Ghidra BizHawk MCP

Write bytes to BizHawk emulated memory at a given address. Use to patch game state, inject values, or modify emulated hardware registers in real time.

Import and analyze a binary into a named Ghidra session. Creates or replaces a session. Returns session_id, platform info, and function count. Call this first before any other Ghidra analysis tool.

Scan the current binary, match every function by structural fingerprint against a previously exported signature map, and rename matches automatically. Use after loading a new binary version to restore meaningful names.

Get the call graph for a function — shows which functions it calls (callees) and which functions call it (callers). Use after ghidra.decompile to understand function relationships.

Attach a comment to a code unit at a given address. Supports comment types: plate, pre, post, eol, repeatable. Use to document reverse-engineering findings inline.

Create a custom structured data type from a JSON member layout. Each member specifies offset (optional), field name, and type string. Use to model protocol headers, packet formats, and data structures.

Get cross-references to and from a given address. Shows what references the address and what the address references. Useful for understanding how data or code is used across the binary.

List all data types defined in the loaded program, including structures, enums, and typedefs. Useful for understanding the program's type landscape before creating new types.

Decompile a function by name or hex address. Returns decompiled C code. Use after session.analyze has loaded a binary.

Composite tool that bulk-decompiles all entry points in one call — program entry, exports, main, _start, etc. Use early in analysis to get an overview of the binary's surface area.

Decompile a function with line range, token budget, and optional summarization to prevent context-window exhaustion on large functions. Use for functions over 50 lines.

Compare two loaded sessions by function name and body size. Returns functions unique to each side and functions that changed between versions. Use for patch diffing and version comparison.

Disassemble N raw instructions at an address. Returns mnemonic, operands, hex bytes, and length for each instruction. Use for precise lower-level inspection when decompiled C is insufficient.

Headlessly execute a slice of instructions using Ghidra's P-code emulator. Seed initial register values and track value propagation across execution steps. No debugger, GDB stub, or network needed. Works on any Ghidra-supported architecture (ARM, x86, MIPS, etc.)

Execute instructions until a break condition is met or the instruction count expires. Supports equality (R0==0), inequality (R1>0xFF), not-equal (R2!=R3), and PC address (PC==0x1234). Stops before or after the matching instruction. Ideal for finding copy-loop bounds, null-pointer paths, or switch-table targets.

Execute an instruction slice with automatic taint tracking. Specify a taint register; the tool reports every step where its value is modified or propagates to other registers. Use to trace data flows through cryptographic routines or input processing.

Export a complete {structural_hash -> function_name} signature map for every function in the current binary. Save the output JSON to reuse across binary versions. Call before closing a session to preserve naming for future diffing.

Generate a behavior-based structural hash for a function that survives compiler shuffling and optimization changes across binary versions. Use with ghidra.apply_signatures for cross-version function matching.

Return a raw hex + ASCII dump for a byte range, equivalent to Ghidra's Listing panel. Complements ghidra.disassemble for inspecting data regions, strings, and padding.

Rename a function or label at a given address. Changes are stored in the Ghidra project database. Use to replace auto-generated names like FUN_* with meaningful identifiers.

Produce a Markdown summary of the active workspace — functions, entry points, custom symbols, recovered structures, renamed functions, and comment count. Replaces a GUI CodeBrowser window. Call at the end of a session to get a human-readable overview.

Change a local variable or function parameter's type annotation in the decompiled view. Use to replace generic types like undefined4* with meaningful types like MyStruct* for cleaner decompilation.

Search the entire loaded binary for a hex byte pattern. Returns matching addresses with context bytes and any string labels at the hit. Use to locate known constants, magic bytes, or patch locations.

Close and remove a Ghidra session workspace, freeing project resources. Cannot be undone. Use ghidra.sessions first to find active session IDs.

List all active Ghidra session workspaces with their session IDs, binary paths, and load timestamps. Useful before calling ghidra.session_close or ghidra.diff.

Zero-input auto-restore: hashes the loaded binary, looks up a previously stashed map by content hash, and renames matching functions automatically. Pair with ghidra.stash_auto_save for fully automatic cross-version name recovery.

Zero-input auto-stash: hashes the loaded binary's first 4 KB and saves a signature map under that hash. No group ID or user input needed. Just analyze and call.

List all stashed signature groups currently in the local server cache (~/.ghidra_bizhawk_mcp/signatures/). Use before ghidra.stash_restore to see available lineage_group_ids.

Load a previously stashed signature map by lineage_group_id and auto-rename every matching function in the current session. Use with ghidra.stash_save for persistent cross-version function name recovery.

Fingerprint all functions and stash the signature map server-side under a lineage_group_id label (e.g. 'my_firmware_v1'). No JSON file management needed — stored in ~/.ghidra_bizhawk_mcp/signatures/.

Examines raw file magic header signatures to detect retro console architectures (NES, SNES, GBA, NDS, Switch, PSX, Genesis, SMS, Dreamcast), headlessly maps correct Ghidra language loaders, hooks multi-session project bindings, and applies automated signature caching overlays. Single-call entry point for ROM analysis.