[Security Study] Malware Analysis, Let’s Do It With AI Now! 🤖 (Ghidra + ChatGPT Environment Setup Guide)

Jul 29, 2026

—

Hello, aspiring security professionals and current practitioners 👋 Today is the first session of the “Malware Analysis using Generative AI” course: Setting up the Analysis Environment.

“Malware analysis… but I’m blind to assembly language, what should I do? 😭” Don’t worry! Now we have a reliable AI assistant. A dream environment that translates complex machine code into human-readable language and even explains what this code is trying to do!

I’ll show you how to build your own AI Analysis Lab by integrating Ghidra and LLM (ChatGPT), from A to Z. 🚀

1. Why Generative AI in Security? 🤔

Malware analysis, especially Reverse Engineering, has a very high barrier to entry. However, with the advent of LLMs (Large Language Models), the landscape has changed.

Code Explanation (Explain): If you ask, “What does this function do?”, it analyzes complex assembly/C code and summarizes it as, “This is ransomware logic that encrypts files.”
Variable Name Suggestion (Renaming): It renames meaningless variable names like v1, arg_0 to contextually appropriate names like file_handle, encrypt_key.
Deobfuscation: It unwraps obfuscated code and displays it in plain text.

In other words, if we master “How to Ask AI (Prompt Engineering)”, we can significantly reduce analysis time! ⏳

2. Prerequisites (Check List) ✅

The following tools are required for the practical exercise.

Virtual Machine (VMware / VirtualBox): ⚠️ Essential! Since you’re dealing with malware, never run it on your host (your computer).
Analysis Tool (Ghidra): A free reverse engineering tool created by the NSA (U.S. National Security Agency).
Python 3.x: Required to run plugins.
OpenAI API Key: The key to connecting ChatGPT with the tool. (Paid account recommended, free accounts have speed limits)

3. Detailed Installation Guide 🛠️

We will integrate a plugin called ‘Gepetto’ with Ghidra, which is the most popular and free option.

STEP 1. Install Java & Ghidra

Ghidra is Java-based.

Please install JDK 17 or higher. (OpenJDK recommended)
Download the latest version from the Ghidra official website and unzip it.
Run ghidraRun.bat (Windows) or ghidraRun (Linux/Mac) to confirm it works correctly.

STEP 2. Download Gepetto Plugin

Gepetto is a Python script that sends the code displayed in Ghidra to the OpenAI GPT model to receive explanations.

Visit the GitHub repository:
Click Code > Download ZIP to download or git clone it.
The .py files that appear after unzipping are important.

STEP 3. Register Script in Ghidra

Now, you need to tell Ghidra, “I’m going to use this script.”

Run Ghidra -> Enter the analysis screen by opening any file in CodeBrowser.
Click Window -> Script Manager in the top menu.
Click the ‘Script Directories’ icon (folder-shaped list) in the upper right of the Script Manager.
Click the [+] button and add the path to the Gepetto folder you just downloaded.
If the script appears when you type “gepetto” in the search bar, success! 🎉

STEP 4. OpenAI API Key Setup 🔑

To ask GPT questions, you need to pay (tokens), right? Let’s connect the API key.

Access OpenAI Platform and issue an API Key. (A long string starting with sk-)
Method A (Environment Variable): Register the key value as OPENAI_API_KEY in your system environment variables.
Method B (Direct Script Modification): Open the gepetto.py file with a text editor and find and insert the API_KEY = “Insert_Key_Here” part. (Environment variable recommended for security!)

4. Practical Test: AI, Please Analyze! 🧪

Alright, the environment setup is complete. Shall we see if it works?

Upload the .exe file (or a practice crackme) to Ghidra.
After Auto Analyze finishes, you’ll see C-like code in the Decompiler window.
Click on a difficult-to-interpret function to place the cursor.
Press the shortcut key (if set) or double-click gepetto.py in the Script Manager!
(Drumroll) A moment later…

🖥️ [Gepetto Output] “This function checks the length of the input string, performs a specific XOR operation, and compares it with a key value. It appears to be a typical password verification logic.”

Wow! 🤩 The AI’s analysis automatically appears in the Comment window. Now, instead of racking our brains trying to interpret assembly language line by line, we can focus on the core logic by looking at the big picture summarized by AI.

5. Precautions and Tips 🍯

🔒 Data Leakage Warning: Do not carelessly upload sensitive internal company source code or malware to public LLMs (like OpenAI)! (In practice, local LLMs or enterprise versions are used.)
💸 Cost Management: Each API call incurs a cost. Be sure to set a usage limit.
🤖 Do Not Blindly Trust: AI sometimes hallucinates. Even if AI says, “This is a safe file,” you, as the analyst, must cross-verify it.

Conclusion 🎁

Today, we built a Ghidra + LLM environment and gained our ‘Iron Man’s Jarvis’. Starting from tomorrow’s Day 2 practical session, we will use this environment to analyze actual ransomware and obfuscated scripts.

Look forward to experiencing a 10x faster analysis speed! 🔥

If you have any questions, please leave a comment!