sharem

SHAREM Welcome to SHAREM! SHAREM was presented at DEFCON 31 in "Game-Changing Advances in Windows Shellcode Analysis" and Black Hat USA Arsenal. A companion Ghidra plugin was made available separately from Trellix, courtesy of Max Kersten. Thus, you can extend the power of SHAREM to Ghidra, if yo...

GhidrAssist

GhidrAssist Author: Jason Tang An advanced LLM-powered plugin for interactive reverse engineering assistance in Ghidra. Description GhidrAssist integrates Large Language Models LLMs into Ghidra to provide intelligent assistance for binary exploration and reverse engineering. It supports any OpenA...

CodeCut

CodeCut Plugin for Ghidra Ghidra Plugin for DeepCut / CodeCut GUI Theory of Operation CodeCut allows a user to assign functions to object files in Ghidra, and then interact with the binary at the object file level. Functions are assigned to object files by setting the Namespace field in the Ghidr...

dragondance

Dragon Dance What is that? Dragon Dance is a plugin for Ghidra to get visualize and manipulate the binary code coverage data. Coverage data can be imported from the multiple coverage sources. For now the plugin supports Dynamorio and Intel Pin binary instrumentation tools. Dynamorio has its own...

bn-uefi-helper

bn-uefi-helper ATENCIÓN: Este plugin ha sido obsoleto. Consulta EFI Resolver Descripción Plugin auxiliar para analizar firmware UEFI. Este plugin incluye las siguientes características: Aplicar el prototipo correcto a la función de punto de entrada Corregir segmentos para que todos sean RWX y...

efiSeek

efiSeek for Ghidra About The analyzer automates the process of researching EFI files, helps to discover and analyze well-known protocols, smi handlers, etc. Features Finds known EFI GUID's Identifies protocols located with LOCATEPROTOCOL function Identifies functions used as the NOTIFY function...

ghidra-mtk-loader

Loader md1img di MediaTek per Ghidra Loader Ghidra per il formato immagine firmware modem md1img di MediaTek. Attualmente è supportato solo il firmware basato su nanoMIPS, ma le funzionalità di base potrebbero comunque funzionare se si sceglie manualmente un'architettura diversa ad es. MIPS duran...

GhidraEmu

GhidraEmu This experimental Ghidra plugin allows you to easily deal with native pcode emulation. No scripts are needed anymore, just use it directly from Ghidra. It can be particularly useful for working with a variety of exotic processors that are not supported by common emulators. If the...

copy-as-yara

Copy as YARA Author: alden Copy disassembly nicely formatted for YARA rules. Description: This is a really simple plugin that allows you to copy disassembly in a way that can be used in YARA rules. You have the option to either copy the assembly code as it is or use address wildcarding to create...

vmprotect-research

VMP 디버추얼라이저 - 프로덕션 릴리스 VMProtect 1.x, 2.x, 3.x 버전을 지원하는 범용 디버추얼라이저. 독립형 CLI 도구 + Ghidra 플러그인. 상태: ✅ 프로덕션 준비 | 검증: 22/22 샘플 100% | 범위: VMP ≤3.6 3.7+는 리버스 엔지니어링 필요 특징 멀티 버전 지원: VMP 1.x, 2.x, 3.x 1.1 → 3.10.5 버전 탐지: 휴리스틱을 통한 자동 식별 디스패치 테이블 추출: 암호화된 테이블을 위한 Unicorn XOR 키 캡처 핸들러 분류: 모든 버전에 걸친 256개 핸들러...

OGhidra — Updated!

OGhidra 3 - AI-Powered Reverse Engineering with Ghidra For the version using a Claude-inspired Orchestrator, see https://github.com/llnl/OGhidra/tree/orchestrator OGhidra bridges Large Language Models with Ghidra's reverse engineering platform, enabling AI-driven binary analysis through natural...

CVE-2019-13623

Ghidra CVE-2019-13623 affects NSA Ghidra prior to 9.1. A path traversal in RestoreTask.java enables an archive containing an executable with a leading ../ in its filename to overwrite arbitrary files, potentially affecting analysis results and, per the entry, enabling arbitrary code execution by ...