AI 지원 역설계를 위한 모델 컨텍스트 프로토콜(MCP) 서버를 제공하는 기드라 확장

ReVa(리버스 엔지니어링 어시스턴트)는 AI 언어 모델이 Ghidra의 강력한 리버스 엔지니어링 기능과 상호작용할 수 있도록 하는 Ghidra MCP 서버입니다. ReVa의 활용 맥락 부패를 제한하고 가능하게 하는 최첨단 기법들 긴 형태의 역설계 과제들.

ReVa는 RE 업무를 위한 AI 어시스턴트 개발 노력과 달리, _tool 중심의 approach_을 사용한다는 점에서 다릅니다 효과적인 LLM 사용을 위한 도구 설계에 대해. ReVa는 LLM에 다양한 소형 도구를 제공하는 것을 목표로 하며, 이는 여러분의 RE 환경이 다양한 소형 도구를 제공하는 것과 같습니다 너에게.

LLM에 제공되는 모든 도구는 LLM이 사용하기 쉽고 다양한 입력을 견딜 수 있도록 설계되었습니다 그리고 LLM에 의한 환각을 줄이기 위해서입니다. 우리는 LLM에 스키마를 제공하되 다른 입력은 허용함으로써 이를 수행합니다. LLM을 안내하는 설명, 수정 가능한 실수를 LLM으로 되돌리는 설명, 그리고 추가적인 내용 LLM의 다음 결정을 안내하기 위해 출력을 내야 합니다.

ReVa 도구들은 다른 솔루션과 다르며, 더 작은 크기, 보강과 다른 조각들과의 연결 고리가 있는 중요한 조각들

ReVa - Ghidra MCP Server for AI-Powered Reverse Engineering

A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering

ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra’s powerful reverse engineering capabilities. ReVa uses state of the art techniques to limit context rot and enable long form reverse engineering tasks.

ReVa is different from other efforts at building AI assistants for RE tasks because it uses a tool driven approach with a focus on designing tools for effective LLM use. ReVa aims to provide a variety of small tools to the LLM, just as your RE environment provides a set of small tools to you.

Each of the tools given to the LLM are constructed to be easy for the LLM to use and to tolerate a variety of inputs and to reduce hallucination by the LLM. We do this by providing the LLM with a schema but tolerating other input, including descriptions that guide the LLM,and redirecting correctable mistakes back to the LLM, and including extra output to guide the next decision by the LLM.

ReVa’s tools differ to other solutions, they provide smaller, critical fragments with reinforcement and links to other relevant information to reduce context usage and hallucination. This greatly improves performance, especially on long form reverse engineering tasks. This allows ReVa to handle large binaries and even entire firmware images.

To encourage exploration as a human would, we report additional context like the namespace and cross references along with the decompilation, this is a small nudge to make the LLM explore the binary in the same way a human would.

Using this technique you can ask general questions and get relevant answers. The model prioritises information from the tools, but when there is no information it can still respond to generic questions from its training.

As an MCP server, ReVa can be used alongside other MCP servers to enrich its analysis. For example you can use the GitHub MCP Server to allow ReVa access to source code on GitHub, or the Kagi MCP Server to allow ReVa to search the web.

You can ask questions like:

• Examine the programs in this project and explain the relationship between the main binary and the shared libraries.
• What are the interesting strings in this program?
• Does this program use encryption? Write a markdown report on the encryption and where it is used.
• Draw a class diagram using plantuml syntax.
• Start from main, examine the program in detail. Rename variables as you go and provide a summary of the program.
• Explain the purpose of the __mod_init segment.
• What does mmap return?
• What does the function at address 0x80000 do?
• This is a CTF problem. Write a pwntools script to get the flag.