LinusandClaude Opus 5.5
ab9bb3eae9
unblob 26.6.4 (the version REA is verified with) is installed from its PyPI wheel into /opt/unblob, with dependencies pinned to its uv.lock at the release commit. A wrapper puts that venv first on PATH, and REA_UNBLOB_COMMAND points REA's extract_firmware at it. Its extractors follow upstream's install-deps.sh: Ubuntu packages, sasquatch v4.5.1-6 (also used by binwalk) and onekey-sec's e2fsprogs fork, whose debugfs rdump options the ext2/3/4 handler needs. The build checks that unblob finds every extractor. The uv.lock converter moves to scripts/ and skips the locked project itself generically, since ghidra-mcp and unblob both use it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
# claude_re_setup
|
|
|
|
A Docker-based reverse-engineering workstation for Linux. Claude Desktop is
|
|
connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and
|
|
binwalk, unblob and esptool are installed alongside them. Nothing beyond
|
|
Docker and an X server (or XWayland) is needed on the host.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
./run.sh # build the image if needed, pick a folder to share, start
|
|
./run.sh --build # rebuild the image first
|
|
./run.sh --workspace ~/re/target-x # share this folder without asking
|
|
docker stop claude-desktop # stop everything
|
|
```
|
|
|
|
The shared folder is mounted at `/workspace` in both containers. Sign in to
|
|
Claude Desktop on every start; the sign-in is not kept. Closing Claude
|
|
Desktop or Ghidra's project window stops everything.
|
|
|
|
## What runs where
|
|
|
|
| Container | Contents | Network |
|
|
| ---------------- | --------------------------------------------------------------- | -------------------------- |
|
|
| `claude-desktop` | Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal |
|
|
| `claude-re-mcp` | REA MCP server (headless Ghidra, binwalk, unblob), no display | internal only, no internet |
|
|
|
|
Both containers run from the same image. REA gets its own container because
|
|
some of its tools run the target. Claude Desktop reaches it at
|
|
`http://rea:8765/mcp` through `mcp-remote`.
|
|
|
|
MCP servers in Claude Desktop (`claude-desktop/claude_desktop_config.json`):
|
|
|
|
- **ghidra**: needs a program open in Ghidra's CodeBrowser.
|
|
- **rea**: opens files from `/workspace` by itself, with its own headless
|
|
Ghidra project.
|
|
|
|
## Sources
|
|
|
|
- Claude Desktop: Anthropic's apt repository (https://code.claude.com/docs/en/desktop-linux)
|
|
- Ghidra 12.1.4: https://github.com/NationalSecurityAgency/ghidra
|
|
- GhidraMCP 2.0: https://github.com/LaurieWired/GhidraMCP
|
|
- ESP32 Flash Loader: https://github.com/dynacylabs/ghidra-esp32-flash-loader
|
|
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm `rea-agents`
|
|
- mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
|
|
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
|
|
- unblob 26.6.4: https://github.com/onekey-sec/unblob
|
|
- esptool 5.6.0: https://github.com/espressif/esptool
|
|
|
|
Versions and checksums are pinned in the `Dockerfile`. `CLAUDE.md` has the
|
|
details.
|