SuperGhidra

SuperGhidra is an open-source Python suite published by yuatemycat for reverse engineers working with Ghidra. It keeps a warm, read-only Ghidra daemon running, rewrites raw decompiler output into compilable C, and recovers C++ class structures from binaries. The latest listed release is v0.3.0, and the code is licensed under AGPL-3.0-or-later.

What It Is

SuperGhidra is a collection of Python packages and a CLI for static binary analysis. Some parts attach to a live Ghidra project, while others run as standalone Python with no JVM. It adds analyses Ghidra does not include out of the box: MSVC RTTI and MFC CRuntimeClass recovery, Serialize() archive layout tracing, cross-version function and struct-shift matching, and a Z3-based equivalence checker for P-code.

Lock-free Ghidra access

Ghidra locks .rep projects exclusively, so headless scripts fail while the GUI is open. SuperGhidra serves reads from a background daemon on 127.0.0.1:5073, backed by a SQLite query cache. Writes such as renames, comments and types go to a JSON overlay and fork journal instead of the project. Users can then sync changes into an open CodeBrowser through a generated script (with an optional live watcher), or replay the journal headlessly with merge_fork.

Agent and MCP workflow

Through the companion SuperghidraMCP server, the README says 38 reverse-engineering tools are exposed to Claude Desktop, Cursor, Antigravity and Claude Code. Agents can inspect binaries, query call graphs and propose renames. Commits are gated by deterministic checks on vtable slots, field displacements and allocation sizes. The LLM naming stage needs a real endpoint, and without one it falls back to neutral names such as sub_.

Scope and limitations

The standalone superghidra decompile subcommand is experimental and handles only a small x86-64 integer subset; real decompilation should use ghidra_oracle.py decompile. The Z3 checker returns UNKNOWN on floating-point operations, unhandled instructions and long loops by design. The storage codec works on external .sgdb files rather than live Ghidra projects. Optional extras cover WGPU ARM64 scanning, LZ4/Zstd page compression, Frida and the PyGhidra bridge.