> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Shellcode / Raw Binary Analysis

> Load and decompile headerless shellcode or raw binaries with Ghidra via remnux-ssh.

```
Analyze the raw shellcode at /home/remnux/samples/shellcode.bin:

1. Use remnux-ssh triage_quick for file type and hashes
2. Use remnux-ssh ghidra_load_sample with:
   - path: /home/remnux/samples/shellcode.bin
   - language: x86:LE:64:default  (or x86:LE:32:default for 32-bit)
3. Use remnux-ssh ghidra_run_analysis with entry_offset=0x0
4. Use remnux-ssh ghidra_list_functions to see discovered functions
5. Use remnux-ssh ghidra_decompile on each function found
6. Summarize: shellcode purpose, API calls, IOCs, likely malware family
```

## Supported Language IDs

| Architecture | Language ID |
| - | - |
| x86 64-bit | `x86:LE:64:default` |
| x86 32-bit | `x86:LE:32:default` |
| ARM 32-bit | `ARM:LE:32:v8` |
| ARM 64-bit | `AARCH64:LE:64:v8A` |

> [!WARNING]
>
> Always call `ghidra_run_analysis` after loading raw/headerless binaries — Ghidra does not auto-analyze them. Without this step, `ghidra_list_functions` will return empty.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.