Reverse Engineering: Agent/Ghidra Automation Loop

When to use

• An agent automates Ghidra: open a program, triage functions, annotate, recover types, diff before/after.
• A verdict must be produced from a binary (identity, packing, obfuscation, patch target) and reported with a confidence level.
• Writing a byte patch via script and needing read-back verification.
• Deciding between PyGhidra in-process (open_program) and the headless analyzer (analyzeHeadless) for a batch job.

When not to use

• Interactive manual RE in the GUI — the loop discipline applies to scripts.
• Decoding raw shellcode bytes — use reverse-engineering-shellcode-analysis.
• Recovering types from objdump output without Ghidra — use binary-analysis-type-recovery.
• Building exploits — analysis discipline only.