RHEXA

Getting started

This page takes you from a finished installation to the first analysis. If RHEXA is not installed yet, start with the installation.

Development status: RHEXA is not yet published as a package. It is installed from source. The command and the MCP server are called rhexa.

1. Check the installation

rhexa doctor

The check reports, among other things, whether the engine is found (ghidra, ghidra-version) and whether a suitable JDK is present. Optional tools such as Hopper, IDA or jadx may be missing.

2. Ask your agent

Once RHEXA is registered with your agent (see connecting your agent), start the agent in any directory and ask a concrete question, for example:

Analyse /home/me/samples/license. Which function checks the licence key,
and against which constant? Show me the evidence.

The agent opens the program with open_binary, lets the Rhexa Engine analyse it, reads strings, functions and pseudocode selectively and answers with address, constant and location.

3. The same on the command line

Every analysis is also available without an agent. Replace path, search text and function with your target:

rhexa analyze  /path/to/program --provider ghidra --json
rhexa search   /path/to/program "license" --provider ghidra --json
rhexa function /path/to/program main --provider ghidra --json
rhexa decompile /path/to/program 0x401000 --provider ghidra --json

--json returns the complete result with evidence. rhexa --help and rhexa <command> --help list all options.

4. What next?