#Ghidra
LightNews LightNews
urmr.gay
trans nb who is called ghidra
October 30, 2026 at 9:42 PM
mrrp.place
does anyone know why

* `killall` failed to locate the ghidra process running on my machine
* `pkill` found it and supposedly delivered the signal, but ghidra remained open
* `procs` easily found the process, and when `kill` sent a SIGTERM ghidra closed immediately

> killall ghidra ghidra: no process found > pkill ghidra > pkill -9 ghidra > procs ghidra [output showing a running java process] > kill 182820 > procs ghidra [no processes found]
November 1, 2026 at 9:27 PM
alekseialeinikov.com
Ghidra MCP vs REA: How AI Agents Reverse Engineer Software, and What the Setup Changes on Your Machine

Ghidra MCP servers connect one decompiler to an AI agent. REA puts many analysis tools, Ghidra included, behind a single MCP server. How the two differ…

#infosec #cybersecurity #ghidramcp
Ghidra MCP vs REA: How AI Agents Reverse Engineer Software, and What the Setup Changes on Your Machine
Ghidra MCP servers connect one decompiler to an AI agent. REA puts many analysis tools, Ghidra included, behind a single MCP server. How the two differ, what their setup changes on your machine, what can go wrong, and where the law draws lines.
www.alekseialeinikov.com
October 29, 2026 at 7:37 AM
prosperflowio.bsky.social
The NSA open-sourced its reverse engineering toolkit, and it decompiles binaries across tons of CPU architectures for free. 🔗 github.com/NationalSecurityAgency/ghidra

Credits: github.com/NationalSecurityAgency/ghidra

#ghidra #java #reverseengineering
November 2, 2026 at 6:30 PM
caffeineislife.bsky.social
Because i'm all for pissing off spoiled brat rich tech bros... 😈
Another tip, there's tons of how to, beginner lessons and such for how to start into reverse engineering on YouTube. There's also a lot of info on Reddit as well as people who can point out where to start based on your skill level.
October 31, 2026 at 10:59 PM
alekseialeinikov.com
Ghidra MCP vs REA: Wie KI-Agenten Software per Reverse Engineering analysieren und was das Setup auf deinem Rechner verändert

Ghidra-MCP-Server verbinden einen Decompiler mit einem KI-Agenten. REA stellt viele Analysewerkzeuge, darunter Ghidra, hinter ei…

#infosec #cybersecurity #ghidramcp
Ghidra MCP vs REA: Wie KI-Agenten Software per Reverse Engineering analysieren und was das Setup auf deinem Rechner verändert
Ghidra-MCP-Server verbinden einen Decompiler mit einem KI-Agenten. REA stellt viele Analysewerkzeuge, darunter Ghidra, hinter einen einzigen MCP-Server. Wie sich beide unterscheiden, was ihr Setup auf deinem Rechner ändert, was schiefgehen kann und wo das Recht Grenzen zieht.
www.alekseialeinikov.com
October 29, 2026 at 7:37 AM
bumbep.bsky.social
KING GHIDRA TAKE ME TO YOUR LEADER
October 28, 2026 at 9:35 PM
sailor.li
It's a time consuming process that primarily consisted of copy-pasting chunks of code from Ghidra and then trying to trick a twenty year old compiler intro reproducing the exact same bytes. It's not exactly honourable work.
November 2, 2026 at 1:35 PM
artestomellivoura.bsky.social
🐉 GHIDRA — THE NSA'S FREE REVERSE ENGINEERING TOOL FOR SOFTWARE & MALWARE ANALYSIS! 💻🔍

#Ghidra #ReverseEngineering #NSA #Cybersecurity #MalwareAnalysis #EthicalHacking #InfoSec #CyberSecurityTools #SoftwareEngineering #Decompiler #DigitalForensics #OpenSource #SecurityResearch #Programming
October 27, 2026 at 9:51 PM
iprogramincpp.com
Does anyone here know how I could possibly decompile a kernelcache of iOS 2.1.1 (armv6) so that I have access to the linked drivers as well, using Ghidra?
October 29, 2026 at 12:04 PM
dphrygian.com
I told it where the original code lived on my hard drive, as an assurance that it was actually my own project, but also not to look at it because that would be cheating.

After installing Ghidra and starting to do some work, it told me it refused to continue.
October 31, 2026 at 9:33 AM
sansisc.bsky.social
Deploying a Local Ghidra Server for Your Malware Analysis Lab https://isc.sans.edu/diary/33470
ISC Logo
October 29, 2026 at 6:21 AM
sansisc.bsky.social
SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158
image of sans internet stormcenter logo with stormcast flair
October 30, 2026 at 3:31 AM
emily.fedi.uni.horse.ap.brid.gy
@b idk what pkill does, but killall is probably specifically trying to match "ghidra" against the executable named "java"
November 1, 2026 at 9:34 PM
kitploit.com
mcp-reverse — MCP server exposing 180+ reverse-engineering tools that aggregate Ghidra, IDA, x64dbg, Frida and 56 other backends with native binary parsers and a 4,200-skill knowledge base. https://ktp.sh/V3dINwDNfb
mcp-reverse
October 29, 2026 at 10:38 PM
hapsis.bsky.social
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)

isc.sans.edu/diary/rss/33...

#Cybersecurity #ThreatIntel #Vulnerability
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Deploying a Local Ghidra Server for Your Malware Analysis Lab, Author: Xavier Mertens
isc.sans.edu
October 29, 2026 at 3:30 PM
philpax.me
I haven't looked at REA! this is a bespoke harness, continually improved by Claude, that uses a scheduler to drive Ghidra and Pi w/ custom tools to maximise knowledge-sharing and throughput

claudeslop readme section, will revise this once the final shape's in place (alt-text cont'd in second image)
How it works The harness turns the executable into a queue of recovery tasks, one per function. Ghidra analyses the executable once, and its records give each function's extent, callees, data references, and RTTI. A task's evidence packet combines these with the original disassembly, Ghidra's decompilation, the declarations of what the function calls, and pattern notes on idioms the compiler is known to produce. A model session receives the packet and writes a C++ translation unit. The harness compiles the unit with the game's compiler and flags in a sandbox, links it at the function's original address, and compares the result with the original bytes. The model sees each mismatch as a diff and tries again, over phases of a few attempts each with a distilled history of what it tried. Nothing counts until the bytes match exactly. An accepted record is then rebuilt with every other record into a hybrid executable, which must also equal the original before the record is committed. Most of the work is scheduling and reuse. Several local models serve the queue at once across the available GPUs, and the scheduler orders tasks by an estimate of each match's value against its difficulty and cost. Value is mainly the identical functions a match unlocks, and difficulty is fitted from earlier verdicts. When one function of a family of identical functions matches, a look-alike adapter rewrites its source for the rest of the family, so one model session can recover hundreds of functions. Every accepted source is also harvested for the types and signatures it declares. Probe compiles establish which of those facts the bytes depend on, and the facts that are backed are written into a shared type registry. The headers generated from the registry make later evidence, and later decompilations, more informed. The harness also improves itself between runs. A coordinating agent, a frontier model working with the operator, runs a failure analysis every few hours. It clusters the sessions that failed, finds the source shape behind each recurring miss, and proves a fix by correcting a session's closest attempt until it matches exactly. Each proven fix then becomes work for implementation agents: a new or corrected pattern note, a harness defect fixed, a compiler profile added, or a function extent repaired in the analysis. The coordinator merges and verifies that work and restarts the run on it. The same loop covers the harness's own operation: stalls, blockers, and throughput are measured and traced to their causes. The local models do the bulk of the recovery, and what the stronger model learns from their failures returns to them as better evidence and a better harness.
November 1, 2026 at 6:43 PM
pancake.infosec.exchange.ap.brid.gy
Europe sovereign and Ghidra spotted in the very same Mistral Large 4 anouncement website. Considering Radare2 is European and performs 4 times better than Ghidra in general cybersec challenges thats feels very wrong to me
October 30, 2026 at 5:14 AM
vtstech.bsky.social
#D2LoD Vanilla+0.0.7-R77 - Now with 2 shared stash pages. Another 3 rounds of #Ghidra Recovery merged from upstream. 40% of Retail #Diablo2 1.14d reverse engineered. github.com/VTSTech/D2Lo...
November 1, 2026 at 8:35 PM
obiryder.bsky.social
A big star count is a reason to investigate, not a verdict.

Sky explains REA’s role alongside Ghidra or IDA. What would you want to test?

30 Oct figures. Early chart history is estimated; projected growth is conditional. AI presenter/voice.

repoquarry.dev/projects/rea
October 30, 2026 at 6:45 PM
arc-codex.com
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)

This article overstates the practical security benefit of using a local Ghidra server, especially when discussing data confidentiality. While versioning is useful, relying on an internal…

via SANS Internet Storm Center
huntaegis.com
October 30, 2026 at 4:19 AM
schizokonoko.bsky.social
man its so fucking hard to get excited for recomps these days
Credits and licence •B2recomp is made by K0NL: the Bayonetta 2 port of the lifter and runtime, the launcher, the build (setup.py, llvm-mingw), the test run and the tools in scripts/. •AI helped in reverse engineering the game, with Ghidra and the open-source project REA.
October 30, 2026 at 2:33 PM
fetchfeeds.bsky.social
Deploying local Ghidra Server for persistent malware analysis & Claude's zero-click flaw in Mul. 🔬💻 #CyberSeguridad https://fefd.link/jL95M
October 30, 2026 at 9:10 AM
fen.cx
ghidra and gcc are free, open source, run locally, dont need special hardware, and are efficient as fuck. you dont need claude to decomp video games, just skill, time, and a computer
October 27, 2026 at 6:26 PM
twoflower.readingsnail.pe.kr
어케 보면 위키리크스의 문건으로 인한 후폭발이...

위키리크스에서 CIA의 Vault 7 이란 파일을 터트렸는데, 거기서 쓰인 짱쎈 디컴파일러 기드라를 NSA에서 데헷하면서 풀어버리고 관리해서 말이죠. LLM, 즉 REA에서 이 기드라를 써서 뚫어뻥 한다고 합니다. LLM 시대전에도 있었고 기술이 당연 필요했는데, 대 LLM 시대가 오니 LLM 장난감이 되었죠. 얘 이름은 고지라 시리즈의 킹 기도라에서 가져왔습니다...

github.com/NationalSecu...
GitHub - NationalSecurityAgency/ghidra: Ghidra is a software reverse engineering (SRE) framework
Ghidra is a software reverse engineering (SRE) framework - NationalSecurityAgency/ghidra
github.com
October 26, 2026 at 11:20 PM