AskJOE - AI-Powered Malware Analysis & Threat Intelligence

项目说明

AskJOE 3.0 – Ad Malware Analysis Suite

![GitHub stars]()
![GitHub forks]()

> AI-powered malware analysis and threat intelligence for Ghidra
> A focused suite of helpers for malware analysis and reverse engineering: triage, capability detection, threat intel, string recovery, renaming, and reporting—all from one launcher with a consistent UI and clickable output.

Demo

!AskJOE 3.0 mini walkthrough

Table of contents

What is AskJOE 3.0?

AskJOE 3.0 extends the original AskJOE project from a single AI-powered function analyzer into a full malware analysis suite. Built on Ghidra and LLM integration (OpenAI or Claude), it adds specialized modules for behaviour understanding, threat intelligence, and re workflows—all with a single launcher and shared configuration.

Requirements

Install Python dependencies from the project root:

Installation

1. Clone or copy the repo
!Script Directory

Put AskJOE.py and the AskJOE/ folder into your Ghidra script directory (e.g. ghidra_scripts), or any path already in Ghidra’s script paths.

2. Configure API keys and options
- Use AskJOE/config.example.ini as a template if provided, or edit AskJOE/config.ini.
- Set AI provider, model, and API keys ([AI], [API_KEYS]).
- Set threat-intel keys as needed ([], [OTX], etc.).
- Adjust CAPA and other tool options if required.

3. Run AskJOE in Ghidra

!Script Manager
- Window > Script Manager > add your script directory if needed.
- Find AskJOE.py (e.g. under SecurityJOES).
- Double-click to run; the AskJOE window opens.

Main components

| Component | Description |
|-----------|-------------|
| AskJOE launcher (AskJOE.py) | Central entry point run from Ghidra’s Script Manager. Opens a tabbed window with Analysis (all tools) and Config (settings from config.ini). |

Tool o

Tools are grouped below by role. All support clickable addresses in the output where applicable (click to jump in the Listing/Decompiler).

AI and explanation

| Tool | Goal |
|------|------|
| AI Triage | First-pass understanding: likely behaviour, IOCs, ATT&CK-style techniques. Structured HTML report; “light” or “deep” mode in config.ini. |
| Explain Function | Explains the function at the cursor using decompiler output. Click Run; the result opens in a new window. Tab shows status only. |
| Ask AI | Chat about the current binary. Presets for malware/vuln research; macros #func, #addr, #strings, #imports. Buttons to create bookmarks and comments from the latest answer. |

Renaming and simplification

| Tool | Goal |
|------|------|
| Rename Helper | Rename functions and from one window. Uses live Code Browser cursor; Refresh then Suggest; apply selected or all. Handles params, locals, and decompiler-generated names. |
| Function Simplifier | Simplified view of the decompiled function; syntax-highlighted, IDE-like output. |

Capability and threat intelligence

| Tool | Goal |
|------|------|
| CAPA Analysis | Runs Mandiant capa on the binary and imports results into Ghidra (symbols/comments). HTML report in AskJOE style. |
| Threat Intelligence Analyzer | Aggregates OSINT (, Hybrid Analysis, OTX, Malware Bazaar, Intezer, Any.Run, Triage, X-Force, etc.). Single HTML view; per-service status and rate-limit handling. |

Detection and recovery

| Tool | Goal |
|------|------|
| Crypto Detector | Finds crypto-related code and constants (encryption/hashing candidates). |
| XOR Searcher | Identifies and decodes XOR-obfuscated data; filters noise; clickable addresses. Includes a short “How to read this” legend. |
| Stack Strings Detector | Recovers stack-constructed strings; table output tuned for malware workflows. |

Export

| Tool | Goal |
|------|------|
| Export Report | Lightweight shareable report: merges AI Triage JSON, Threat Intel JSON, and latest CAPA log into a markdown-style HTML report; opens in a window and saves to disk. |

Using AskJOE

Opening the launcher

!AskJOE GUI Analysis

!AskJOE GUI Config

Running any tool (general)

1. File > Import a binary in Ghidra and wait for analysis.
2. In AskJOE Analysis, select a tool from the list.
3. Click Run; results appear in the output pane (HTML, clickable addresses where applicable). For Explain Function, use Refresh first so the current function matches your cursor.
4. Use Clear output to reset before another run.

AI Triage

!AskJOE - AI Triage

1. Open a binary in Ghidra and run initial analysis.
2. In Analysis, select AI Triage.
3. Click Run; the tool produces a first-pass report (behaviour, IOCs, ATT&CK-style techniques).
4. Review the HTML output; addresses are clickable to jump in the Listing/Decompiler.
5. Adjust "light" or "deep" mode in Config or config.ini if needed.

Ask AI

!AskJOE - Ask AI

1. Place the cursor in the function or address of interest.
2. Open Ask AI from the Analysis tab.
3. Optionally pick a preset (e.g. “Classify malware behaviour”, “Review interesting strings”).
4. Use #func, #addr, #strings, #imports in your question to inject context.
5. Click Send; use Bookmark here / Comment here to annotate Ghidra from the answer.

Explain Function

!AskJOE - Explain Function

1. Place the cursor inside the function you want explained (in the Listing or Decompiler).
2. In Analysis, select Explain Function.
3. Click Run; the result opens in a new window (AI summary and step-by-step description). The tab shows status only.
4. In the result window, click any address to jump to it in Ghidra.

Function Simplifier

!AskJOE - Function Simplifier

1. Place the cursor inside the function you want to simplify.
2. In Analysis, select Func Simplifier.
3. Click Run; a simplified, syntax-highlighted view of the decompiled function is shown.
4. Use the output to understand control flow and logic; status messages go to the Ghidra console.

Rename Helper

!AskJOE - Rename Helper

1. Put the cursor inside the function you want to rename.
2. In Analysis, open Rename helper.
3. In the Rename Helper window: Refresh > Suggest & function names.
4. Select rows and use Apply selected renames or Apply all renames.
5. Names are applied to the function, parameters, and decompiler- locals.

CAPA Analysis

!AskJOE - CAPA Analysis

1. Open a binary in Ghidra; ensure capa is installed and configured (see config.ini).
2. In Analysis, select CAPA Analysis.
3. Click Run; capa runs on the binary and results are imported into Ghidra (symbols/comments).
4. Review the HTML report in the output pane; click addresses to na.
5. Inspect the Listing/Decompiler for capability markers added by the script.

Threat Intelligence Analyzer

!AskJOE - Threat Intelligence

1. Configure API keys for desired services (, OTX, etc.) in Config or config.ini.
2. Open a binary in Ghidra (file must be on disk for hashing).
3. In Analysis, select Threat Intel.
4. Click Run; the tool queries enabled services and aggregates results.
5. Review the HTML report (families, campaigns, IOCs); per-service status is shown.

Crypto Detector

!AskJOE - Crypto Detector

1. Open a binary in Ghidra and run analysis.
2. In Analysis, select Crypto Detector.
3. Click Run; the tool scans for crypto-related code and constants.
4. Review the list of suspected encryption/hashing routines and addresses.
5. Click addresses in the output to jump to candidates in the Listing/Decompiler.

Stack Strings Detector

!AskJOE - Stack Strings

1. Open a binary in Ghidra and run analysis.
2. In Analysis, select Stack Strings.
3. Click Run; the tool recovers stack-constructed strings and shows them in a table.
4. Review addresses and string content for malware-relevant data.
5. Use clickable addresses to na to the corresponding code.

XOR Searcher

!AskJOE - XOR Searcher

1. Open a binary in Ghidra and run analysis.
2. In Analysis, select XOR Search.
3. Click Run; the tool finds XOR patterns and decoded candidate strings.
4. Read the "How to read this" legend in the output for loops and operands.
5. Click addresses to inspect XOR routines in the Listing/Decompiler.

Export Report

!AskJOE - Export Report

1. Run AI Triage, Threat Intelligence, and CAPA as needed (their outputs are used).
2. In Analysis, select Export report.
3. Click Run; the script builds a consolidated HTML report from the latest results.
4. The report opens in a new window and is saved to disk.
5. Share or attach the generated file for case notes, tickets, or reports.

License

This project is licensed under the GPL-2.0 License. See LICENSE for details.

---

Contact

项目信息

开发语言：Python

Star 数：165

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-Powered Malware Analysis & Threat Intelligence for Ghidra Transform your static analysis workflow with cutting-edge AI capabilities, comprehensive malware detection, and advanced threat intelligence.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。