Initial public release: dockerized reverse-engineering workbench

ChipBench packages Ghidra, radare2, binwalk, chip-programming tools, simulators, and firmware-unpacking utilities into one reproducible container for analyzing raw chip dumps entirely from the command line or an AI CLI. Headless Jython scripts drive import, forced-disassembly sweeps, live queries, and bulk decompilation exports without any GUI. Derived from a private engagement environment, generalized for public release under AGPLv3. No engagement-specific artifacts are included. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-18 11:15:05 -05:00
commit 1b447b77ad
28 changed files with 1860 additions and 0 deletions
@@ -0,0 +1,13 @@
+# chipbench shell setup
+# Prepend the isolated Python venv so `python3` resolves to the interpreter
+# that has capstone / unicorn / mcp installed.
+case ":${PATH}:" in
+    *":/opt/venv/bin:"*) ;;
+    *) export PATH="/opt/venv/bin:${PATH}" ;;
+esac
+
+# Helpful banner once per login shell.
+if [ -n "${BASH_VERSION:-}" ] && [ -z "${CHIPREV_BANNER:-}" ]; then
+    export CHIPREV_BANNER=1
+    printf '\n  chipbench RE shell — try: re-identify, re-analyze, re-binwalk (host) or\n  r2 / ghidraRun / binwalk / python3 (here). Artifacts: /data/artifacts (ro)\n  Project: /data/work  Output: /data/output\n\n'
+fi
@@ -0,0 +1,74 @@
+[supervisord]
+nodaemon=true
+user=chip
+logfile=/data/work/supervisord.log
+pidfile=/tmp/supervisord.pid
+childlogdir=/data/work
+loglevel=info
+
+; Control socket in a chip-writable location so `supervisorctl status`
+; works from inside the container (supervisord runs as non-root uid 1001).
+[unix_http_server]
+file=/tmp/supervisor.sock
+chmod=0700
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock
+
+[program:xvfb]
+command=/usr/bin/Xvfb :0 -screen 0 1920x1080x24 -ac +extension RANDR
+autorestart=true
+priority=10
+stdout_logfile=/data/work/xvfb.log
+stderr_logfile=/data/work/xvfb.err
+
+[program:fluxbox]
+command=/usr/bin/fluxbox
+environment=DISPLAY=":0",HOME="/home/chip"
+autorestart=true
+priority=20
+stdout_logfile=/data/work/fluxbox.log
+stderr_logfile=/data/work/fluxbox.err
+
+[program:x11vnc]
+command=/usr/bin/x11vnc -display :0 -forever -shared -noxdamage -rfbauth /home/chip/.vnc/passwd -rfbport 5900
+autorestart=true
+priority=30
+stdout_logfile=/data/work/x11vnc.log
+stderr_logfile=/data/work/x11vnc.err
+
+[program:novnc]
+command=/usr/bin/websockify --web /usr/share/novnc/ 6080 localhost:5900
+autorestart=true
+priority=40
+stdout_logfile=/data/work/novnc.log
+stderr_logfile=/data/work/novnc.err
+
+[program:ghidra]
+; GUI project manager. Open the chip dump from here; the GhidraMCP plugin
+; starts its REST server on 127.0.0.1:8080 once the CodeBrowser tool loads.
+; NOTE: the `ghidraRun` wrapper hardcodes launch.sh "bg" mode, which daemonizes
+; the JVM and exits 0 -- supervisor would then respawn it forever. So we call
+; launch.sh "fg" directly so the JVM runs in the foreground and is tracked.
+; We first wait for the X server to avoid an AWT connect race.
+command=bash -c 'for i in {1..60}; do [ -e /tmp/.X11-unix/X0 ] && break; sleep 0.5; done; exec /opt/ghidra/support/launch.sh fg jdk Ghidra "" "" ghidra.GhidraRun'
+directory=/data/work
+environment=DISPLAY=":0",HOME="/home/chip"
+autorestart=true
+startsecs=10
+startretries=3
+priority=50
+stdout_logfile=/data/work/ghidra.log
+stderr_logfile=/data/work/ghidra.err
+
+[program:mcp-bridge]
+; MCP-over-SSE bridge to the GhidraMCP REST API (reachable from host on 8081).
+command=/opt/venv/bin/python /opt/ghidramcp/bridge_mcp_ghidra.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/
+autorestart=true
+startsecs=3
+priority=60
+stdout_logfile=/data/work/mcp-bridge.log
+stderr_logfile=/data/work/mcp-bridge.err