3.4 KiB
Headless Reverse Engineering
This context describes how users ask reproducible, read-only questions about binaries through Ghidra without managing Ghidra's internal project model.
Language
Sample: An immutable sequence of input bytes identified by a cryptographic content digest. Identical bytes are the same Sample even when they have different file names or locations. Avoid: Binary, file, target
Analysis Profile: The canonical analysis inputs other than the Sample, including Ghidra and Java versions, Target Specification, fully resolved loader and analyzer options, analysis-adapter version, and maximum CPU count. Avoid: Configuration, settings
Target Specification: The loader, executable format, processor language, and compiler specification used by Ghidra to interpret a Sample. Avoid: Architecture, target
Analysis: The reusable body of facts Ghidra derives from one Sample under one Analysis Profile. Avoid: Project, database, workspace
Quarantined Analysis: Analysis data that failed integrity validation and is retained for diagnosis but can never satisfy a Query. Avoid: Analysis, cache miss
Query: A read-only question evaluated against an Analysis. A Query cannot change the Sample or Analysis. Avoid: Command, job, operation
Function: A Ghidra-discovered unit of executable behavior identified within an Analysis by its entry Address. Avoid: Symbol, method
Function Selector: An unambiguous reference used to choose a function by address or resolved symbol name. Avoid: Function name, function ID
Call Edge: A directed relationship from a caller Function through a callsite Address to a resolved or unresolved callee, produced by a future targeted Query. Avoid: Call, dependency
Reference: A Ghidra-derived relationship from one Address to another Address or external symbol, produced by a future targeted Query. Avoid: Pointer, cross-reference result
Address: A location within an Analysis identified by an explicit Ghidra address space and an offset whose width is defined by that space. Avoid: Integer, offset, pointer
Artifact: A durable, schema-versioned representation of a Query result tied to its Analysis. Avoid: Output, report, result file
Diagnostic Log: A tool-owned record of execution diagnostics that may explain an Analysis or Query failure but is not part of the Query result. Avoid: Artifact, output
Invocation: One synchronous attempt by the Rust harness to run a bounded Ghidra/Java operation and validate its response. Avoid: Job, session, worker
Worker Sandbox: The capability-limited environment containing only the untrusted Ghidra/JVM child for one Invocation; the trusted Rust harness remains outside it. Avoid: Analysis Store, containerized CLI
Cleanup Transaction: Tool-owned staged data that has been removed from active store visibility and is awaiting complete deletion or a recoverable retry. Avoid: Analysis, quarantine
Target Verification: The declared relationship between a Target Specification and the project's integration-test matrix: either verified or unverified. Avoid: Ghidra confidence, supported Sample
Analysis Store: The tool-owned collection of reusable Analyses, Quarantined Analyses, Artifacts, and Diagnostic Logs. It is disposable and never contains the authoritative Sample. Avoid: Project directory, cache directory, workspace