rz-ghidra

rz-ghidra これは、Rizin用のGhidraデコンパイラおよびSleighディスアセンブラの統合です。 Ghidraのデコンパイラ部分のみに基づいており、すべてC++で書かれているため、Ghidra自体は必要なく、プラグインは自己完結型でビルドできます。 このプロジェクトは、もともとradare2向けにr2con 2019でCutterトークの一部として発表されました：https://youtu.be/eHtMiezr7l8?t=950 使用方法 root@kitploit: Usage: pdg Native Ghidra decompiler plugin | pdg...

Callisto

Callisto インテリジェントな自動バイナリ脆弱性解析ツール デモ： Callisto は、インテリジェントな自動バイナリ脆弱性解析ツールです。その目的は、提供されたバイナリを自律的に逆コンパイルし、出力された疑似コードを繰り返し解析して、その疑似Cコード内の潜在的なセキュリティ脆弱性を探すことです。Ghidra のヘッドレスデコンパイラが、バイナリの逆コンパイルと解析部分を駆動します。疑似コード解析はまず Semgrep SAST ツールによって実行され、その後 GPT-3.5-Turbo に転送されて、Semgrep の発見内容の検証と、追加の脆弱性の可能性の特定が行われます。...

ghidrecomp

Ghidrecomp - 命令行 Ghidra 反编译器 关于 这个 Python 命令行工具会反编译二进制文件中的所有函数，并将它们以单独的 C 文件形式写入目录：mermaid flowchart LR afilename -- bghidrecomp a2Symbol Server -- b b -- eGhidra Project Files b -- output subgraph output subgraph decompilations direction LR ifunc1.c hfunc2.c ffuncB.c end subgraph callgraphs...

CVE-2026-52757

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereference...

CVE-2026-52757

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereference...

CVE-2026-52757

Ghidra before 12.1 is affected by a heap-use-after-free in the decompiler’s HighVariable::merge() during the variable merging pass. The issue can be triggered by a crafted binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, leading to reads/writes of ...

CVE-2026-52757 Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereference...

EUVD-2026-36016

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereference...

Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery

Decompilation -- recovering source code from compiled binaries -- is essential for security analysis, malware reverse engineering, and legacy software maintenance. However, existing decompilers produce code that often fails to compile or execute correctly, limiting their practical utility. We...

Talos tools of the trade

By Andrea Marcelli and Holger Unterbrink. If you're looking for something to keep you busy while we're all stuck inside during the holidays, Cisco Talos has a few tools for you you can play with in the coming days and weeks. We recently updated GhIDA to work with the latest version of IDA and we...

GhIDA: Ghidra decompiler for IDA Pro

By Andrea Marcelli Executive Summary Cisco Talos is releasing two new tools for IDA Pro: GhIDA and Ghidraaas. GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in the IDA workflow, giving users the ability to rename and highlight symbols and improved navigation and comments. GhIDA...