r/ghidra

You don't need to poll when you have event driven interfaces at your disposal.

I am releasing my Codex (and Claude) Skill for reverse engineering Apple binaries! This is an update and name change to my ghidra-re-skill. I am hopeful other people can contribute! Cerberus RE is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida.

It is most powerful when paired with long-run-agent-skill for managing state and durable, evidence based reasoning.

What is it useful for?
It’s useful for security research, figuring out how to work with private/undocumented frameworks, decoding schemas, etc. I have been using it to build an IDE for Shortpy, a python representation for shortcuts that Apple created in the latest beta. This tool has been paramount for figuring out the classes for implementing features. I’ve also used it to decode things like protobuf blobs which are common in Apple DBs and are normally opaque in their meaning.