DecompFuncUtils

A Ghidra extension that enhances the decompiler with C++ reverse engineering utilities, including VTable reconstruction, struct field navigation, and inter-procedural taint analysis.

---

Installin The Plugin (Or Any Other Plugin)

• How to install the plugin you download from the releases.

Features

🔷 Memory-to-Struct Converter

Select a memory region in the Listing view and instantly create a struct with automatic field naming based on symbol references.

Capabilities:

• Select any memory range containing pointers
• Automatically resolves pointer targets to symbols/functions
• Creates sanitized field names from referenced symbols
• Applies the new struct at the selection address

Capabilities:

• Right-click on a vtable label or DATA reference in the decompiler
• Automatically scans for valid function pointers (supports 32/64-bit)
• Creates a struct with fields named after target functions
• Handles duplicate function names with automatic suffixes
• Updates existing vtable structures when the table changes

🔷 Struct Field Navigation

Double-click or use Ctrl+G on struct field names in the decompiler to navigate directly to the referenced function or label.

Use case: When analyzing a vtable like vtable->doSomething, double-clicking on doSomething jumps directly to that function.

---

Installation

From Release

1. Download the latest .zip from the Releases page
2. In Ghidra: File → Install Extensions → Add Extension
3. Select the downloaded zip file
4. Restart Ghidra

From Source

# Set your Ghidra installation path
export GHIDRA_INSTALL_DIR="/path/to/ghidra"

# Build the extension
gradle buildExtension

The built extension will be in dist/.

---

Usage

VTable Handler

1. In the Decompiler view, locate a constructor or function that references a vtable
2. Right-click on the vtable label (e.g., PTR_LAB_10154100)
3. Select "Create/Update VTable Structure"
4. Enter a name for the vtable struct
5. The plugin creates the struct and applies it at the vtable address

Struct Field Navigation

• Double-click on any struct field name in the decompiler
• Or use Ctrl+G with the cursor on a field name
• The plugin navigates to the target function/label if found

Memory-to-Struct Converter

1. In the Listing view, select a memory region (click and drag)
2. Right-click and select "Create Struct from Selection"
3. Enter a name for the new struct
4. The struct is created with pointer fields named after referenced symbols

---

Running Multiple Claude Sessions in Parallel

You can drive several binaries at once, one Claude Code session per Ghidra instance, with no cross-talk. Each Ghidra instance runs its own MCP server on its own port; each Claude session is routed to exactly one of them.

How it works

• When the MCP server starts, it grabs the first free port in 13100–13149 and advertises itself in ~/.ghidra-mcp/server-<pid>.json (port, project, and the loaded binary name). Stale files from crashed instances are pruned on start.
• The committed .mcp.json reads ${GHIDRA_MCP_URL:-http://localhost:13100/sse}, so the GHIDRA_MCP_URL set in a terminal decides which Ghidra that Claude session talks to. Unset, it falls back to the default port (single-session use).

Workflow

1. Open each binary in its own Ghidra instance and start its MCP server (Tools → MCP Server → Start, or enable MCP Auto Start in the options).

2. In a terminal, launch Claude bound to a specific instance. PowerShell:

   ./tools/ghidra-claude.ps1 -Binary libfoo.so   # route to the instance with libfoo.so open
   ./tools/ghidra-claude.ps1 -List               # list every live server first
   ./tools/ghidra-claude.ps1 -Port 13101         # pin an exact port

   Or Bash (Linux/macOS/Git Bash — needs curl and either jq or python):

   ./tools/ghidra-claude.sh --binary libfoo.so
   ./tools/ghidra-claude.sh --list
   ./tools/ghidra-claude.sh --port 13101

   The launcher exports GHIDRA_MCP_URL and starts claude in the same shell. Repeat in another terminal for another binary — the sessions never share state.

Because each session targets a separate Ghidra process (separate JVM and project database), edits, analysis, and decompilation in one can't damage or override another. Working two sessions on the same binary is not recommended — the database is protected from corruption, but the sessions will logically overwrite each other's renames/structs.

---

Requirements

• Ghidra 11.0 or later
• Java 17 or later
• Gradle (version matching your Ghidra installation)

---

License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

---

Author

Tomer Goldschmidt

---