### Standard First-Time Setup and Deploy Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Use this sequence for initial setup on a new machine and to deploy the plugin. It installs dependencies, builds the plugin, and copies it to the Ghidra profile. ```bash python -m tools.setup ensure-prereqs --ghidra-path "C:\\ghidra_12.1_PUBLIC" ``` ```bash python -m tools.setup build ``` ```bash python -m tools.setup deploy --ghidra-path "C:\\ghidra_12.1_PUBLIC" ``` -------------------------------- ### Deploy Project with Setup CLI Source: https://github.com/bethington/ghidra-mcp/blob/main/tools/README.md Execute the deploy command using the setup CLI, providing the path to your Ghidra installation. This is part of the deployment process for the project. ```bash python -m tools.setup deploy --ghidra-path F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Recommended Script Order: Fresh Start Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/QUICK_REFERENCE_SCRIPTS.md For a new project or initial setup, run these scripts in the specified order. 'BuildHashIndex_ProjectFolder.java' creates the initial documentation index, 'FixSymbolConflicts_ProjectFolder.java' resolves naming issues, and 'BatchPropagateToAllVersions_ProjectFolder.java' applies documentation across all project versions. ```java 1. BuildHashIndex_ProjectFolder.java ├─ Choose: "Start Fresh" (for first run) └─ Output: ~/ghidra_function_hash_index.json 2. FixSymbolConflicts_ProjectFolder.java (optional) ├─ Choose: "Fix Conflicts Only" (if conflicts found) └─ Or "Cancel" (if no conflicts) 3. BatchPropagateToAllVersions_ProjectFolder.java ├─ Choose: "All Binaries in Project" └─ Propagates to all versions ``` -------------------------------- ### Verify Gradle version task example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/GRADLE_PHASE1_BACKLOG.md Provides example commands to run the `verifyVersion` task. This task compares the Ghidra version from `pom.xml` with the version reported by the Ghidra installation. It exits cleanly even if `GHIDRA_INSTALL_DIR` is not set. ```bash ./gradlew verifyVersion ./gradlew verifyVersion -PGHIDRA_INSTALL_DIR=F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Show All Setup CLI Subcommands Source: https://github.com/bethington/ghidra-mcp/blob/main/tools/README.md Use this command to display all available subcommands for the setup CLI. This is useful for understanding the full range of project setup, build, deploy, and version management operations. ```bash python -m tools.setup --help ``` -------------------------------- ### Prepare Ghidra classpath task example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/GRADLE_PHASE1_BACKLOG.md Demonstrates running the `prepareGhidraClasspath` task, which verifies the existence of 18 required Ghidra jars. Gradle uses `fileTree` directly for compilation, eliminating the need for `mvn install:install-file`. ```bash ./gradlew prepareGhidraClasspath -PGHIDRA_INSTALL_DIR=F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Build and Start Single GhidraMCP Instance Source: https://github.com/bethington/ghidra-mcp/blob/main/docker/README.md Build the Docker image and start a single instance of the GhidraMCP headless server using docker-compose. Use this for initial setup and testing. ```bash # Build and start cd docker docker-compose up -d # Check status curl http://localhost:8089/check_connection ``` -------------------------------- ### Gradle Start Ghidra Command Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/GRADLE_PHASE1_BACKLOG.md This command starts Ghidra using Gradle, integrated into the setup CLI. ```python cmd_start_ghidra → run_gradle(..., ['startGhidra']) ``` -------------------------------- ### Setup Commands with Gradle Backend Source: https://github.com/bethington/ghidra-mcp/blob/main/CLAUDE.md Use these commands when `TOOLS_SETUP_BACKEND` is set to `gradle`. This routes the same setup commands to a Gradle backend. ```bash $env:TOOLS_SETUP_BACKEND = "gradle" python -m tools.setup build python -m tools.setup preflight --ghidra-path F:\ghidra_12.1_PUBLIC python -m tools.setup deploy --ghidra-path F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Start Ghidra Application (macOS) Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Launches the Ghidra application. After starting, enable the GhidraMCP plugin via Tools > GhidraMCP > Start MCP Server. ```bash /opt/homebrew/opt/ghidra/libexec/ghidraRun ``` -------------------------------- ### Install Prerequisites (macOS) Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Installs necessary tools like OpenJDK, Maven, Python, and Ghidra using Homebrew. ```bash brew install openjdk@21 maven python ghidra ``` -------------------------------- ### Add Example Usage for New Tool Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md Create an example Python script in the `examples/` directory to demonstrate how to use the newly added MCP tool. ```python # examples/use-new-tool.py from bridge_mcp_ghidra import my_new_tool result = my_new_tool("example", param2=5) print(result) ``` -------------------------------- ### Running Ghidra Preflight Check Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md Execute the preflight check for Ghidra setup, specifying the path to your Ghidra installation. ```bash # 2. Run preflight against your Ghidra install python -m tools.setup preflight --ghidra-path "C:\path\to\ghidra" ``` -------------------------------- ### Start fun-doc Dashboard Only Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/README.md Use this command to start only the web dashboard without initiating any documentation workers. ```bash python fun_doc.py --no-worker ``` -------------------------------- ### Start Web Dashboard Separately Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/README.md This command starts only the web dashboard. It requires that fun_doc.py is already running to connect to the event bus. ```bash python web.py ``` -------------------------------- ### String Labeling Example with Suffixes Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/STRING_LABELING_CONVENTION.md Illustrates how to apply labels to strings, including examples of duplicate handling and descriptive suffixes like Fmt, Msg, Title, Dir, Alt, Upper, Lower, and Local. ```text szOpt_SmallOff # First instance szOpt_SmallOff2 # Second instance szOpt_SmallOff3 # Third instance ``` ```text Suffix | When to Use | Example -------|-------------|--------- `Fmt` | Format strings | `szDbg_TileCacheFmt` `Msg` | Message body | `szSecurity_BufferOverrunMsg` `Title` | Dialog title | `szSecurity_BufferOverrunTitle` `Dir` | Directory path | `szPath_MonstersDir` `Alt` | Alternative version | `szApi_MessageBoxA_Alt` `Upper` | Uppercase variant | `szDllName_Kernel32Upper` `Lower` | Lowercase variant | `szDll_D2GameLower` `Local` | Local/embedded copy | `szDllName_D2ClientLocal` ``` -------------------------------- ### Start fun-doc Dashboard and Worker Loop Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/README.md This command starts the main entry point for fun-doc, launching both the web dashboard and the idle worker loop for function documentation. ```bash python fun_doc.py ``` -------------------------------- ### Install Debugger Dependencies and Run Debugger Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Install optional Windows-only Python dependencies for the standalone debugger server and then run the debugger. ```text python -m pip install -r requirements-debugger.txt python -m debugger ``` -------------------------------- ### Install Ghidra Dependencies on Windows Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Installs Ghidra dependencies, ensuring all necessary JARs are available. Specify the Ghidra installation path using the --ghidra-path argument. ```text # Windows python -m tools.setup install-ghidra-deps --ghidra-path "C:\path\to\ghidra_12.1_PUBLIC" ``` -------------------------------- ### Feature Request Example Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md An example of how to structure a feature request, including title, use case, proposed solution, and priority. ```text Title: Add tool to analyze register usage patterns Use Case: Need to find functions that don't follow calling convention for obfuscation analysis Proposed Solution: New tool: analyze_register_usage(function_name) Returns: {"register_changes": {...}, "violations": [...]} Priority: Medium - helpful for malware analysis ``` -------------------------------- ### Ensuring Prerequisites Installation Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md Command to ensure all necessary prerequisites for Ghidra-MCP are installed, including specifying the Ghidra path. ```bash # 3. Install prerequisites python -m tools.setup ensure-prereqs --ghidra-path "C:\path\to\ghidra" ``` -------------------------------- ### Start fun-doc with a Specific Provider Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/README.md This command starts fun-doc and specifies a particular LLM provider, such as 'claude', to be used for documentation tasks. ```bash python fun_doc.py --provider claude ``` -------------------------------- ### Install System Prerequisites on Linux (Ubuntu/Debian) Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Installs essential system packages including OpenJDK, Maven, Python, pip, curl, jq, and unzip required for building Ghidra MCP on Ubuntu/Debian-based systems. ```bash sudo apt update && sudo apt install -y openjdk-21-jdk maven python3 python3-pip curl jq unzip ``` -------------------------------- ### Bug Report Example Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md An example of how to structure a bug report, including title, environment, steps to reproduce, and expected vs. actual behavior. ```text Title: Decompile timeout on binary > 10MB Environment: - OS: Windows 11 - Ghidra: 12.1 - Binary: 12MB x86-64 Steps: 1. Load 12MB binary in Ghidra 2. Wait for analysis 3. Call decompile_function("main") Error: RequestTimeout after 30 seconds Expected: Decompilation completes or returns gracefully ``` -------------------------------- ### Renaming Existing Files Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/NAMING_CONVENTIONS.md Illustrates renaming of existing files to comply with recommended conventions during migration. ```text CLAUDE.md ordinal_fix_log_*.txt Old reports Examples .py files Docs in docs/ ``` -------------------------------- ### Bump Project Version with Setup CLI Source: https://github.com/bethington/ghidra-mcp/blob/main/tools/README.md Use the bump-version command with the setup CLI to update the project's version number. Specify the new version using the --new flag. ```bash python -m tools.setup bump-version --new 5.10.0 ``` -------------------------------- ### File Layout Example Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/benchmark/regression/__schema__.md Illustrates the directory structure for regression assertion files. ```text fun-doc/benchmark/regression/ __schema__.md (this file) Benchmark.dll.yaml (assertions for /testing/benchmark/Benchmark.dll) BenchmarkDebug.exe.yaml (assertions for /testing/benchmark/BenchmarkDebug.exe) ``` -------------------------------- ### Field Offset Verification Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Example demonstrating how to verify field offsets by comparing structure definitions with actual assembly access. This helps ensure type accuracy. ```text Structure Definition Assembly Access Offset 0x0: dwType (uint) MOV EAX, [pUnit + 0x0] ✓ Offset 0x4: dwFlags (uint) CMP [pUnit + 0x4], 0 ✓ Offset 0x8: pNext (UnitAny*) LEA ECX, [pUnit + 0x8] ✓ ``` -------------------------------- ### Structure Alignment Verification Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Example illustrating how to verify structure alignment assumptions based on its fields. This is important for correct memory layout and access. ```text If structure has: DWORD (4 bytes) DWORD (4 bytes) WORD (2 bytes) WORD (2 bytes) Expected alignment: 4-byte (DWORD-aligned) Expected size: 12 bytes (3 DWORDs) ``` -------------------------------- ### Structure Alignment and Padding Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md An example detailing the identification of padding and alignment within a structure based on offset analysis. This helps in understanding the memory layout and potential unused bytes. ```text Offset 0x00-0x03: dwType (uint) - 4 bytes Offset 0x04-0x07: dwFlags (uint) - 4 bytes Offset 0x08-0x0B: [UNKNOWN] - 4 bytes Offset 0x0C-0x0D: wHealth (ushort) - 2 bytes Offset 0x0E-0x0F: [PADDING/ALIGNMENT] - 2 bytes ``` -------------------------------- ### Starting Standalone Debugger Server Source: https://github.com/bethington/ghidra-mcp/blob/main/CLAUDE.md Command to launch the standalone debugger server, which will listen on port 8099. ```bash python -m debugger ``` -------------------------------- ### Build and Run Ghidra-MCP Docker Container Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Builds and starts the Ghidra-MCP headless server in detached mode using Docker Compose. This is the quickest way to get the server running. ```bash # Build and run docker-compose up -d ghidra-mcp ``` -------------------------------- ### Setup Commands with Maven Backend (Default) Source: https://github.com/bethington/ghidra-mcp/blob/main/CLAUDE.md Default commands routed through the Maven backend. Includes build, preflight checks, dependency verification, and deployment. ```text python -m tools.setup build python -m tools.setup preflight --ghidra-path F:\ghidra_12.1_PUBLIC python -m tools.setup ensure-prereqs --ghidra-path F:\ghidra_12.1_PUBLIC python -m tools.setup deploy --ghidra-path F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Recommended Script Order: Updates Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/QUICK_REFERENCE_SCRIPTS.md When updating documentation after initial setup, follow this order. 'BuildHashIndex_ProjectFolder.java' merges new documentation into the existing index, and 'BatchPropagateToAllVersions_ProjectFolder.java' updates other versions from the current program. ```java 1. BuildHashIndex_ProjectFolder.java ├─ Choose: "Merge with Existing" └─ Updates index with new documentation 2. BatchPropagateToAllVersions_ProjectFolder.java ├─ Choose: "Current Program Only" └─ Updates all other versions from current ``` -------------------------------- ### Build Project Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/releases/RELEASE_CHECKLIST.md Compile the project. This is a standard build step. ```bash python -m tools.setup build ``` -------------------------------- ### Installing Debugger Dependencies Source: https://github.com/bethington/ghidra-mcp/blob/main/CLAUDE.md Optional command to install dependencies required for the debugger. ```bash python -m pip install -r requirements-debugger.txt ``` -------------------------------- ### Install Ghidra Dependencies into Maven (macOS) Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Installs Ghidra JARs into the local Maven repository using a Python script. Ensure the --ghidra-path is correctly set to your Ghidra installation directory. ```bash python -m tools.setup install-ghidra-deps \ --ghidra-path /opt/homebrew/opt/ghidra/libexec ``` -------------------------------- ### Log File Naming Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/NAMING_CONVENTIONS.md Example of a log file name adhering to the snake_case_date format. ```text build_log_20251105.txt ``` -------------------------------- ### Build the Benchmark Binary Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/benchmark/README.md Compile the fun-doc benchmark binary, which produces build/Benchmark.dll. This is a prerequisite for real mode. ```bash python fun-doc/benchmark/build.py ``` -------------------------------- ### Setup Ghidra Benchmark Integration Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/benchmark/README.md Import the compiled Benchmark.dll into a running Ghidra instance. This step is idempotent and can be run multiple times. The default import path is /testing/benchmark/Benchmark.dll, but can be overridden with FUNDOC_BENCHMARK_PROGRAM. ```bash python fun-doc/benchmark/setup_ghidra_benchmark.py ``` -------------------------------- ### Gradle Install Ghidra Dependencies Command Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/GRADLE_PHASE1_BACKLOG.md This command installs Ghidra classpath dependencies using Gradle. ```python cmd_install_ghidra_deps → run_gradle(..., ['prepareGhidraClasspath']) ``` -------------------------------- ### Maven Build Process Overview Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/MAVEN_VERSION_MANAGEMENT.md This outlines the steps involved in the Maven build process for version substitution. It highlights how Maven reads the `pom.xml` version and substitutes it into resource files. ```text 1. Developer updates pom.xml: X.Y.Z 2. Maven build runs: mvn clean package assembly:single 3. Maven processes resources: - Reads pom.xml version - Substitutes ${project.version} in version.properties - Substitutes ${project.version} in extension.properties 4. Java plugin loads version.properties at runtime 5. All APIs report correct version automatically ``` -------------------------------- ### Example Global Names Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/prompts/fix-globals.md Examples of valid global variable names following the required naming convention. ```text g_dwPlayerCount g_pMainUnit g_szConfigPath g_pfnCallback ``` -------------------------------- ### Run preflight check task example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/GRADLE_PHASE1_BACKLOG.md Shows how to execute the `preflight` task, which validates the Java environment, Ghidra jar presence, and write access to extension directories. This task depends on `verifyVersion`. ```bash ./gradlew preflight -PGHIDRA_INSTALL_DIR=F:\ghidra_12.1_PUBLIC ``` -------------------------------- ### Install Test Requirements Source: https://github.com/bethington/ghidra-mcp/blob/main/docker/README.md Install the necessary Python packages for running integration tests against the GhidraMCP headless server. ```bash # Install test requirements pip install -r tests/requirements.txt ``` -------------------------------- ### Initial Provider Policy Implementation Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/FUNCTION_DOCUMENTATION_SCALE_RFC.md Outlines the first steps for implementing provider policies, focusing on leveraging existing configurations and adding mode-specific defaults. ```text use existing provider configuration add per-mode defaults where needed ``` -------------------------------- ### Worker Started Acknowledgment Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/templates/dashboard.html Handles the 'worker_started_ack' event from the socket. This event typically signifies that a worker has successfully started or resumed. ```javascript socket.on('worker_started_ack', d => { /* pane created by worker_started event */ }); ``` -------------------------------- ### Field Offset Verification Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Example of verifying field offsets for specific functions, indicating successful access with a checkmark. ```markdown ProcessUnit: [pUnit + 0x0] = dwType ✓ ValidateUnit: [pUnit + 0x4] = dwFlags ✓ ApplyDamage: [pUnit + 0xC] = wHealth ✓ ``` -------------------------------- ### Complete Example: String Type Application Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/TOOL_USAGE_GUIDE.md Demonstrates the full process of applying a string data type, renaming it with Hungarian notation, and the expected return messages for each step. ```python # Address: 0x0040BC08, Data: "VIDEO" string (6 bytes) # Step 3a: Apply type apply_data_type("0x0040bc08", "char[6]") # Returns: "Successfully applied data type 'char[6]' at 0x0040bc08 (size: 6 bytes)" # Step 3b: Rename with Hungarian notation rename_or_label("0x0040bc08", "szVideoSection") # Returns: "Success: Renamed defined data at 0x0040bc08 to 'szVideoSection'" ``` -------------------------------- ### Endpoint Metadata Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/HEADLESS_PARITY_RFC.md Example JSON structure for an endpoint entry in the compatibility matrix, including headless status and requirements. ```json { "path": "/decompile_function", "method": "GET", "category": "decompile", "params": ["address", "program"], "description": "Decompile function", "compatibility": { "gui": true, "headless": true, "headless_status": "full", "reason": "", "workflows": ["function_docs", "batch_docs"], "requirements": { "requires_project": true, "requires_program": true, "requires_selection": false, "requires_codebrowser": false, "requires_gui_tool": false, "writes_project": false } } } ``` -------------------------------- ### Platform Plan: First Backend Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/project-management/DYNAMIC_KNOWLEDGE_VALIDATION_RFC.md Details the platform plan, starting with a cross-platform design contract and implementing the first backend for Windows/dbgeng targeting PE files. This establishes the initial environment for dynamic validation. ```text Design contract debugger-agnostic evidence model and workflow semantics. First backend Windows/dbgeng for PE targets. Later backends Linux/gdb and macOS/lldb. ``` -------------------------------- ### Example 3: Helper Structure Creation for Skill Execution Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Shows the creation of a helper structure, SkillObject, for tracking runtime skill execution state. Useful for managing temporary data related to function calls. ```text SkillObject (48 bytes): - dwType: uint (skill type identifier) - pOwnerUnit: UnitAny * (unit executing skill) - pTargetUnit: UnitAny * (target of skill) - dwSkillId: uint (skill index) - dwLevel: uint (skill level) - dwCharges: uint (remaining uses) - pSkillData: SkillData * (execution parameters) ``` -------------------------------- ### Verify Ghidra Installation Directory in Docker Source: https://github.com/bethington/ghidra-mcp/blob/main/docker/README.md Execute a command inside the Ghidra-MCP Docker container to verify the Ghidra installation path. ```bash docker exec ghidra-mcp ls /opt/ghidra ``` -------------------------------- ### Example 1: Identifying UnitAny Parameters Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Demonstrates identifying a UnitAny structure by analyzing function parameters, assembly access patterns, and cross-referencing similar functions. Useful for understanding game entity structures. ```text Function ProcessUnit (0x401000): Parameter 1: int * pUnit # Generic type Assembly: MOV EAX, [pUnit + 0x0] # Read at offset 0x0 CMP [pUnit + 0x4], 0 # Compare at offset 0x4 ``` ```text UnitAny * pUnit - dwType at offset 0x0 - dwFlags at offset 0x4 - wHealth at offset 0xC - ... (248 more bytes of game entity data) ``` -------------------------------- ### Commit Message Example Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md An example of a commit message following the conventional format, including type, scope, subject, body, and footer. ```git feat(tools): Add batch_analyze_structures tool - Implements bulk structure discovery - 90% API call reduction vs individual calls - Tested on 3 large binaries Closes #123 ``` -------------------------------- ### Invalid Plate Comment Examples Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/PLATE_COMMENT_BEST_PRACTICES.md Examples of plate comments that fail validation due to length, missing steps, or missing sections. ```text Process data. Parameters: - pContext: Context pointer Returns: Success code ``` ```text Algorithm: Initialize variables, validate inputs, process data, return result. Parameters: - pContext: Context pointer Returns: - 0 on success ``` ```text Algorithm: 1. Initialize 2. Process 3. Return This function processes data. ``` -------------------------------- ### High-Xref Bitfield Global Example Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/prompts/step-globals.md An example of a detailed plate-comment for a high-xref bitfield global, including 'Set by', 'Read by', 'Source', and 'Bitfield' sections. ```text Bitmap of currently-active quests for the player; bit N = quest N active. Set by: ProcessQuestUpdate, InitQuestState Read by: RenderQuestLog, IsQuestActive (and 14 other readers) Source: QuestC.cpp:0x14 Bitfield: 0x0001 = QUEST_DENOFEVIL 0x0002 = QUEST_SISTERS_BURIAL ``` -------------------------------- ### Build and Deploy Ghidra MCP (macOS) Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Ensures prerequisites are met, builds the project, and deploys the extension. The extension will be installed to ~/Library/ghidra/ghidra_12.1_PUBLIC/Extensions/GhidraMCP/. ```bash python -m tools.setup ensure-prereqs \ --ghidra-path /opt/homebrew/opt/ghidra/libexec python -m tools.setup build python -m tools.setup deploy \ --ghidra-path /opt/homebrew/opt/ghidra/libexec ``` -------------------------------- ### Install Ghidra Maven Dependencies on Linux Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Installs only the Ghidra JAR dependencies into the local Maven repository (`~/.m2/repository`) without building or deploying the extension. ```bash python -m tools.setup install-ghidra-deps --ghidra-path ~/ghidra_12.1_PUBLIC ``` -------------------------------- ### Type Application Summary Example Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md A summary format for documenting type application changes, including the number of functions updated, parameter, old type, new type, and verification details. ```markdown Total functions updated: 12 Parameter: pUnit Old type: int * New type: UnitAny * Verification: All functions access fields at 0x0-0xF8 ``` -------------------------------- ### Verify VC6 cl.exe Installation Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/benchmark/tools/vc6/README.md Run this command to check if the Visual C++ 6.0 compiler (cl.exe) is correctly installed and accessible in the expected path. ```bash ./tools/vc6/VC98/Bin/cl.exe ``` -------------------------------- ### Example 2: Creating SkillTableEntry Structure Source: https://github.com/bethington/ghidra-mcp/blob/main/docs/prompts/DATA_TYPE_INVESTIGATION_WORKFLOW.md Illustrates the process of creating a new structure, SkillTableEntry, based on offset analysis from multiple functions. Useful when existing structures do not match observed data access patterns. ```asm LEA ECX, [pSkillTable + EAX*0x23C + 0x1A4] # Stride 0x23C, offset 0x1A4 MOV EDX, [ECX] # Read at +0x1A4 CMP [ECX + 0x4], 0 # Compare at +0x1A8 ``` ```python create_struct("SkillTableEntry", [ {"name": "dwType", "type": "uint"}, {"name": "dwId", "type": "uint"}, # ... 100 more bytes of fields {"name": "dwShiftAmount", "type": "byte", "offset": 0x1A4}, {"name": "dwWeaponCoeff", "type": "byte", "offset": 0x1A5}, {"name": "dwBaseDamage", "type": "uint", "offset": 0x1A8}, # ... more fields ]) ``` -------------------------------- ### Preview Markdown Documentation Source: https://github.com/bethington/ghidra-mcp/blob/main/CONTRIBUTING.md Display the content of the endpoints.json file using the 'more' command for preview. ```bash cat tests/endpoints.json | more ``` -------------------------------- ### Worker Started Notification Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/templates/dashboard.html Adds an activity log entry when a worker starts, including details like provider, restoration status, and type (auto or count-based). ```javascript socket.on('worker_started', d => { addActivity(`Worker ${d.worker_id}: ${d.provider} ${d.restored ? 'restored ' : ''}${d.continuous ? 'Auto' : 'x' + d.count}`, 'scan'); }); ``` -------------------------------- ### /create_project Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Create a Ghidra project. ```APIDOC ## POST /create_project ### Description Create a Ghidra project. ### Method POST ### Endpoint /create_project ``` -------------------------------- ### Handle Worker Started Event Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/templates/dashboard.html Creates or retrieves a worker pane and appends a 'Worker started' message when a worker begins. It also ensures the 'Stop All' button is visible. ```javascript socket.on("worker_started", d => { getOrCreatePane(d.worker_id, d.provider, d.binary || ''); appendToPane( d.worker_id, d.restored ? `Worker restored after restart: ${d.provider} ${d.continuous ? 'Auto' : 'x' + d.count}` : `Worker started: ${d.provider} ${d.continuous ? 'Auto' : 'x' + d.count}`, 'scan' ); // Show Stop All button when any worker is running const stopAllBtn = document.getElementById('btnStopAll'); if (stopAllBtn) stopAllBtn.style.display = ''; }); ``` -------------------------------- ### Run Benchmark in Mock Mode (Default) Source: https://github.com/bethington/ghidra-mcp/blob/main/fun-doc/benchmark/README.md Execute the benchmark in mock mode with default settings for fast tier and baseline variant, comparing against the latest run. ```bash python fun-doc/benchmark/run_benchmark.py --mock --tier fast --compare ``` -------------------------------- ### Build Ghidra MCP Project Source: https://github.com/bethington/ghidra-mcp/blob/main/README.md Commands to set up prerequisites, build, and deploy the Ghidra MCP project using the Python-first workflow. Ensure Ghidra is installed and its path is correctly specified. ```bash # Recommended: direct Python-first workflow python -m tools.setup ensure-prereqs --ghidra-path "C:\\ghidra_12.1_PUBLIC" python -m tools.setup build python -m tools.setup deploy --ghidra-path "C:\\ghidra_12.1_PUBLIC" ```