Kuna
An agent-first decompiler designed to be refined by other agents.
Kuna is written in Rust and was originally ported from Ghidra, but has since diverged on multiple features and pipeline designs.
This project is an experiment to establish how far the autonomous refinement of decompilers can push research in the field.
Learn more about this approach in this post.
🏆 Kuna has held the top position on DecBench against most modern decompilers for optimized C. Kuna is also one of the fastest decompilers on the planet, decompiling a 19MB binary in under 3 minutes. These wins are only possible thanks to our growing contributors and sponsors who keep Kuna improving.
Questions? Join our Discord:
Install & Usage
Kuna is distributed as a single Rust binary and can be run on most systems.
It can be used either on the CLI, the web browser, or in the Ghidra GUI (as the decompiler backend), most found in releases.
CLI Usage
If building from source, you can find the kuna binary in decompiler/target/release/kuna.
Otherwise, you can find it in the latest release for your OS (Linux, Windows, MacOS supported). The release kuna is a single self-contained binary: the compiled SLEIGH specs are built in.
kuna decompile ./a.out main
kuna decompile ./stripped.bin 0x401040 --addr
# decompiles a full binary, returning a .c, .h, and .asm file
kuna decompile-project ./a.out
# flip a feature internal to the decompiler (useful for LLMs)
kuna decompile ./a.out main --option compareform canonical
When using it with an agent, install the built-in skill to inform your agent on its efficient usage.
It ships inside the binary, so kuna install-skill sets it up for Claude Code, Codex and OpenCode offline (--dir DIR for other agents, --print to just read it).
Web Browser Usage
Since Kuna is written in Rust, you can also use it in the web browser through WebAssembly.
This will do all of the work on your machine, which means the binary remains private.
Visit decompile.run to use it.
The code for deploying your own site can be found in ./integrations/web
Ghidra GUI Usage
Since Kuna is originally a Ghidra port, the output format has remained largely compatible with Ghidra proper.
You can use the Kuna core as the Ghidra decompiler inside of the traditional Ghidra GUI.
You can either build the extension (./integrations/ghidra), or download the extension for the latest release.
The extension will work on all platforms Kuna is supported on.
To install and activate Kuna in Ghidra, do the following:
- Download it from the releases , named
kuna-version-KunaDecompiler-ghidra....zip.
- In Ghidra: File → Install Extensions… → + → select the zip → restart.
- In Ghidra: File → Configure → Miscellaneous → check KunaDecompilerPlugin.
Now, when you decompile, you should see /* Kuna v{version} */ in the decompilation.
All native Ghidra features are not yet supported, so please report them when you find issues.
To disable the Kuna backend, simply disable the plugin in File -> Configure.
Ghidra Headless Usage
The Kuna extension swaps the decompiler from a CodeBrowser plugin, and headless Ghidra (analyzeHeadless, PyGhidra, or tools built on them like REA) never loads GUI plugins.
To use Kuna as the decompiler backend there, swap the native decompiler binary directly.
- Locate the stock Ghidra decompiler binary and back it up:
cd "$GHIDRA_INSTALL_DIR/Ghidra/Features/Decompiler/os/linux_x86_64"
cp decompile decompile.ghidra.orig
- Replace it with the Kuna backend from the extension zip's
KunaDecompiler/os/linux_x86_64/ directory:
cp /path/to/KunaDecompiler/os/linux_x86_64/kuna_ghidra decompile
chmod +x decompile
- Verify the swap: decompile a function and check for the
/* Kuna v<version> */ marker in the output.
No specs download is needed: kuna_ghidra gets the processor specs and p-code from Ghidra itself.
On other platforms, use the matching os/<platform>/ directory (linux_arm_64, mac_x86_64, mac_arm_64, or win_x86_64, where both files end in .exe).
To revert to the stock Ghidra decompiler, restore the backup with cp decompile.ghidra.orig decompile.
The extension README also covers an in-script PyGhidra toggle and a drop-in that leaves the stock binary untouched.
This method was tested with Ghidra 12.1.2 and REA 3.1.0.
Project Goals
LLM agents, like Codex, have fundamentally changed how we reverse engineer and ultimately secure binaries.
Instead of humans looking directly at decompilers, LLMs are increasingly the ones using them, and humans instead read the agents' logs.
As such, it feels natural that decompilers should become oriented and optimized around agents.
Additionally, we can use those agents to automatically refine the tool they depend on.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
