic
- generative-ai Repository topic
- pentesting Repository topic
- pentest Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Ghidra analysis
## Hosted engagement
The isolated E2B REA/Ghidra companion is the analysis runtime and the Run tab can mirror its CodeBrowser. The engagement agent discovers a binary under `/workspace` and opens it through `rea_open_binary`; the product pins its source digest and analysis run. Opening the viewer alone does not imply that a binary was analyzed.
Use `rea_find_tools` with a task-specific query to inspect the available native name and schema before calling it. REA provides a source-bound Evidence result and marks unresolved or derived observations. Do not infer tool availability from the full package catalog.
Address-specific calls can navigate the real Listing and Decompiler through the GUI mirror. Inspect the GUI result before saying the operator saw the location. If following failed, keep the REA analysis result and report the lack of visual confirmation separately. Record the binary hash, Evidence ID, and address with every finding.
## Standalone OSS runtime
A standalone run starts the optional `reversing` workload and uses `rea_status`, `rea_find_tools(binary_path, query)`, and `rea_call_tool(binary_path, name, arguments_json)`. The binary must be under the engagement's `/workspace`; no separate upload is needed. The sidecar pins the bytes and persists the original Evidence bundle under `/workspace/.analysis/rea/<runId>/` before delivering a successful result. The complete available Ghidra-session tool set is pageable through `rea_find_tools`. Legacy headless tools remain a fallback when REA is unavailable; standalone output does not imply a hosted GUI update.