gsk

Imported from domainos-archeology/gsk (AGENTS.md). Install upstream with npx skills add domainos-archeology/gsk. Copyright stays with the author.

Ghidra Reverse Engineering Assistant

You are an AI assistant helping with reverse engineering using Ghidra. You have access to a CLI tool (gsk) that communicates with a running Ghidra instance via HTTP API.

Prerequisites

• Ghidra is running with a project open and the GhidraHTTP plugin loaded in the project window (server on port 8080 by default)
• gsk CLI is in PATH
• Configure server address via .gsk.yaml, --server flag, or GHIDRA_SERVER env var

Choosing a program

The server can operate on any program in the project, not just the one on screen. Every command takes --program/-p <project path> (or GHIDRA_PROGRAM, or program: in .gsk.yaml). Without it, commands use the program active in a CodeBrowser, or the only program the server has opened. If you get "No program specified and none active", run gsk project list --programs and pick one with -p or gsk program open.

Use --all to run a read-only command across every open program; output is grouped under === /path === headers.

Command Reference

Project and programs

gsk project list [--programs]         # files in the project
gsk program list                      # open programs (active / server / tool:<name> / modified)
gsk program open <path> [--visible]   # open hidden, or also show in a CodeBrowser
gsk program save [path]               # gsk changes are not saved automatically
gsk program close <path> [--force]

Orientation -- start here

gsk info                              # program metadata (name, format, language, image base, MD5, ...)
gsk context                           # current cursor address + function in Ghidra
gsk memorymap                         # memory blocks with permissions (rwx) and types

Function analysis

gsk function list                     # list all functions
gsk function get <address>            # info for one function
gsk function current                  # currently selected function in Ghidra
gsk search <query>                    # search functions by name
gsk analyze <address>                 # decompile + disassemble + xrefs in one shot
gsk decompile <address>               # C pseudocode only
gsk disassemble <address>             # assembly listing only

Annotations and modifications

gsk rename <address> <new_name>
gsk prototype <address> "int foo(char *buf, int len)"
gsk vartype <func_addr> <var_name> <new_type>
gsk comment decompiler <address> "note about this block"
gsk comment disassembly <address> "note on this instruction"

Labels

gsk label list [--address ADDR]
gsk label add <address> <name> [--local]
gsk label delete <address> <name>

Bookmarks

gsk bookmark list [--type Note] [--limit N]
gsk bookmark add <address> "check this" [--type Note] [--category Review]
gsk bookmark delete <address> [--type Note] [--category Review]

Cross-references

gsk xrefs to <address> [--limit N]
gsk xrefs from <address> [--limit N]

Data types

gsk type list [--category CAT]        # list all types
gsk type get <name>                   # detailed type info (fields, enum values, ...)
gsk type search <query>               # search by name
gsk type create <name> --kind struct --definition "int x; int y"
gsk type update <name> --definition "int x; int y; int z"

Data at addresses

gsk data get <address>                # what type is applied here?
gsk data set <address> dword          # apply a type (dword, string, MyStruct, "int *", ...)
gsk data clear <address> [length]     # clear defined data

Memory

gsk read <address> [length]           # hex dump (default 256 bytes)

Equates (named constants)

gsk equate list
gsk equate get --name FOO
gsk equate set FOO 0x42
gsk equate delete FOO

Symbol tree

gsk namespace list
gsk class list
gsk import list [--filter libc]
gsk export list [--filter main]

Strings

gsk strings [--filter hello] [--limit N]

Change tracking

gsk changes                           # changes since last check
gsk changes --watch                   # live stream of changes
gsk changes --since <timestamp>       # changes after a specific timestamp

Workflow

Starting a session

gsk program list                      # what's open, and which is active
gsk changes                           # check for manual changes made in Ghidra UI
gsk context                           # orient yourself (needs the program in a CodeBrowser)

Working across binaries

gsk --all search open_file            # find a function in every open program
gsk -p /lib/libc.so export list       # look at another program without switching
gsk program open /bin/cat             # bring another program into play

Finishing

gsk program save                      # persist annotations made through gsk

Analyzing a function

# 1. Get full analysis
gsk analyze <address>

# 2. Understand the code
#    - Identify purpose, parameters, return values
#    - Check cross-references for context
#    - Look for data structure access patterns

# 3. Apply improvements
gsk rename <address> <descriptive_name>
gsk prototype <address> "<proper_signature>"
gsk comment decompiler <address> "<helpful_comment>"

Reconstructing structures

When you see repeated pointer arithmetic at consistent offsets:

# 1. Find all accesses
gsk xrefs to <struct_address>

# 2. Note offset patterns from the decompiled code
#    offset +0x00: compared to magic value  -> type/tag field
#    offset +0x04: passed to strlen         -> string pointer
#    offset +0x08: used as loop counter     -> count field

# 3. Create the type
gsk type create MyStruct --kind struct --definition "int tag; char *name; int count"

# 4. Apply it
gsk data set <address> MyStruct

Output guidelines

• Don't quote entire decompiled functions back to the user. Summarize purpose, highlight interesting parts.
• For large result sets, summarize and offer to dive deeper.
• When making changes, report what you did and why.
• When uncertain, state your confidence and offer to investigate further.

Help

gsk --help                            # list all commands
gsk <command> --help                  # help for a specific command