Using LLMs and Ghidra for Reverse Engineering and Vulnerability Analysis
· 1:28:31 · Watch on YouTube ↗
Summary
Hahna Kane Latonick demonstrates Ghidra integrations with local and online language models to analyze binaries, find vulnerabilities and decode obfuscated strings, while emphasizing the need to verify AI-generated results.
Key points
- Ghidra Ollama used a local Gemma 2 model to explain a vulnerable training binary and flag a potential buffer overflow.
- A Ghidra MCP demonstration connected Gemini to Ghidra to analyze a backdoor binary; its creator confirmed the analysis was broadly accurate.
- PyGhidra MCP analyzed a sample application and its shared library, identifying a buffer overflow and generating an untested proof-of-concept script.
- A separate demonstration decoded XOR-obfuscated strings in a simulated malware loader using a generated Python script.
- The speakers cautioned that LLM output can be incomplete or contain hallucinations and should be checked against the code and disassembly.
- Automatic approval allowed a generated script to execute without another prompt, illustrating the need for care with tool permissions.
Article Details
- Topics
- [09:51] Ghidra Ollama and local language models for reverse engineering
- [13:44] Buffer overflow analysis in a vulnerable training binary
- [29:00] Using disassembly and decompiled code to verify model output
- [35:29] Ghidra MCP analysis of backdoor binaries
- [57:17] Verification and limitations of AI-generated malware analysis
- [01:00:04] PyGhidra MCP headless and multi-binary analysis
- [01:07:32] Identifying a shared-library buffer overflow and generating a proof of concept
- [01:13:53] Analyzing and deobfuscating a simulated malware loader
People
Dr Josh StroscheinHost and reverse engineering instructor who supplied a demonstration binary and discussed verification of model output.Hahna Kane LatonickSecurity researcher and R&D director who demonstrated AI-assisted reverse engineering and vulnerability analysis.John McIntoshIdentified in the transcript as the developer of PyGhidra MCP.Laura WiardIdentified in the transcript as the creator of Ghidra MCP.