Kong: Reverse Engineering Binary Files Using LLMs in Ghidra

Kong is a tool for automated reverse engineering of binary files, leveraging large language models (LLMs) to restore function names, data types, and structures in obfuscated and symbol-stripped binaries.

The tool integrates with Ghidra, performing function call analysis, type and name recovery, and writing results back into the Ghidra program database.

Key features of the solution include a fully autonomous analysis process and integration with Ghidra without requiring a server or RPC.

• Function analysis in call order
• Creation of rich context windows for LLMs
• Semantic synthesis and agent-based deobfuscation

Kong supports various architectures, including x86, x86-64, ARM, and AArch64, with varying levels of confidence in analysis results. The project is written in Python and is available at https://github.com/amruth-sn/kong.