SuperGhidra is a Python acceleration suite that keeps Ghidra analysis in a persistent daemon, adds GPU scanning, Z3 P-code verification, and C++ class recovery for authorized reverse engineers.
| Tool | yuatemycat/SuperGhidra — Python toolkit that accelerates Ghidra scripting with a persistent daemon, P-Code lifting, Z3 SMT equivalence checking, GPU-accelerated ARM64 scanning, and MSVC/MFC class recovery |
| Category | Reverse engineering toolchain / binary analysis acceleration |
| Primary Use | Speeding up authorized binary analysis: decompilation queries, ARM64 ADRP sweeps, cross-version function matching, RTTI recovery, and semantic verification of LLM decompiler output |
| Safe Use | For malware analysts, vulnerability researchers, and CTF practitioners working on binaries they are authorized to analyze — lab research, defensive malware triage, and licensed software audits |
| Telemetry Note | Purely local tooling: a daemon on 127.0.0.1:5073, SQLite cache, and JSON overlay files; no outbound network activity, so its use is invisible to targets and leaves only local artifacts on the analyst workstation |
SuperGhidra positions itself against a pain point every Ghidra operator knows: headless runs pay 5–15 seconds of JVM startup each invocation, a project lock blocks a second reader, and bulk jobs like sweeping a 20 MB ARM64 .text section or matching 45,000 functions across two builds run on a single CPU thread. The project's answer is architectural rather than cosmetic. Instead of launching analyzeHeadless repeatedly, core keeps one read-only Ghidra project loaded in a background daemon listening on 127.0.0.1:5073, caches answers in SQLite, and moves the heavy lifting out of the JVM into plain Python, NumPy, or GPU compute shaders. That single design decision — persistent process plus cache — is what turns interactive iteration from a compile-loop experience into a query-loop one.
The daemon layer deserves attention on its own. Renames and comments are written to a JSON overlay rather than mutated into the .rep, which means batch automation can accumulate annotations without ever dirtying the shared project — overlay-sync later merges the JSON overlay and delta logs into an atomic Ghidra GUI Python script. There is also a resource governor exposing eco, balanced, turbo, and auto modes, which is a thoughtful touch for analysts running on shared or thermally constrained hardware, and IPC runs over a zero-copy shared-memory ring buffer benchmarked at roughly 195,300 messages per second on Windows.
The formats package is where much of the Ghidra-independent value lives. It implements its own ELF, PE, and Mach-O loader, MSVC RTTI and MFC CRuntimeClass recovery, Serialize() layout tracing, a CArchive decoder, and PDB parsing down to the MSF 7.0 container, GSI hash stream, and TPI CodeView leaf records (LF_STRUCTURE, LF_FIELDLIST, LF_PROCEDURE). DWARF 5, Breakpad, and map export round it out. For anyone reverse engineering legacy Windows C++ targets — the kind of MFC document/view applications that dominate enterprise software — the ability to run superghidra rtti-recover app.dll -o classes.json and get class hierarchies and vtables without ever booting Ghidra is a meaningful workflow shortcut.
The lifters package implements an ARM64-to-P-code lifter with coverage the README enumerates precisely: integer ops, exclusive memory access, SIMD vector arithmetic, the ARMv8-A Cryptographic Extensions (AESE, AESD, AESMC, AESIMC, SHA1, SHA256), and atomic CAS/SWP/LDADD. Alongside it sit x86 and ARM/Thumb decoders and a Z3 SMT checker that either proves two P-code snippets equivalent or answers UNKNOWN. This is the formal-methods heart of the project, and it powers the most interesting claim in the README: semantic gating of LLM decompiler output.
That gating story is worth unpacking because it addresses a real, documented weakness in neural decompilation. The authors note that benchmarks like HumanEval-Decompile suffer from training-set contamination — models recalling memorized code rather than reasoning about semantics. Their out-of-distribution matrix, built by differential co-execution under MSVC 14.44 cl.exe and MinGW GCC 16.2.0, shows raw LLM predictions compiling 100% of the time yet passing semantically 0% of the time across six kernels including SHA256_ROUND, CHACHA20_QR, and LEB128_DECODE. The D-LiFT/CoExec gate rejected every hallucinated candidate before commit. Whether the 0% baseline generalizes, the methodology — compile, then verify equivalence against ground-truth semantics — is the correct pattern, and SuperGhidra makes it a reusable primitive via verify_smt_equivalence.
On the reference benchmark, Ghidra raw scored 107/1300 (8.23%) on HumanEval-Decompile, while Ghidra plus the filter reached 294/1300 (22.62%), with +187 gains and zero regressions — overtaking raw IDA's 18.69%. The filter's zero-regression property matters more than the headline number: a post-pass that only accepts candidates it can justify is safe to leave enabled in a pipeline, which is exactly what you want when LLM naming or decompilation suggestions feed into a persistent annotation overlay.
Performance claims are concrete and hardware-annotated (i9-12950HX, RTX A5500). A 4 MB ARM64 block of 1,048,576 instructions gets swept for ADRP+ADD/LDR pairs in 7.28 ms on NumPy SIMD — about 144 M instructions per second — and a 20 MB block on WGPU DirectX 12 compute shaders takes 41.20 ms with bit-exact agreement against the CPU path. The acceleration package picks its backend adaptively: CPU NumPy for inputs under 5 MB to avoid GPU staging latency, WGPU (DirectX 12/Vulkan/Metal) at 5 MB and above. Function seeding runs at 126 M instructions per second on the same block.
The diff package targets patch-diff and version-diff workflows: functions are matched across builds using CFG feature vectors, after which the tool finds struct fields whose offsets moved between versions and rewrites the accesses. For vulnerability researchers tracking a patch across firmware updates, that offset re-materialization step is the tedious part that rarely gets tooling, and automating it is a genuine contribution. Storage gets attention too — an LZ4/Zstd codec for Ghidra's 16 KB buffer pages achieving 79–86% disk savings at 443 MB/s (LZ4) and 207 MB/s (Zstd level 3) on synthetic pages, plus a standalone Java BufferFile codec.
Installation is conventional: pip install superghidra, with optional extras such as superghidra[smt] for the Z3 checker, superghidra[gpu] for WGPU shaders, superghidra[ghidra] for the pyghidra bridge (JDK 21 and Ghidra 11+ required for daemon mode), and superghidra[frida] for live emulator runtime inspection. The unified CLI exposes til-import for IDA .til type libraries and flirt-match for IDA FLIRT signature databases — pragmatic nods toward operators migrating from IDA Pro. Configuration is entirely environment-driven (GHIDRA_INSTALL_DIR, SUPERGHIDRA_PROJECTS, SUPERGHIDRA_MSVC_ROOT), nothing is hardcoded to a machine, and CI runs a six-job dual-OS matrix with 736 collected pytest tests passing at 100%.
The integrations package adds an APK-to-JNI cross-referencer for Android reversing, an emulator memory reader gated by a device allow-list, and the LLM naming pipeline. Notably, the whole toolset is also exposed over MCP through the companion SuperghidraMCP server (Apache-2.0, built on pyghidra-mcp), providing 38 tools — recover_cpp_classes, trace_serialize, decode_carchive, diff_binaries, verify_smt_equivalence, gpu_adrp_scan — to agents like Claude, Antigravity, and Codex. That lets an AI assistant drive analysis directly instead of shelling out to headless scripts, which pairs naturally with the overlay model: agent-generated annotations land in JSON, get SMT-verified where applicable, and sync atomically.
Caveats are refreshingly candid: the Java codec does not compress Ghidra projects transparently because Ghidra hardcodes LocalManagedBufferFile behavior, and the standalone superghidra decompile is explicitly staged — it handles register-to-register mov/add/xor and ret on x86-64, exiting non-zero on anything else. With 97 stars, an AGPL-3.0 license, and per-package READMEs, this reads as an ambitious but honest engineering project. For authorized analysts doing firmware triage, patch diffing, or LLM-assisted decompilation with semantic guardrails, SuperGhidra offers one of the more complete acceleration stacks around Ghidra currently published.
yuatemycat/SuperGhidra.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.