AwesomeREA.org

Integration

Kong

Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.

Requirements and limitations

  • The reviewed main commit is 25 commits after the v0.2.2 release of 2026-03-18, which matches kong-re 0.2.2 on PyPI; those later commits add an unreleased Rust kong-ml crate and XDA model-training scripts that the README does not describe. Kong needs Python 3.11+ with uv, a local Ghidra installation and JDK 21+, which it detects or reads from GHIDRA_INSTALL_DIR and JAVA_HOME. Its commands are kong setup, analyze, info and eval, with a Textual interface or --headless output.
  • Analysis needs an Anthropic or OpenAI API key, or an OpenAI-compatible endpoint passed with --base-url, and sends each function’s decompilation with its cross-references, strings and neighbouring signatures to that service; Kong tracks token use and estimated cost per model. Users supply the binary to analyse, and the repository ships no target binaries.
  • The README rates its confidence by architecture and source language: high for C and C++ on x86, x86-64, ARM and AArch64, medium or low for Go, Rust, MIPS and PowerPC, and lower as binaries grow. Obfuscation is detected by patterns in the decompiled text before the deobfuscation pass. BENCHMARKS.md reports a single run with claude-opus-4-6 on a stripped liblzma.so.5.4.1 from the backdoored XZ Utils 5.6.1 (CVE-2024-3094): 355 of 396 queued functions analysed in 15 minutes for $6.63, with the five core implant functions found at model-reported confidence of 90–95%. These are author results, not reproduced here.
  • The kong eval command scores analysis.json against ground-truth source, using word-based Jaccard matching for names and signature-component scoring for types; no evaluation results are published. CI runs the pytest suite on Python 3.11 to 3.14 for pull requests. This collection reviewed source and documentation without running Kong, Ghidra or any model.
  • Apache-2.0 per LICENSE and pyproject.toml; Ghidra, model services and analysed binaries keep their own terms. The README names KeygraphHQ’s Shannon web-pentesting pipeline as its inspiration. The reviewed sources establish no REA connection.

About this entry

Type
Integration
Category
Independent agent workflows
Relationship
Independent agent integration
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · amruth-sn/kong · Revision 8c4ee4b
  2. BENCHMARKS.md GitHub · amruth-sn/kong · Revision 8c4ee4b
  3. pyproject.toml GitHub · amruth-sn/kong · Revision 8c4ee4b
  4. kong/__main__.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  5. kong/agent/deobfuscator.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  6. kong/llm/tools.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  7. kong/evals/metrics.py GitHub · amruth-sn/kong · Revision 8c4ee4b
  8. .github/workflows/ci.yml GitHub · amruth-sn/kong · Revision 8c4ee4b
  9. LICENSE GitHub · amruth-sn/kong · Revision 8c4ee4b
  10. https://github.com/amruth-sn/kong/releases/tag/v0.2.2
  11. https://pypi.org/project/kong-re/0.2.2/
  12. https://github.com/amruth-sn/kong/compare/v0.2.2...8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2