| get_programsA | List the open Ghidra programs and the one that is currently active. Program identifiers are based on the current Ghidra project name/path, not
the original imported filename. |
| executeA | Execute a Python snippet in Ghidra's scripting environment. The snippet runs inside Ghidra with full access to the Ghidra API via
PyGhidra.
Available variables:
- currentProgram: exactly one program, selected via the required
`program` argument
- flat: FlatProgramAPI-compatible script object
- toAddr(value): convert an address, function, symbol, or exact
function/label name to an Address
- Helpers: getBytes, getDataAt, getFunctionAt, getFunctionContaining,
getInstructionAt, getReferencesTo, getReferencesFrom
- state, monitor: Ghidra script state and task monitor
All Ghidra Java classes can be imported, e.g.:
from ghidra.program.model.symbol import SymbolType
from ghidra.app.decompiler import DecompInterface
Modifications are auto-wrapped in a transaction.
Use print() to return output.
The response includes:
- output: stdout captured from the snippet
- stderr: stderr captured from the snippet
- error: traceback string if execution failed
Program selection is based on the current Ghidra project name/path, not
the original imported filename. Use `get_programs()` to discover available
open programs.
Args:
code: Python code to execute in Ghidra.
program: Required Ghidra project path or name to target.
timeout: Bridge execution timeout in seconds.
|
| decompileA | Decompile the function at or containing target. Args:
target: Value accepted by the bridge's `toAddr`, such as `0x401000`,
`FUN_00401000`, or an exact label/function name. The function at or
containing the resolved address is decompiled.
program: Required Ghidra project path or name to target.
timeout: Decompiler timeout in seconds.
|
| disassembleA | Mark an address or address selection as code using Ghidra disassembly commands. Returns a compact text summary of the disassembled byte ranges.
With a single `target`, this behaves like the GUI Disassemble action at the
current location. With `end`, `length`, or `ranges`, it behaves like
invoking Disassemble with a listing selection. `restricted=True` uses the
same restricted-set behavior as Ghidra's Disassemble (Restricted) action.
`mode="default"` chooses the normal Ghidra disassembler, except for
architecture/language combinations where a more specific default is known:
PowerPC VLE languages default to VLE, ARM Thumb-default languages default
to Thumb, and MIPS microMIPS language variants default to their alternate
ISA mode.
Architecture-specific modes are available when supported by the selected
program language:
- `thumb` or `arm` for ARM/Thumb
- `vle` or `book-e`/`ppc` for PowerPC VLE languages
- `mips16` or `mips` for MIPS16/MicroMIPS-capable languages
- `xgate` or `hcs12` for HCS12/XGATE
- `x86_32` or `x86_64` for 32-bit compatibility disassembly in x86-64
Args:
program: Required Ghidra project path or name to target.
target: Address, exact label, or function name. Required unless
`ranges` is supplied.
end: Inclusive end address for a contiguous selection.
length: Byte length for a contiguous selection starting at `target`.
ranges: Optional list of range objects, each with `start` plus optional
`end` or `length`, for non-contiguous selections.
mode: Disassembly mode. Default uses Ghidra's normal Disassemble
command, but resolves to architecture-specific defaults for
PowerPC VLE, ARM Thumb-default, and MIPS microMIPS languages.
Special modes include `thumb`, `vle`, `book-e`, `mips16`,
`xgate`, and `x86_32`.
restricted: Restrict disassembly flow to the supplied selection/range.
enable_analysis: Submit new instructions for incremental analysis.
timeout: Bridge execution timeout in seconds.
|
| list_instructionsA | List disassembled instructions starting at an address or label. The result is a compact, hexdump-style text view with one instruction per
line: address, raw bytes, and instruction text. Pass either `end` for an
inclusive address range or `length` for a byte count. `max_count` limits
returned instructions; use 0 or None for no instruction-count limit.
Args:
target: Start address, exact label, or function name.
program: Required Ghidra project path or name to target.
end: Optional inclusive end address.
length: Optional byte length from target.
max_count: Maximum instructions to return. Use 0 or None for no limit.
|
| labelsA | Get matching labels or functions in the selected program. The response is JSON containing the matched labels with their short names,
qualified namespace paths, symbol types, addresses, and function
signatures when applicable. Global data labels also include their
datatype.
Each entry also reports `namespace` (the qualified parent namespace, or
null for global symbols) and `namespace_type` (e.g. `Class`, `Namespace`,
`Function`, or `GLOBAL`). These come from the real Ghidra `Namespace`
object, so C++ class membership is reported accurately. Use this to list a
class's methods, e.g. `namespace="MyClass"` or `namespace="ns::*"`.
`kind="user"` returns user-defined symbols only. `kind="functions"` returns
all discovered functions, including analysis-created default names.
`kind="all"` returns both user-defined symbols and all functions.
Filter behavior (applies to both `filter` and `namespace`):
- `*` returns all labels
- If the value contains glob metacharacters (`*`, `?`, `[]`), glob matching
is applied
- Otherwise, the value is treated as a case-sensitive substring
`filter` is matched against the symbol name, qualified name, and address.
`namespace` is matched against the qualified parent namespace.
Args:
program: Required Ghidra project path or name to target.
filter: Label filter expression. `*` returns all labels.
kind: One of `user`, `functions`, or `all`.
namespace: Parent-namespace filter. `*` returns labels in any
namespace. Match against the qualified namespace, e.g. `MyClass`.
|
| address_infoA | Return address context in one lookup. The response includes the resolved address, containing memory block,
symbols at the address, containing function, containing instruction,
containing data, and incoming/outgoing references.
Args:
target: Address, exact label name, or exact function name to inspect.
program: Required Ghidra project path or name to target.
|
| xrefsA | Get incoming and outgoing cross-references for an address, label, or function. The target is resolved through Ghidra's `toAddr()` helper, so normal
address strings, exact label names, and exact function names are accepted.
The response is JSON containing the resolved address plus both incoming and
outgoing references, including reference type and nearby label/function
context for the opposite end of each edge.
When `include_pointer_bytes` is true, initialized memory is also scanned
for raw pointer-sized values equal to the resolved address. These are byte
matches, not Ghidra reference records.
Args:
target: Address, exact label name, or exact function name to inspect.
program: Required Ghidra project path or name to target.
include_pointer_bytes: Also scan memory for raw pointer-byte matches.
|
| read_dataA | Read raw memory bytes or structured Ghidra data at an address or label. Raw mode returns a hexdump/xxd-style text view that includes both hex bytes
and printable ASCII by default. Pass `format` such as `u32be` with `count`
to decode raw integer tables as JSON. Structured mode returns compact JSON
for the defined data at, or containing, the resolved address, preserving
struct fields, arrays, unions, and pointer pointees without the older
metadata wrapper. `concise` remains accepted as a legacy alias for
`structured`.
If `length` is omitted in raw mode, the tool uses the remaining size of the
selected defined data item when available, otherwise it defaults to 64
bytes. If `count` is provided for a typed raw format, `length` is ignored
and the byte count is derived from `count * item_size`. Supplying `length`,
`count`, or a non-default `format` implies raw mode, so callers do not also
need to set `mode="raw"`.
Args:
target: Address, exact label name, or exact function name to inspect.
program: Required Ghidra project path or name to target.
mode: One of `structured` or `raw`. `concise` is accepted as a legacy
alias for `structured`.
length: Optional byte count for raw mode.
format: Raw output format: `hexdump`, `u8`, `u16be`, `u16le`, `u32be`,
`u32le`, `u64be`, `u64le`.
count: Optional number of typed raw values to read.
|
| memory_mapA | List memory blocks, or update permission flags for one memory block. With no `target`, this returns every block in the program memory map with
address range, size, permissions, initialization state, source name, and
comment. With `target`, select a block either by exact block name or by an
address contained in the block. Passing any permission argument changes that
block's corresponding flag before returning the updated block record.
Args:
program: Required Ghidra project path or name to target.
target: Optional block name or address inside a block.
read: Optional read permission value for the selected block.
write: Optional write permission value for the selected block.
execute: Optional execute permission value for the selected block.
volatile: Optional volatile flag value for the selected block.
|
| analyzeA | Run Ghidra auto-analysis for pending changes or the full program. `scope="changes"` matches Ghidra's incremental analysis of pending work.
`scope="all"` schedules and runs analysis over the full program.
Args:
program: Required Ghidra project path or name to target.
scope: Either `changes` or `all`.
timeout: Bridge execution timeout in seconds.
|
| searchA | Search program content. Scalar search finds instruction operand scalars/immediates and, if
requested, defined data scalar values. Pass one integer value or multiple
comma/space-separated values such as `0x27,0x67`.
Text search finds substring matches in instruction text, defined data text,
symbol names, comments, and decompiled functions depending on `where`.
`where="decompiled"` searches decompiler C output and returns matching
functions with line excerpts.
Byte search finds raw byte patterns in initialized memory. Queries accept
bytes separated by spaces or commas, or contiguous hex such as
`1d6c7ee1`. `context` controls how many bytes before and after each byte
match are included in the result. When
`include_nearby_function_pointers=true`, byte-search results also include
raw pointer-sized values in the returned context that resolve to function
entry points.
Args:
query: Search query. For scalar search, one or more integer values.
program: Required Ghidra project path or name to target.
kind: Search kind: `scalar`, `text`, or `bytes`.
where: Search scope. Scalar supports `instructions`, `data`, or `all`.
Text also supports `symbols`, `comments`, and `decompiled`. Byte
search currently scans initialized memory.
limit: Maximum matches to return. Use 0 or None for no limit.
case_sensitive: Use case-sensitive matching for text search.
context: Bytes of context before/after byte-search matches.
include_nearby_function_pointers: For byte search, report nearby raw
pointers that resolve to function entry points.
|
| create_functionA | Create a function at target, optionally with a user-defined name. If a function already starts at `target`, it is returned and renamed when a
`name` is provided. If `target` falls inside an existing function, no new
function is created and the containing function is returned.
When `target` is not yet an instruction, it is first disassembled in the
language's correct default ISA mode (PowerPC VLE, ARM Thumb-default, or
microMIPS), clearing any conflicting data, so entries are not mis-decoded
into broken boundaries.
Args:
target: Address, exact label, or function name where the function
should start.
program: Required Ghidra project path or name to target.
name: Optional user-defined function name.
|
| set_registerA | Set or assume a register value over an address range or selection. This writes a Ghidra program-context register value. Pass a single `target`,
optionally with `end` or `length`, or pass non-contiguous `ranges` entries
with `start` plus optional `end` or `length`.
Args:
register: Register name.
value: Integer register value, for example `0`, `13`, or `0x40000000`.
program: Required Ghidra project path or name to target.
target: Address, exact label, or function name. Required unless
`ranges` is supplied.
end: Inclusive end address for a contiguous selection.
length: Byte length for a contiguous selection starting at `target`.
ranges: Optional list of range objects, each with `start` plus optional
`end` or `length`, for non-contiguous selections.
|
| clearA | Clear selected program metadata using Ghidra's Clear With Options command. If `clear_types` is omitted or empty, every clear option is enabled,
matching a full Clear With Options selection. Otherwise, only the requested
`clear_types` are enabled. Supported values are:
`instructions`, `data`, `symbols`, `comments`, `properties`, `functions`,
`registers`, `equates`, `user_references`, `analysis_references`,
`import_references`, `default_references`, and `bookmarks`. `all` expands
to every clear type.
With a single `target`, this clears the code unit containing that address,
matching Clear With Options with no listing selection. With `end`, `length`,
or `ranges`, it clears over that selection.
Args:
program: Required Ghidra project path or name to target.
clear_types: Clear option names to enable exactly. Omit to clear all
supported types.
target: Address, exact label, or function name. Required unless
`ranges` is supplied.
end: Inclusive end address for a contiguous selection.
length: Byte length for a contiguous selection starting at `target`.
ranges: Optional list of range objects, each with `start` plus optional
`end` or `length`, for non-contiguous selections.
timeout: Bridge execution timeout in seconds.
|
| commentA | Set a Ghidra comment at an address, label, or function. The comment is written at the resolved address. Function names resolve to
the function entry point. Supported comment types match Ghidra's listing
comment slots: `plate`, `pre`, `eol`, `repeatable`, and `post`.
Args:
target: Address, exact label, or function name to comment.
text: Replacement comment text.
program: Required Ghidra project path or name to target.
comment_type: One of `plate`, `pre`, `eol`, `repeatable`, or `post`.
|
| renameA | Rename a function, global label/variable, function argument, or local variable. The target can be selected either with a compact typed selector or with the
`kind` and `function` arguments:
- `function:main` or `kind="function", target="main"`
- `global:g_counter` or `kind="global", target="0x404020"`
- `arg:#0@main`, `arg:argc@main`, or `kind="argument", function="main"`
- `local:uVar4@main` or `kind="local", function="main"`
- `var:name@main` or `kind="variable", function="main"` to match either
an argument or local variable
For the decompiler's "Split Out As New Variable" behavior, pass
`split_at` with the instruction address of the variable occurrence to
isolate, for example `target="local:res@handler", new_name="did_index",
split_at="0x90003482"`. The split variable is type-locked the same way
Ghidra's UI action does, so the split survives the next decompile.
If `kind` is `auto` and no `function` is supplied, the target is first
treated as a function at/containing the resolved address, then as a global
label/variable. Function, global, argument, and local renames are marked as
`USER_DEFINED` in Ghidra.
For C++, `new_name` may be namespace-qualified, e.g.
`new_name="MyClass::method"` or `new_name="ns::sub::g_table"`. The namespace
hierarchy is created if missing (missing levels become plain namespaces;
existing namespaces/classes are reused), and the function or global symbol
is placed in that namespace. To create a real C++ class first (so methods
land in a `Class` rather than a plain namespace), use `namespaces(...,
action="create", kind="class")`. Namespace-qualified names are only valid
for function and global renames, not argument/local variables.
Args:
target: Rename target selector. Local/argument selectors can use
`<kind>:<variable-or-#index>@<function>`.
new_name: Replacement name.
program: Required Ghidra project path or name to target.
kind: One of `auto`, `function`, `global`, `argument`, `local`, or
`variable`.
function: Function address/name for argument, local, or variable
renames when not using the `@function` selector syntax.
split_at: Optional instruction address of the local/argument
occurrence to split out as a new variable before renaming.
timeout: Decompiler timeout in seconds for local/argument renames.
|
| rename_batchA | Run multiple rename commands against the selected program in one request. Each command object accepts the same fields as `rename`: `target`,
`new_name`, optional `kind`, optional `function`, optional `split_at`, and
optional per-command `timeout`. Commands are executed sequentially in one
Ghidra snippet. The JSON result contains one entry per attempted command
with `ok: true` and the rename result, or `ok: false` and an error string.
Example command objects:
- `{"target": "function:main", "new_name": "app_main"}`
- `{"target": "arg:#0@main", "new_name": "argc"}`
- `{"target": "local:res@handler", "new_name": "did_index",
"split_at": "0x90003482"}`
Args:
commands: Rename command objects to execute sequentially.
program: Required Ghidra project path or name to target.
timeout: Default decompiler timeout in seconds for local/argument
renames. A command may override this with its own `timeout`.
stop_on_error: Stop after the first command failure when true.
|
| get_typesA | Return matching struct/enum type declarations as C header text. The `name` argument is a glob that matches either the datatype name or full
datatype path. Examples: `*`, `IMAGE_*`, `/my/category/Foo`.
Both direct structs/enums and typedefs that alias a struct/enum are
included, so normal C header style type names work as expected. Exported
enums also include comment directives like
`/* ghidra-mcp enum-size: Name=1 */` so enum storage sizes can be
round-tripped through `set_types()`.
Args:
program: Required Ghidra project path or name to target.
name: Glob used to match one or more types. `*` returns all supported
types in the selected program.
|
| set_typesA | Create or update one or more struct/enum types from C header text. The input accepts normal C header style declarations, including `typedef
struct`, `typedef enum`, plain `struct`, and plain `enum` definitions.
Enum sizes can be set with comment directives such as
`/* ghidra-mcp enum-size: Name=1 */`.
Field comments are accepted from trailing `// ...` or `/* ... */`
comments and are applied to the resulting struct members.
To intentionally leave unknown bytes in a struct, add explicit placeholder
fields using Ghidra's undefined types, for example:
`undefined1 _pad[3];`, `undefined2 _pad;`, `undefined4 _reserved;`.
Use that for deliberate gaps; omitted fields only produce whatever natural
ABI padding the parsed C layout would normally create.
Missing referenced types are resolved from the current program's datatype
manager when possible, so new definitions can refer to already-existing
program types without re-declaring them inline.
Imported structs are stored as explicit-layout, non-packed Ghidra structs
so their size and padding remain directly editable after import.
The return value is the stored type definitions exported back out of Ghidra
as C header text.
Args:
types: One or more type declarations in C header syntax.
program: Required Ghidra project path or name to target.
timeout: Timeout in seconds for the bridge-side parse/import/export.
|
| apply_typesA | Apply an existing datatype, or an array of it, at an address or label. The datatype must already exist in the selected program's datatype manager;
create it first with `set_types` when needed. `data_type` can be an exact
datatype name or full datatype path. It may also include a simple array
suffix such as `uds27_dispatch_entry[8]`; otherwise pass `count` to create
an array. When `clear_existing` is true, conflicting code/data units across
the target byte range are cleared before the new data is created.
Args:
target: Address or exact label where the data should be created.
data_type: Existing datatype name/path, optionally with `[count]`.
program: Required Ghidra project path or name to target.
count: Number of elements to apply. Use 1 for a single item.
clear_existing: Clear conflicting code/data over the byte range first.
timeout: Bridge execution timeout in seconds.
|
| namespacesA | List, create, or populate C++ namespaces and classes. Namespaces and classes are real Ghidra `Namespace`/`GhidraClass` objects,
not name prefixes. Use this to recover C++ structure in stripped firmware:
create a class per recovered vtable, then move its methods into it.
Actions:
- `list`: return the namespaces and classes in the program as JSON, each
with its qualified name, `type` (`Namespace`/`Class`/...), and member
count. Filter with `filter` (substring or glob over name/qualified name).
- `create`: create the namespace or class at `path` (a `::`-separated path
such as `MyClass` or `ns::sub::Inner`). Missing parent levels are created
as plain namespaces. `kind="class"` makes the final level a `GhidraClass`
(an existing plain namespace at that path is converted to a class);
`kind="namespace"` makes it a plain namespace. Existing entries are
reused, so this is idempotent.
- `move`: move the symbol at `target` (address, label, or function name)
into `namespace` (created if missing, honoring `kind`). Functions are
reparented; other symbols are moved with their name preserved.
- `type_methods`: for the class at `path`, set the first parameter of every
function member to `<class> *this` (adding one if a method has none) so
the decompiler propagates the class type. The class is created if missing.
Methods already typed with the class pointer are left as-is. Reports
`typed_methods` and `already_typed`. Use this to type a whole class at
once instead of calling `set_prototype` per method.
Args:
program: Required Ghidra project path or name to target.
action: One of `list`, `create`, `move`, or `type_methods`.
path: Namespace/class path for `create`/`type_methods`, e.g. `MyClass`
or `a::b::C`.
target: Symbol selector for `move` (address, label, or function name).
namespace: Destination namespace/class path for `move`.
kind: `namespace` or `class`; the kind of the final level that
`create`/`move` resolves or creates.
filter: Substring/glob filter for `list`. `*` returns everything.
|
| set_prototypeA | Set a function's prototype, including a C++ this pointer and methods. This is the main tool for typing C++ methods so the decompiler propagates
the class type through callers and grows the class struct. Datatypes are
resolved from the program's datatype manager (create them first with
`set_types` when needed). The result reports the signature before and after.
Two ways to specify the signature:
- `prototype`: a full C declaration string, e.g.
`"int process(MyClass *this, int cmd)"`. Parsed and applied as-is.
- structured: `return_type` (e.g. `"void"`), `parameters` (a list of
`{"name": ..., "type": ...}` objects; a bare type string is also
accepted), and optionally a leading `this` pointer (see below).
C++ method typing (structured mode):
- `class_name`: attach the function as a method of this class (a real
`GhidraClass`, created if missing) and, unless `this_type` is given, add a
leading `this` parameter of type `<class_name> *`. An empty struct named
after the class is created if one does not exist yet, so the decompiler
has a type to grow.
- `this_type`: explicit type for the leading `this` parameter, e.g.
`"MyClass"` (a ` *` is added if absent). Overrides the class-derived type.
`calling_convention` is applied only if the program's language defines it
(e.g. `__thiscall` exists on x86 but usually not on embedded targets); an
undefined convention is reported in `notes` and left unchanged. On most
embedded ABIs the `this` pointer is simply the first argument under the
default convention, which this tool sets up correctly without a special
convention. When you do use `__thiscall`, omit the explicit `this` (Ghidra
injects it); otherwise pass `this` via `class_name`/`this_type`.
Args:
target: Function selector (address, exact label, or function name).
program: Required Ghidra project path or name to target.
prototype: Full C declaration string. Takes precedence when supplied.
return_type: Return datatype name (structured mode).
parameters: Ordered parameter list as `{"name", "type"}` objects
(structured mode), excluding the auto-added `this`.
calling_convention: Optional calling-convention name to apply if the
language defines it.
this_type: Explicit `this`-pointer datatype (structured mode).
class_name: Class to attach the method to and derive `this` from.
timeout: Bridge execution timeout in seconds.
|
| vtableA | Recover a C++ vtable: type the function-pointer table at address. Point this at the start of a vtable (the address an object's vptr holds,
i.e. the first virtual-function slot — not the Itanium offset-to-top/typeinfo
prefix). It reads consecutive pointer-sized words, classifies each as a code
pointer or not (respecting the program's pointer size, endianness, and the
ARM/Thumb low bit), and reports the slots as JSON. This is discovery-by-hand:
you supply the address; it does not scan memory for vtables.
With `count` unset, slots are read until the first non-code pointer (bounded
by `max_count`). With `count` set, exactly that many slots are read.
When `apply` is true it also:
- creates a struct (`<class>_vtable` or `vtable_<address>`) of function
pointers — one named `vfuncN` field per slot, with the target function in
the field comment — and applies it at `address`;
- labels the table (as `<class>::vftable` when `class_name` is given);
- creates a function at each code slot when `create_functions` is true. A
slot whose target is not yet an instruction (stale data, or bytes left
decoded in the wrong ISA mode such as PowerPC VLE vs Book-E) is cleared
and re-disassembled in the language's correct default mode before the
function is created; slots that still can't be recovered are reported in
`unrecovered_slots` rather than silently skipped;
- when `class_name` is given and `type_methods` is true, reparents each slot
method into the class and sets its first parameter to `<class> *this`
(adding one if the method has no parameters), so the decompiler propagates
the class type. Reports `typed_methods`.
Set `apply=false` for a read-only report (always safe).
Args:
address: Start of the vtable (address or exact label).
program: Required Ghidra project path or name to target.
count: Exact number of slots to read. Omit to auto-detect by code-run.
max_count: Upper bound on slots when auto-detecting. Default 256.
apply: Create the struct/label/functions. False = report only.
create_functions: Create functions at slot targets (recovering stale or
wrong-ISA-mode targets first).
class_name: Associate the table with this class (created if missing);
the table is labeled `<class_name>::vftable`.
type_methods: When a class is given, reparent slot methods into the
class and type their `this` pointer. Default true; no-op without
`class_name`.
timeout: Bridge execution timeout in seconds.
|
