Run any Skill in Manus with one click

headless-ghidra-discovery

Stars6

Forks0

UpdatedApril 28, 2026 at 07:29

P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

ByteLandTechnology

ByteLandTechnology/headless-ghidra

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

4 files

SKILL.md

readonly

name	headless-ghidra-discovery
description	P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.
phase	P3

Headless Ghidra Metadata Enrichment — P3

P3 enriches function metadata from third-party evidence and the P1 runtime hotpath call-chain. Analysis work may be parallelized while producing YAML, but all writes back to the Ghidra project must go through serialized ghidra-agent-cli ghidra ... commands.

Required ghidra-agent-cli Commands

ghidra-agent-cli workspace state show
ghidra-agent-cli functions list
ghidra-agent-cli callgraph callers
ghidra-agent-cli callgraph callees
ghidra-agent-cli metadata enrich-function
ghidra-agent-cli metadata validate
ghidra-agent-cli hotpath validate
ghidra-agent-cli ghidra apply-renames
ghidra-agent-cli ghidra verify-renames
ghidra-agent-cli ghidra apply-signatures
ghidra-agent-cli ghidra verify-signatures
ghidra-agent-cli gate check --phase P3

Inputs

artifacts/<target-id>/pipeline-state.yaml
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
artifacts/<target-id>/third-party/identified.yaml
artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml

Outputs

artifacts/<target-id>/metadata/renames.yaml
artifacts/<target-id>/metadata/signatures.yaml
artifacts/<target-id>/metadata/types.yaml
artifacts/<target-id>/metadata/constants.yaml
artifacts/<target-id>/metadata/strings.yaml
artifacts/<target-id>/metadata/apply-records/

Exit Expectations

Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

Do not decompile anything in this phase.
Do not rewrite historical per-function outputs.
Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P3 gate passes → headless-ghidra-batch-decompile

More from this repository

same repository

ghidra-agent-cli

ByteLandTechnology/headless-ghidra

Rust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI behavior. Do not load for P0–P4 workflow sequencing — use the headless-ghidra skill family instead.

2026-05-056

headless-ghidra-analyze-function

ByteLandTechnology/headless-ghidra

Thoroughly analyze a single function by first recovering its type definitions, constant definitions, vtables, function name and signature, then producing the final decompilation. Use when the user wants a complete per-function analysis following the strict recovery order: types → constants → vtables → function identity → decompilation.

2026-05-056

headless-ghidra

ByteLandTechnology/headless-ghidra

Entry skill for the Headless Ghidra YAML-first reverse-engineering pipeline. Use when the user asks to analyze, decompile, triage, resume, or iterate on a binary target with Ghidra/headless-ghidra. Reads artifacts/<target>/pipeline-state.yaml, routes P0–P4 phase skills, runs gate checks, and manages review pauses. Performs zero analysis work itself.

2026-05-056

headless-ghidra-baseline

ByteLandTechnology/headless-ghidra

P1 phase skill for Headless Ghidra baseline and runtime evidence. Use after P0 when the target must be imported into Ghidra, auto-analyzed, exported to baseline YAML, and given reproducible runtime or hotpath observations without decompiling function bodies.

2026-04-286

headless-ghidra-batch-decompile

ByteLandTechnology/headless-ghidra

P4 phase skill for Headless Ghidra selected function substitution. Use after P3 when an approved batch of functions should have metadata applied, be decompiled through Ghidra, and be recorded as per-function capture/substitution YAML.

2026-04-286

headless-ghidra-evidence

ByteLandTechnology/headless-ghidra

P2 phase skill for Headless Ghidra third-party evidence. Use after P1 to review baseline/runtime artifacts, identify or rule out third-party code, record pristine sources, classify functions, and capture evidence before metadata recovery.

2026-04-286

name	headless-ghidra-discovery
description	P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.
phase	P3

Headless Ghidra Metadata Enrichment — P3

Required ghidra-agent-cli Commands

ghidra-agent-cli workspace state show
ghidra-agent-cli functions list
ghidra-agent-cli callgraph callers
ghidra-agent-cli callgraph callees
ghidra-agent-cli metadata enrich-function
ghidra-agent-cli metadata validate
ghidra-agent-cli hotpath validate
ghidra-agent-cli ghidra apply-renames
ghidra-agent-cli ghidra verify-renames
ghidra-agent-cli ghidra apply-signatures
ghidra-agent-cli ghidra verify-signatures
ghidra-agent-cli gate check --phase P3

Inputs

artifacts/<target-id>/pipeline-state.yaml
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
artifacts/<target-id>/third-party/identified.yaml
artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml

Outputs

artifacts/<target-id>/metadata/renames.yaml
artifacts/<target-id>/metadata/signatures.yaml
artifacts/<target-id>/metadata/types.yaml
artifacts/<target-id>/metadata/constants.yaml
artifacts/<target-id>/metadata/strings.yaml
artifacts/<target-id>/metadata/apply-records/

Exit Expectations

Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

Do not decompile anything in this phase.
Do not rewrite historical per-function outputs.
Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P3 gate passes → headless-ghidra-batch-decompile