Skip to content

Initial Release

Choose a tag to compare

View all tags
@Karib0u Karib0u released this 09 Nov 22:23
· 17 commits to main since this release
v1.0.0
6200508

🎉 kernagent - Initial Release

Turn binaries into conversations — offline, deterministic, and verifiable.

kernagent is an AI-powered reverse-engineering copilot built on top of Ghidra snapshots. It converts binaries into portable analysis bundles, then lets an LLM answer questions about them with real evidence.

🌟 Key Features

Core Capabilities

  • Snapshot-first architecture: Full Ghidra/PyGhidra extraction creates immutable, portable analysis bundles
  • Evidence-based analysis: All claims backed by real artifacts (functions, strings, imports, xrefs, decompilation)
  • Model-agnostic: Works with any OpenAI-compatible API (OpenAI, local models, custom gateways)
  • Deterministic & reproducible: Same snapshot → same results

Commands

  • summary: Executive overview of binary purpose, capabilities, and key artifacts
  • ask: Interactive Q&A with tool-using agent over the snapshot
  • oneshot: Deterministic triage mode for CI, bulk analysis, and pipelines

Rich Tool API

The agent has access to 15+ read-only tools including:

  • Function search and metrics
  • Decompilation reading
  • Call graph traversal
  • String, import, and data search
  • Cross-reference resolution
  • Memory section analysis

🛠️ Built With

  • Python 3.12+
  • Ghidra 11.x
  • PyGhidra 2.2+
  • Docker
  • OpenAI-compatible APIs

🚀 Quick Start

Linux / macOS / WSL2:

curl -fsSL https://raw.githubusercontent.com/Karib0u/kernagent/main/install.sh | bash

Manual installation:

git clone https://github.com/Karib0u/kernagent.git
cd kernagent
bash install.sh

Then run:

kernagent summary /path/to/binary.exe
kernagent ask /path/to/binary.exe "What does this binary do?"
kernagent oneshot /path/to/binary.exe

🔒 Design Principles

  • Read-only: Never mutates binaries
  • Static-only: No execution of untrusted code
  • Deterministic: Same inputs → same outputs
  • Model-neutral: Bring your own LLM endpoint
  • Auditable: All claims map back to addresses and artifacts

📚 Use Cases

  • Malware triage pipelines
  • Legacy/vendor binary documentation
  • Security audits and reviews
  • Reverse engineering workflows
  • Supply chain analysis

For complete documentation, examples, and usage guides, see the README.

Assets 2
Loading