SANS diary explains a local Ghidra Server for malware labs
A shared Ghidra repository keeps analysis projects outside disposable VMs and supports versioning and multiple clients.
Stories per day · 30 days
2 RSS
Relatedreverse-engineering2decompilation1lab1malware1malware-analysis1version-control1vm-obfuscation1
6 stories, newest first · one card per story
Stories tagged #ghidra
VMSpec recovers program semantics from virtual-machine-obfuscated code
A prototype stripped VM obfuscation from nearly all of 147 benchmark programs and six malware domain-generation algorithms.
REA: New AI-Powered Reverse Engineering Tool Supports Ghidra, Hopper, and Claude Code
Open-source REA connects AI coding agents to Ghidra, Hopper, and IDA for local binary reverse engineering.
17
REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro to Reverse Engineer Anything
Open-source REA connects Claude Code and Cursor to Ghidra and IDA for evidence-backed reverse engineering.
18
DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.
When LLM Decompilers Recompile More and Preserve Less
Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.