一个提供模型上下文协议（MCP）服务器的 Ghidra 扩展，用于人工智能辅助逆向工程

ReVa（逆向工程助手）是一款Ghidra MCP服务器，使AI语言模型能够与Ghidra强大的逆向工程能力交互。ReVa的使用 最先进的技术限制上下文腐烂并促成 长版逆向工程任务。

ReVa与其他为RE任务构建AI助手的努力不同，因为它采用了_tool驱动的approach_，并以一个重点 关于设计有效使用大型语言模型的工具。 ReVa旨在为LLM提供各种小型工具，就像你的房地产环境提供一套小工具一样 对你来说。

提供给LLM的每一种工具都设计得易于LLM使用，并能容忍各种输入 并减少LLM的幻觉。我们通过为LLM提供一个模式，但容忍其他输入来实现这一点， 包括指导LLM的描述，并将可纠正错误引导回LLM中，以及额外的内容 输出以指导LLM的下一步决策。

ReVa 的工具与其他解决方案不同，它们提供更小的， 关键片段与强化及关联

ReVa - Ghidra MCP Server for AI-Powered Reverse Engineering

A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering

ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra’s powerful reverse engineering capabilities. ReVa uses state of the art techniques to limit context rot and enable long form reverse engineering tasks.

ReVa is different from other efforts at building AI assistants for RE tasks because it uses a tool driven approach with a focus on designing tools for effective LLM use. ReVa aims to provide a variety of small tools to the LLM, just as your RE environment provides a set of small tools to you.

Each of the tools given to the LLM are constructed to be easy for the LLM to use and to tolerate a variety of inputs and to reduce hallucination by the LLM. We do this by providing the LLM with a schema but tolerating other input, including descriptions that guide the LLM,and redirecting correctable mistakes back to the LLM, and including extra output to guide the next decision by the LLM.

ReVa’s tools differ to other solutions, they provide smaller, critical fragments with reinforcement and links to other relevant information to reduce context usage and hallucination. This greatly improves performance, especially on long form reverse engineering tasks. This allows ReVa to handle large binaries and even entire firmware images.

To encourage exploration as a human would, we report additional context like the namespace and cross references along with the decompilation, this is a small nudge to make the LLM explore the binary in the same way a human would.

Using this technique you can ask general questions and get relevant answers. The model prioritises information from the tools, but when there is no information it can still respond to generic questions from its training.

As an MCP server, ReVa can be used alongside other MCP servers to enrich its analysis. For example you can use the GitHub MCP Server to allow ReVa access to source code on GitHub, or the Kagi MCP Server to allow ReVa to search the web.

You can ask questions like:

• Examine the programs in this project and explain the relationship between the main binary and the shared libraries.
• What are the interesting strings in this program?
• Does this program use encryption? Write a markdown report on the encryption and where it is used.
• Draw a class diagram using plantuml syntax.
• Start from main, examine the program in detail. Rename variables as you go and provide a summary of the program.
• Explain the purpose of the __mod_init segment.
• What does mmap return?
• What does the function at address 0x80000 do?
• This is a CTF problem. Write a pwntools script to get the flag.