/AskJOE

This is a Ghidra script that calls OPENAI to give meaning to decompiled functions

Primary LanguagePython

AskJOE

What is AskJOE?

AskJoe is a tool that utilizes OpenAI to assist researchers wanting to use Ghidra as their malware analysis tool. It was based on the Gepetto idea. With its capabilities, OpenAI highly simplifies the practice of reverse engineering, allowing researchers to better detect and mitigate threats.

AskJOE Running

The tool is free to use, under the limitations of Github.

Author: https://twitter.com/charleslomboni | Threat Researcher, Security Joes

Updates - 05/23/2023

  • askChoices added
  • Explain selection added
  • Config file added

Updates - 05/11/2023

  • Execute all added
  • Stack String added
  • Rename function added
  • Changed color from function renamed added
  • Changed max_tokens

Updates - 05/08/2023

  • Code refactored
  • Explain function added
  • Simplify code added
  • Set OpenAI answer to comment added
  • Monitor messages added

Dependencies

Limitations

OpenAI has a hard limit of 4096 tokens for each API call, so if your text is longer than that, you'll need to split it up. However, OpenAI currently does not support stateful conversations over multiple API calls, which means it does not remember the previous API call.

How to install?

  • Copy the AskJOE files to the ghidra_scripts folder

ghidra_scripts