---
name: "ghidra-software-reverse-engineering"
description: "Decompile, disassemble, and analyze compiled software binaries and firmware."
metadata:
  author: "National Security Agency"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "decompile binary with ghidra"
  - "analyze malware binary ghidra"
  - "reverse engineer firmware"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# NSA Ghidra Software Reverse Engineering Decompiler

Reverse engineers compiled software with NSA Ghidra: decompilation of x86/x64/ARM binaries to readable C, symbolic function graphs, patch analysis, and script automation with Java/Python.

## When to Invoke
Invoke this skill whenever you need to:
- decompile binary with ghidra
- analyze malware binary ghidra
- reverse engineer firmware

## Execution SOP & Rules
1. Import binary into Ghidra and run automated analysis (function identification, symbol recovery).
2. Inspect decompiled C code side-by-side with assembly instructions in the listing view.
3. Rename functions and data structures progressively as understanding of logic evolves.
4. Execute automated batch analysis using analyzeHeadless for large firmware archives.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.