ReVa - Reverse Engineering Assistant

ReVa connects AI assistants to Ghidra. You describe what you want to know about a binary in plain language, and the AI uses Ghidra's analysis tools to answer your questions, annotate the database, and help you understand the program.

ReVa works through the Model Context Protocol (MCP), which means it works with any MCP-compatible AI client — Claude Code, VS Code with Copilot, Cursor, or any other client that supports the protocol.

How It Works

You talk to the AI assistant in natural language. The assistant translates your questions into Ghidra operations — decompiling functions, following cross-references, searching strings, tracing data flow — and synthesizes the results into an answer.

Every operation the assistant performs is visible to you. You can see which functions it examined, what cross-references it followed, and what changes it made. All modifications to the program database happen through Ghidra transactions and can be undone with EditUndo.

What Can You Do With ReVa?

Here are some examples of things you can ask:

Task Example Prompt

Triage a binary "What does this program do? Survey the imports, strings, and key functions."

Understand a function "Decompile the function at 0x00401000 and explain what it does."

Trace data flow "Where does the user input from recv() end up? Is there a buffer overflow?"

Identify algorithms "What cryptographic algorithm does this function implement? Check for known constants."

Annotate the database "Rename the variables in this function to meaningful names and add a summary comment."

Define structures "This function parses a network packet. Define a C structure for the packet format."

Map the call graph "What functions call the encryption routine, and what do they pass as the key?"

Find vulnerabilities "Check whether the input buffer at 0x00401200 has bounds checking before the memcpy."

Import and analyze "Import /tmp/firmware.bin and give me an overview."

Three Ways to Use ReVa

GUI Mode (Ghidra Plugin)

Run ReVa alongside Ghidra's graphical interface. The AI assistant connects over HTTP while you work in the CodeBrowser. You see changes as they happen and can undo anything the assistant does.

This is the recommended mode for interactive analysis.

CLI Mode (Claude Code)

Use the mcp-reva command to integrate directly with Claude Code or other CLI-based AI tools. ReVa manages its own Ghidra project automatically — just point it at a binary and start asking questions.

Headless Mode

Run ReVa without the Ghidra GUI for automation, scripting, and CI/CD pipelines. Useful for batch analysis of multiple binaries.

Capabilities at a Glance

Area What the AI Can Do

Decompilation Decompile functions, search across all decompilations, rename variables, change data types, add comments

Functions List, search, and filter functions; set prototypes and signatures; manage function tags

Cross-References Find all references to/from any address; trace data flow forward and backward

Call Graphs Build call graphs; find common callers of multiple functions; traverse call trees

Strings & Symbols Search and filter strings and symbols with pagination

Memory & Data Read memory, inspect data, apply data types, create labels

Data Types Browse type archives, define C structures from headers, apply structures to addresses

Imports & Exports List imported/exported functions, find import references, resolve thunks

C++ Analysis Analyze vtables, find virtual method callers, search for constants

Annotations Set comments and bookmarks, search annotations

Project Import binaries, run analysis, manage project files

Security

By default, the MCP server binds to 127.0.0.1 (localhost only). Only processes on your machine can connect.

If you change the server host to 0.0.0.0 to accept remote connections, enable API key authentication to prevent unauthorized access. See Configuration Options.

All program modifications can be undone using Ghidra's standard undo functionality.

Task	Example Prompt
Triage a binary	"What does this program do? Survey the imports, strings, and key functions."
Understand a function	"Decompile the function at 0x00401000 and explain what it does."
Trace data flow	"Where does the user input from recv() end up? Is there a buffer overflow?"
Identify algorithms	"What cryptographic algorithm does this function implement? Check for known constants."
Annotate the database	"Rename the variables in this function to meaningful names and add a summary comment."
Define structures	"This function parses a network packet. Define a C structure for the packet format."
Map the call graph	"What functions call the encryption routine, and what do they pass as the key?"
Find vulnerabilities	"Check whether the input buffer at 0x00401200 has bounds checking before the memcpy."
Import and analyze	"Import /tmp/firmware.bin and give me an overview."

Area	What the AI Can Do
Decompilation	Decompile functions, search across all decompilations, rename variables, change data types, add comments
Functions	List, search, and filter functions; set prototypes and signatures; manage function tags
Cross-References	Find all references to/from any address; trace data flow forward and backward
Call Graphs	Build call graphs; find common callers of multiple functions; traverse call trees
Strings & Symbols	Search and filter strings and symbols with pagination
Memory & Data	Read memory, inspect data, apply data types, create labels
Data Types	Browse type archives, define C structures from headers, apply structures to addresses
Imports & Exports	List imported/exported functions, find import references, resolve thunks
C++ Analysis	Analyze vtables, find virtual method callers, search for constants
Annotations	Set comments and bookmarks, search annotations
Project	Import binaries, run analysis, manage project files

Provided by: ReVa