ghidra-ai-bridge

AI-powered Ghidra query interface for reverse engineering agents.

ghidra-ai-bridge provides a CLI and Python API that lets AI agents (or humans) query Ghidra project data — decompiled code, structs, enums, vtables, cross-references, strings, and more — without running Ghidra interactively.

Features

Query decompiled code by address or function name
Cross-reference lookup — callers and callees
Struct/enum/vtable inspection from Ghidra exports
String search with reference tracking
Address map integration for reversed source code
Source type extraction — struct sizes, enum values from VALIDATE_SIZE / VALIDATE_OFFSET macros
Remaining stub tracking — find unreversed functions
Crash debugging — find which function contains a given address
Configurable — works with any Ghidra project via YAML config
Headless export — PyGhidra-based bulk export scripts
Normalized IR evidence — high P-code and CFG exports per function
Function context bundles — machine-readable callees, strings, globals, and CFG

Installation

pip install ghidra-ai-bridge

For headless Ghidra export support:

pip install ghidra-ai-bridge[headless]

Quick Start

# Interactive setup
ghidra-bridge init

# Export data from Ghidra project (requires pyghidra)
ghidra-bridge export all

# Build address map from reversed source
ghidra-bridge build-map

# Query
ghidra-bridge decompile 0x401000
ghidra-bridge search CPed
ghidra-bridge xrefs-to 0x5fb010
ghidra-bridge struct CEntity
ghidra-bridge info

Configuration

Create a ghidra-bridge.yaml in your project root:

ghidra:
  install_dir: ~/Downloads/ghidra_12.0.1_PUBLIC
  project_dir: ~/Documents/Ghidra
  project_name: my-project
  program_name: target.exe

paths:
  export_dir: .ghidra-exports
  address_map: .ghidra-exports/address_map.json

source:                                   # optional
  root: ./source
  hook_patterns:
    - 'RH_ScopedInstall\s*\(\s*(\w+)\s*,\s*(0x[0-9A-Fa-f]+)'
  stub_patterns:
    - 'plugin::Call\w*<[^>]*(0x[0-9A-Fa-f]+)[^>]*>'

binary:                                   # optional
  code_range_min: 0x00401000
  code_range_max: 0x00900000

Config priority: CLI args > environment variables > YAML file > defaults.

Environment variables: GHIDRA_INSTALL_DIR, GHIDRA_PROJECT_DIR, GHIDRA_PROJECT_NAME, GHIDRA_PROGRAM_NAME, GHIDRA_EXPORT_DIR.

Commands

Command	Description
`init`	Interactive setup wizard
`export <type>`	Run Ghidra export (all, structs, decompiled, vtables, globals, strings, source-types)
`build-map`	Build address map from source
`decompile <addr\|name>`	Show decompiled code
`search <pattern>`	Search function names
`xrefs-to <addr\|name>`	Show callers
`xrefs-from <addr\|name>`	Show callees
`struct <name>`	Show Ghidra struct definition
`enum <name>`	Show Ghidra enum values
`vtable <class>`	Show virtual function table
`global <addr\|name>`	Show global variable info
`strings <pattern>`	Search strings
`containing <addr>`	Find function containing address
`decompile-class <class>`	Decompile all class methods
`context <addr\|name>`	Export a JSON evidence bundle for a function
`pcode <addr\|name>`	Show normalized high P-code JSON
`cfg <addr\|name>`	Show control-flow graph JSON
`asm <addr\|name>`	Show assembly captured during decompiled export
`unimplemented [pattern]`	List unimplemented functions
`remaining [class]`	Show remaining stubs
`source-struct <name>`	Query struct from source
`source-enum <name>`	Query enum from source
`dump-asm <addr> <output>`	Dump assembly (requires pyghidra)
`info`	Show export statistics
`list`	List all functions

License

MIT

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ghidra_ai_bridge-0.2.0.tar.gz (31.8 kB view details)

Uploaded Jul 15, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

ghidra_ai_bridge-0.2.0-py3-none-any.whl (31.7 kB view details)

Uploaded Jul 15, 2026 Python 3

File details

Details for the file ghidra_ai_bridge-0.2.0.tar.gz.

File metadata

Download URL: ghidra_ai_bridge-0.2.0.tar.gz
Upload date: Jul 15, 2026
Size: 31.8 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ghidra_ai_bridge-0.2.0.tar.gz
Algorithm	Hash digest
SHA256	`cfe184a2c0f98d2c6d5d1489c2e91ba93884957c7d8a99da0382c5275d4d4f31`
MD5	`7f8fb677d9e3becd735f9670f4f71df3`
BLAKE2b-256	`c08a48a05efbf2efc1ebb94ca0f7e5fdddb0bacb69cb9fe47723137e8fbfad61`

See more details on using hashes here.

Provenance

The following attestation bundles were made for ghidra_ai_bridge-0.2.0.tar.gz:

Publisher: publish.yml on Dryxio/ghidra-ai-bridge

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: ghidra_ai_bridge-0.2.0.tar.gz
- Subject digest: cfe184a2c0f98d2c6d5d1489c2e91ba93884957c7d8a99da0382c5275d4d4f31
- Sigstore transparency entry: 2172980881
- Sigstore integration time: Jul 15, 2026
Source repository:
- Permalink: Dryxio/ghidra-ai-bridge@8d2bc22aa6498eaa7178957c2c9babef1d75d03d
- Branch / Tag: refs/tags/v0.2.0
- Owner: https://github.com/Dryxio
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@8d2bc22aa6498eaa7178957c2c9babef1d75d03d
- Trigger Event: release

File details

Details for the file ghidra_ai_bridge-0.2.0-py3-none-any.whl.

File metadata

Download URL: ghidra_ai_bridge-0.2.0-py3-none-any.whl
Upload date: Jul 15, 2026
Size: 31.7 kB
Tags: Python 3
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ghidra_ai_bridge-0.2.0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`7be3c7d11e10367231f0aee12085afec24a89d8c2ccc3547d06b260898138779`
MD5	`a38e98ab9a1842426f943e6102db0c42`
BLAKE2b-256	`1f7d67f13402e311158b695ccd5c92c31c48dfce13554aa8654faab9169a9ffc`

See more details on using hashes here.

Provenance

The following attestation bundles were made for ghidra_ai_bridge-0.2.0-py3-none-any.whl:

Publisher: publish.yml on Dryxio/ghidra-ai-bridge

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: ghidra_ai_bridge-0.2.0-py3-none-any.whl
- Subject digest: 7be3c7d11e10367231f0aee12085afec24a89d8c2ccc3547d06b260898138779
- Sigstore transparency entry: 2172980894
- Sigstore integration time: Jul 15, 2026
Source repository:
- Permalink: Dryxio/ghidra-ai-bridge@8d2bc22aa6498eaa7178957c2c9babef1d75d03d
- Branch / Tag: refs/tags/v0.2.0
- Owner: https://github.com/Dryxio
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@8d2bc22aa6498eaa7178957c2c9babef1d75d03d
- Trigger Event: release

Release history Release notifications | RSS feed

This release

0.2.0 This release

Jul 15, 2026 2 files

0.1.0

Apr 12, 2026 2 files

ghidra-ai-bridge 0.2.0

ghidra-ai-bridge

Features

Installation

Quick Start

Configuration

Commands

License

Project links

Key dates

1 maintainer

GitHub Statistics

License expression

Requires

Provides Extra

Download files

Source Distribution

Built Distribution

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

Release history Release notifications | RSS feed