LinusandClaude Opus 5.5
ab9bb3eae9
unblob 26.6.4 (the version REA is verified with) is installed from its PyPI wheel into /opt/unblob, with dependencies pinned to its uv.lock at the release commit. A wrapper puts that venv first on PATH, and REA_UNBLOB_COMMAND points REA's extract_firmware at it. Its extractors follow upstream's install-deps.sh: Ubuntu packages, sasquatch v4.5.1-6 (also used by binwalk) and onekey-sec's e2fsprogs fork, whose debugfs rdump options the ext2/3/4 handler needs. The build checks that unblob finds every extractor. The uv.lock converter moves to scripts/ and skips the locked project itself generically, since ghidra-mcp and unblob both use it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude_re_setup
A Docker-based reverse-engineering workstation for Linux. Claude Desktop is connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and binwalk, unblob and esptool are installed alongside them. Nothing beyond Docker and an X server (or XWayland) is needed on the host.
Usage
./run.sh # build the image if needed, pick a folder to share, start
./run.sh --build # rebuild the image first
./run.sh --workspace ~/re/target-x # share this folder without asking
docker stop claude-desktop # stop everything
The shared folder is mounted at /workspace in both containers. Sign in to
Claude Desktop on every start; the sign-in is not kept. Closing Claude
Desktop or Ghidra's project window stops everything.
What runs where
| Container | Contents | Network |
|---|---|---|
claude-desktop |
Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal |
claude-re-mcp |
REA MCP server (headless Ghidra, binwalk, unblob), no display | internal only, no internet |
Both containers run from the same image. REA gets its own container because
some of its tools run the target. Claude Desktop reaches it at
http://rea:8765/mcp through mcp-remote.
MCP servers in Claude Desktop (claude-desktop/claude_desktop_config.json):
- ghidra: needs a program open in Ghidra's CodeBrowser.
- rea: opens files from
/workspaceby itself, with its own headless Ghidra project.
Sources
- Claude Desktop: Anthropic's apt repository (https://code.claude.com/docs/en/desktop-linux)
- Ghidra 12.1.4: https://github.com/NationalSecurityAgency/ghidra
- GhidraMCP 2.0: https://github.com/LaurieWired/GhidraMCP
- ESP32 Flash Loader: https://github.com/dynacylabs/ghidra-esp32-flash-loader
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm
rea-agents - mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
- unblob 26.6.4: https://github.com/onekey-sec/unblob
- esptool 5.6.0: https://github.com/espressif/esptool
Versions and checksums are pinned in the Dockerfile. CLAUDE.md has the
details.