# SuperGhidra

> Python toolkit that speeds up Ghidra scripting, rewrites decompiler output into compilable C, and exposes guardrailed reverse-engineering tools to AI agents over MCP.

SuperGhidra is an open-source Python suite published by yuatemycat for reverse engineers working with Ghidra. It keeps a warm, read-only Ghidra daemon running, rewrites raw decompiler output into compilable C, and recovers C++ class structures from binaries. The latest listed release is v0.3.0, and the code is licensed under AGPL-3.0-or-later.

## What It Is

SuperGhidra is a collection of Python packages and a CLI for static binary analysis. Some parts attach to a live Ghidra project, while others run as standalone Python with no JVM. It adds analyses Ghidra does not include out of the box: MSVC RTTI and MFC CRuntimeClass recovery, Serialize() archive layout tracing, cross-version function and struct-shift matching, and a Z3-based equivalence checker for P-code.

## Lock-free Ghidra access

Ghidra locks .rep projects exclusively, so headless scripts fail while the GUI is open. SuperGhidra serves reads from a background daemon on 127.0.0.1:5073, backed by a SQLite query cache. Writes such as renames, comments and types go to a JSON overlay and fork journal instead of the project. Users can then sync changes into an open CodeBrowser through a generated script (with an optional live watcher), or replay the journal headlessly with merge_fork.

## Agent and MCP workflow

Through the companion SuperghidraMCP server, the README says 38 reverse-engineering tools are exposed to Claude Desktop, Cursor, Antigravity and Claude Code. Agents can inspect binaries, query call graphs and propose renames. Commits are gated by deterministic checks on vtable slots, field displacements and allocation sizes. The LLM naming stage needs a real endpoint, and without one it falls back to neutral names such as sub_<addr>.

## Scope and limitations

The standalone `superghidra decompile` subcommand is experimental and handles only a small x86-64 integer subset; real decompilation should use `ghidra_oracle.py decompile`. The Z3 checker returns UNKNOWN on floating-point operations, unhandled instructions and long loops by design. The storage codec works on external .sgdb files rather than live Ghidra projects. Optional extras cover WGPU ARM64 scanning, LZ4/Zstd page compression, Frida and the PyGhidra bridge.

## Features
- Persistent read-only Ghidra daemon with SQLite L2 query cache
- Non-destructive JSON write overlay and fork journal with merge_fork
- Live Ghidra GUI overlay sync script generator with watch mode
- CompilableDecompilerFilter rewrites raw decompiler output into compilable C
- MSVC RTTI and MFC CRuntimeClass recovery without Ghidra
- Serialize() archive layout tracing
- Cross-version CFG function matching and struct-shift migration
- Z3 P-code equivalence checker for ARM64/x86-64 lifted code
- ELF/PE/Mach-O loader with DWARF 5, Breakpad and .map export
- IDA .til import and FLIRT signature matching
- Optional WGPU/NumPy ARM64 ADRP and prologue scanning
- 38 MCP tools via SuperghidraMCP with commit guardrails
- APK-to-JNI cross-referencer and allow-listed Android emulator memory reader

## Integrations
Ghidra, PyGhidra, OpenJDK 21, Claude Desktop, Claude Code, Cursor, Antigravity, Model Context Protocol, Z3, Frida, IDA Pro

## Platforms
WINDOWS, MACOS, LINUX, ANDROID, WEB, API, DEVELOPER_SDK, CLI

## Pricing
Open Source

## Version
0.3.0

## Links
- Website: https://github.com/yuatemycat/SuperGhidra
- Repository: https://github.com/yuatemycat/SuperGhidra
- EveryDev.ai: https://www.everydev.ai/tools/superghidra