biniamf/ai-reverse-engineering

AI-Assisted Reverse Engineering with Ghidra

# Rev·Deck — AI-Assisted Reverse Engineering with Ghidra Rev·Deck is a local, single-user static-analysis workstation. It pairs an evidence-first web UI with an LLM copilot over a binary analyzed by a headless Ghidra service: browse deterministic evidence (functions, strings, imports, cross-references, a bounded call graph) directly, or ask the assistant bounded questions whose factual claims must cite inspectable evidence. Analyzed binaries are never executed. The browser only talks to this Flask app; the app proxies validated, typed requests to the Ghidra service. ## Demo https://github.com/user-attachments/assets/fba14dc5-7ad5-4137-9349-ed824da64fbe ## Quick Start (Docker) ```bash cp .env.example .env # set API_BASE and MODEL_NAME; set API_KEY if required docker compose up --build ``` Docker Compose reads `.env` automatically for interpolation. It fails before starting if `API_BASE` or `MODEL_NAME` is missing; `API_KEY=not-used` remains valid for local/keyless providers. The stack starts both services. Open http://127.0.0.1:5000. To run only the Ghidra service: ```bash docker pull biniamfd/ghidra-headless-rest:latest # ensure the newest image docker run --rm \ -p 127.0.0.1:9090:9090 \ -v "$(pwd)/data:/data/ghidra_projects" \ --security-opt no-new-privileges:true \ biniamfd/ghidra-headless-rest:latest ``` For a reproducible pin, use the tested release digest instead of `latest`: ```bash docker run --rm \ -p 127.0.0.1:9090:9090 \ -v "$(pwd)/data:/data/ghidra_projects" \ --security-opt no-new-privileges:true \ biniamfd/ghidra-headless-rest:1.2.1@sha256:971591a3a8448d8ed969079b452306e806f36079c3ddd298f4a618d6e2f1442d ``` ## Prerequisites - Docker and Docker Compose (for the Quick Start path), or Python 3.10+ and Node.js 18+ (for running from source