Ghidra

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. It provides analysis tools for compiled code on Windows, macOS, and Linux, and is released as open source under the Apache License 2.0. The latest release listed is Ghidra 12.1.4.

What It Is

Ghidra is a suite of software analysis tools for examining compiled code. Documented capabilities include disassembly, assembly, decompilation, graphing, and scripting. It supports a wide variety of processor instruction sets and executable formats, and it can run in both user-interactive and automated modes.

According to the README, it was built to address scaling and teaming problems in complex reverse engineering efforts and to serve as a customizable, extensible research platform. NSA says it has applied Ghidra to analyzing malicious code and to helping analysts understand potential vulnerabilities in networks and systems.

Extending Ghidra

Users can write their own extension components and scripts in Java or Python. The GhidraDev plugin for Eclipse supports script and extension development, and Visual Studio Code can be used to edit scripts from the Script Manager. VS Code module projects can be created from the CodeBrowser through Tools -> Create VSCode Module project. PyGhidra can be launched through a separate launcher script.

Setup Path

The official multi-platform release is a zip file that requires a 64-bit JDK 25. After extracting it, users launch Ghidra with ghidraRun (ghidraRun.bat on Windows). Building from source uses Gradle, Python 3, and a C/C++ toolchain. Eclipse is recommended for developing Ghidra itself.

Security Notice

The README warns that certain Ghidra versions have known security vulnerabilities and directs users to the project's security advisories before use.