# ghidra

Published articles for ghidra.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI

DevFeed: [pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI](<https://devfeed.tech/articles/pyghidra-mcp-meets-ghidra-gui-drive-project-wide-re-with-local-ai-39720.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/pyghidra-mcp-meets-ghidra-gui-drive-project-wide-re-with-local-ai/>)

Author: clearbluejar

Published: 2026-05-05T07:00:00Z

Content type: article

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [Ghidra](<https://devfeed.tech/topics/ghidra.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Local AI](<https://devfeed.tech/topics/local-ai.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [gemma4](<https://devfeed.tech/tags/gemma4.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [local](<https://devfeed.tech/tags/local.md>), [local-ai](<https://devfeed.tech/tags/local-ai.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>)

### AI overview

The article presents pyghidra-mcp v0.2.0, which adds a GUI-backed mode allowing a local LLM to drive a live Ghidra CodeBrowser across an entire project. It demonstrates real-time function renaming, plate comments, and cross-binary analysis, with edits recorded in Ghidra's undo history.

### Source excerpt

pyghidra-mcp v0.2.0 ships a GUI-backed mode that lets a local LLM drive a live Ghidra CodeBrowser at full project scope. Renames, plate comments, and cross-binary pivots land in real time, with every edit tagged in Ghidra's undo history while the session is alive.

## How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS

DevFeed: [How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS](<https://devfeed.tech/articles/how-llms-feed-your-re-habit-following-the-use-after-free-trail-in-clfs-39718.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/how-llms-feed-your-re-habit-following-the-uaf-trail-in-clfs/>)

Author: clearbluejar

Published: 2026-02-03T06:15:00Z

Content type: tutorial

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [race-condition](<https://devfeed.tech/topics/race-condition.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Logging](<https://devfeed.tech/topics/logging.md>)

Tags: [ghidra](<https://devfeed.tech/tags/ghidra.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [llms](<https://devfeed.tech/tags/llms.md>), [macos](<https://devfeed.tech/tags/macos.md>), [race-condition](<https://devfeed.tech/tags/race-condition.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

This article describes how LLMs and pyghidra-mcp support reverse engineering by tracing a use-after-free vulnerability in Windows Common Log File System (CLFS) through a patch diff. It explains CLFS, its Win32 and kernel-driver interfaces, and how a race condition can trigger the vulnerability.

### Source excerpt

Dive into how LLMs and pyghidra-mcp accelerate reverse engineering by tracing a UAF vulnerability in CLFS through a patch diff.

## TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering

DevFeed: [TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering](<https://devfeed.tech/articles/tp-link-tapo-c200-hardcoded-keys-buffer-overflows-and-privacy-in-the-era-of-ai-assisted-reverse-engineering-41272.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2025/12/18/TP-Link-Tapo-C200-Hardcoded-Keys-Buffer-Overflows-and-Privacy-in-the-Era-of-AI-Assisted-Reverse-Engineering/>)

Author: Simone Margaritelli

Published: 2025-12-17T23:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Android](<https://devfeed.tech/topics/android.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-assisted-reverse-engineering](<https://devfeed.tech/tags/ai-assisted-reverse-engineering.md>), [android](<https://devfeed.tech/tags/android.md>), [assembly](<https://devfeed.tech/tags/assembly.md>), [aws](<https://devfeed.tech/tags/aws.md>), [china](<https://devfeed.tech/tags/china.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2025-14299](<https://devfeed.tech/tags/cve-2025-14299.md>), [cve-2025-14300](<https://devfeed.tech/tags/cve-2025-14300.md>), [cve-2025-8065](<https://devfeed.tech/tags/cve-2025-8065.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [ghidramcp](<https://devfeed.tech/tags/ghidramcp.md>), [hardcoded-credentials](<https://devfeed.tech/tags/hardcoded-credentials.md>), [integer-overflow](<https://devfeed.tech/tags/integer-overflow.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [memory](<https://devfeed.tech/tags/memory.md>), [mips](<https://devfeed.tech/tags/mips.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [re](<https://devfeed.tech/tags/re.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [reversing](<https://devfeed.tech/tags/reversing.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [tapo-c200](<https://devfeed.tech/tags/tapo-c200.md>), [tapo-camera](<https://devfeed.tech/tags/tapo-camera.md>), [tp-link](<https://devfeed.tech/tags/tp-link.md>), [tplink](<https://devfeed.tech/tags/tplink.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

This article describes an AI-assisted reverse-engineering investigation of TP-Link Tapo C200 camera firmware. The author reports finding several security vulnerabilities affecting about 25,000 devices directly exposed on the internet, and discusses the tools and process used.

### Source excerpt

Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always giv

## pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis

DevFeed: [pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis](<https://devfeed.tech/articles/pyghidra-mcp-headless-ghidra-mcp-server-for-project-wide-multi-binary-analysis-39719.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/pyghidra-mcp-headless-ghidra-mcp-server-for-project-wide-multi-binary-analysis/>)

Author: clearbluejar

Published: 2025-08-19T15:56:00Z

Content type: release

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [Ghidra](<https://devfeed.tech/topics/ghidra.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [agentic workflows](<https://devfeed.tech/topics/agentic-workflows.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [automated](<https://devfeed.tech/tags/automated.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [llm](<https://devfeed.tech/tags/llm.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>)

### AI overview

The article introduces pyghidra-mcp, a headless Model Context Protocol server for Ghidra. It is designed for automation and exposes an entire Ghidra project so an LLM can trace function calls across multiple interdependent binaries in one analysis session.

### Source excerpt

Unlock project-wide, multi-binary analysis with pyghidra-mcp, a headless Ghidra MCP server for automated, LLM-assisted reverse engineering.

## The faker's guide to reading (x86) assembly language

DevFeed: [The faker's guide to reading (x86) assembly language](<https://devfeed.tech/articles/the-faker-s-guide-to-reading-x86-assembly-language-39723.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/fakers-guide-to-assembly/>)

Author: Tim Misiak

Published: 2023-01-03T16:20:24Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [Assembly](<https://devfeed.tech/topics/assembly.md>), [x86](<https://devfeed.tech/topics/x86.md>), [Programming](<https://devfeed.tech/topics/programming.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [systems](<https://devfeed.tech/topics/systems.md>), [Ghidra](<https://devfeed.tech/topics/ghidra.md>)

Tags: [assembly](<https://devfeed.tech/tags/assembly.md>), [c](<https://devfeed.tech/tags/c.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [guide](<https://devfeed.tech/tags/guide.md>), [ida](<https://devfeed.tech/tags/ida.md>), [language](<https://devfeed.tech/tags/language.md>), [reading](<https://devfeed.tech/tags/reading.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [rust](<https://devfeed.tech/tags/rust.md>), [tools](<https://devfeed.tech/tags/tools.md>), [x86](<https://devfeed.tech/tags/x86.md>)

### AI overview

This tutorial explains why reading x86 assembly is generally easier than writing it and why it helps developers understand native-code programs. It presents assembly reading as useful for troubleshooting, understanding compiled behavior, and reverse engineering code when source is unavailable, while noting that it complements tools such as Ghidra and IDA.

### Source excerpt

Assembly code scares people. There's a good reason for that. For many people, writing code in assembly language seems equivalent to writing code in ancient dwarven runes, or calculating pi in roman numerals. The fact that RollerCoaster Tycoon was almost completely written in assembly language sounds almost too amazing to be true. Many programmers view assembly language as some combination of ancient, arcane, inscrutable, useless, and complex. Despite all that, I have a secret to share with you.

## Competing in Pwn2Own 2021 Austin: Icarus at the Zenith

DevFeed: [Competing in Pwn2Own 2021 Austin: Icarus at the Zenith](<https://devfeed.tech/articles/competing-in-pwn2own-2021-austin-icarus-at-the-zenith-39714.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2022/03/26/competing-in-pwn2own-2021-austin-icarus-at-the-zenith/>)

Author: Axel "0vercl0k" Souchet

Published: 2022-03-26T15:00:00Z

Content type: opinion

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Ghidra](<https://devfeed.tech/topics/ghidra.md>), [Hardware](<https://devfeed.tech/topics/hardware.md>), [Network](<https://devfeed.tech/topics/network.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [archer-c7](<https://devfeed.tech/tags/archer-c7.md>), [competition](<https://devfeed.tech/tags/competition.md>), [cve-2022-24354](<https://devfeed.tech/tags/cve-2022-24354.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [memory-corruption](<https://devfeed.tech/tags/memory-corruption.md>), [netusb](<https://devfeed.tech/tags/netusb.md>), [network](<https://devfeed.tech/tags/network.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [pwn2own-austin](<https://devfeed.tech/tags/pwn2own-austin.md>), [remote-kernel](<https://devfeed.tech/tags/remote-kernel.md>), [reverse](<https://devfeed.tech/tags/reverse.md>), [router](<https://devfeed.tech/tags/router.md>), [routers](<https://devfeed.tech/tags/routers.md>), [security](<https://devfeed.tech/tags/security.md>), [tp-link](<https://devfeed.tech/tags/tp-link.md>), [tp-link-archer-c7-v5](<https://devfeed.tech/tags/tp-link-archer-c7-v5.md>), [zenith](<https://devfeed.tech/tags/zenith.md>)

### AI overview

A personal account of preparing for and entering the Pwn2Own 2021 Austin competition. The author describes reverse-engineering consumer router firmware, selecting a router target with teammates, and working toward participation in the contest.

### Source excerpt

Introduction In 2021, I finally spent some time looking at a consumer router I had been using for years. It started as a weekend project to look at something a bit different from what I was used to. On top of that, it was also a good occasion to play ...

## Exploiting a custom tetris game in CSAW Quals 2020

DevFeed: [Exploiting a custom tetris game in CSAW Quals 2020](<https://devfeed.tech/articles/exploiting-a-custom-tetris-game-in-csaw-quals-2020-39679.md>)

Original publisher: [Read original article](<https://mahaloz.re/2020/09/13/csaw-quals-2020-blox.html>)

Published: 2020-09-13T00:00:00Z

Content type: tutorial

Language: en

Sources: [mahaloz.re](<https://devfeed.tech/sources/mahaloz-re.md>)

Topics: [Code](<https://devfeed.tech/topics/code.md>), [arcade](<https://devfeed.tech/topics/arcade.md>), [Ghidra](<https://devfeed.tech/topics/ghidra.md>), [Reconnaissance](<https://devfeed.tech/topics/recon.md>), [Script](<https://devfeed.tech/topics/script.md>)

Tags: [ctf](<https://devfeed.tech/tags/ctf.md>), [game](<https://devfeed.tech/tags/game.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [pwn](<https://devfeed.tech/tags/pwn.md>), [reversing](<https://devfeed.tech/tags/reversing.md>), [solve](<https://devfeed.tech/tags/solve.md>), [writeup](<https://devfeed.tech/tags/writeup.md>)

### AI overview

This writeup explains how a custom Tetris game in CSAW Quals 2020 was analyzed and exploited. The challenge involved discovering cheat-piece placements, obtaining the binary, reverse-engineering its checks, and using an out-of-bounds write to obtain a partial write primitive and ultimately the flag.

### Source excerpt

Pwning a custom Tetris game through an out-of-bounds write to memory through block manipulation and changes to the `.text` segment.

## Reversing printf-as-a-VM service in Google Quals 2020

DevFeed: [Reversing printf-as-a-VM service in Google Quals 2020](<https://devfeed.tech/articles/reversing-printf-as-a-vm-service-in-google-quals-2020-39678.md>)

Original publisher: [Read original article](<https://mahaloz.re/2020/08/30/google-quals-2020-sprint.html>)

Published: 2020-08-30T00:00:00Z

Content type: tutorial

Language: en

Sources: [mahaloz.re](<https://devfeed.tech/sources/mahaloz-re.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [C](<https://devfeed.tech/topics/c.md>), [format](<https://devfeed.tech/topics/format.md>), [Google](<https://devfeed.tech/topics/google.md>), [Ghidra](<https://devfeed.tech/topics/ghidra.md>)

Tags: [c](<https://devfeed.tech/tags/c.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [format](<https://devfeed.tech/tags/format.md>), [game](<https://devfeed.tech/tags/game.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [reversing](<https://devfeed.tech/tags/reversing.md>), [vm](<https://devfeed.tech/tags/vm.md>)

### AI overview

This writeup explains how a Google Quals 2020 challenge implemented a virtual machine using C printf format strings. It covers reverse engineering the program, identifying the format-string instruction set and registers, and beginning to analyze the relevant format specifiers.

### Source excerpt

Solving a virtual machine implemented inside format strings found in the printf library in C with @kylebot.