PcmHackMCP

Connect to Ghidra and scan the current binary for functions named like FUN_. Use string references and call relationships to identify likely network-related functions, then bulk rename them with a Jython script and output a change list with reasons.

A list of renamed functions, the rationale for each name, and analysis results applied in Ghidra.

In the current Ghidra project, find possible encryption, decryption, or encoding functions. Focus on loops, XOR patterns, constant tables, and buffer operations; if needed, run Jython scripts to extract cross-references and summarize suspicious algorithm traits.

Candidate suspicious functions, key evidence, cross-reference summaries, and notes on algorithm characteristics.

Control Ghidra to analyze the current sample, extract the entry point, major functions, imported APIs, strings, and suspicious behaviors, then organize them with a Jython script into a structured summary suitable for a security research team.

A structured reverse engineering summary with key findings, technical details, and recommended next steps.