What is Ghidra?
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. It analyzes compiled code from many processor instruction sets and executable formats, and runs either as an interactive desktop application or in automated, headless mode. According to the project, NSA built it to address scaling and teaming problems on complex SRE efforts and has applied it to the analysis of malicious code and of potential vulnerabilities in networks and systems.
NSA released Ghidra to the public on March 5, 2019 at the RSA Conference, describing it as the product of years of internal research and development. The announcement named the Sleigh processor modeling language, which translates machine instructions into the P-code intermediate representation, the undo/redo feature, the multi-user collaboration repository and scripting as notable functions. A 2023 NSA article reported more than one million public downloads in the first four years and states that NSA has adopted contributions from public users on GitHub.
The source code is published on GitHub under the Apache License 2.0 and is written mainly in Java, with native components such as the decompiler. The current release is Ghidra 12.2, published on October 22, 2026 as a single multi-platform zip file (ghidra_12.2_PUBLIC_20261016.zip) with a published SHA-256 checksum. There is no installer: the archive is extracted and started with ghidraRun or ghidraRun.bat, and removing Ghidra means deleting its directory.
The 12.2 release notes list a new minimum of JDK 25, enforced TLS server authentication for all Ghidra Server and BSim PostgreSQL connections, a client-side Server Allow List, a reworked bsim_ctl deployment script, beta support for timeless (time-travel) debugging based on Intel PIN traces, C99 fixed-width integer data types, an interactive structure, union and enum merger, accessibility changes and processor module additions such as Hexagon, CIP-51 and a CPU32 variant of M68000. Project data from earlier releases opens in 12.2, but programs saved in 12.2 may not open in older versions.
The README carries a warning that certain Ghidra versions contain known security vulnerabilities and points to the project's security advisories. Questions and community discussion take place in GitHub Discussions, and the contributor's guide describes how external bug fixes and features are submitted. The former project domain ghidra-sre.org now redirects to the GitHub repository.
Ghidra screenshots
Explore the interface. Open a screenshot to view it at full size.
Listing and Decompile windows side by side for a function in WinHelloCPP.exe, from the official decompiler help.
Function Graph of _strlen with 14 vertices, each block showing its instructions, from the official Function Graph help.
Debugger tool with the termmines specimen open before launch, from the official Debugger course.
Decompiler Diff View comparing a stripped PostgreSQL function with its BSim match, from the official BSim tutorial.
CodeBrowser with the Program Tree of a Windows PE file and its DOS header in the listing, from the official CodeBrowser help.
Source: official Ghidra project page.
Key capabilities
- Disassembly and the CodeBrowser listing The CodeBrowser tool shows a program's memory blocks in a Program Tree next to an annotated listing of bytes, instructions, data, labels and cross-references. Analysts can create and edit data types, functions, comments and labels, and every change can be undone or redone. The listing also supports flow arrows, markers and operand highlighting described in the built-in help.
- Decompiler The Decompile window shows C-like pseudocode for the function at the current listing location and stays synchronized with the disassembly. Variables, function signatures and data types edited in the decompiler propagate back to the program database. The decompiler is a native component shipped prebuilt for the platforms included in the release.
- Function Graph and other graphs The Function Graph displays a function's basic blocks as connected vertices with code inside each block, and can show loops and paths between blocks. Separate graph services cover call graphs and data graphs. Vertices can be grouped and laid out with several layout algorithms.
- Processor and format coverage Processor modules in the 12.2 source tree include x86, ARM and AArch64, MIPS, PowerPC, RISC-V, SPARC, SuperH, 6502, 68000, 8051, AVR (Atmel), PIC, Z80, Xtensa, Hexagon, LoongArch, TriCore, V850, MSP430, eBPF, Dalvik and JVM bytecode, among others. Processors are defined in the Sleigh specification language, so new instruction sets can be added as modules. Feature modules handle formats and metadata such as PDB, DWARF, Objective-C, Swift, Rust and Microsoft and GNU demangling.
- Java and Python scripting The Script Manager runs GhidraScripts written in Java against the full Ghidra API, with javadocs shipped in the installation. The integrated PyGhidra library, originally developed by the Department of Defense Cyber Crime Center as Pyhidra, provides native CPython 3 scripting through JPype, a REPL in the GUI and use as a standalone Python package. A Jython module is present in the source tree as an extension.
- Headless Analyzer The analyzeHeadless command creates or opens a project, imports single files or whole directories, runs auto-analysis, and executes pre- and post-processing scripts on each program without the GUI. It can write per-file logs, set analysis timeouts and keep or delete the created project. Scripts can control whether each processed program is kept.
- Ghidra Server for team projects The Ghidra Server stores shared repositories: each user works on a local copy of a project and checks changes into the common repository. Version 12.2 enforces TLS server authentication on all client connections and, without a configured keystore, the server only listens on the loopback interface. Installation and administration are documented in the server README, including running it as a service.
- Debugger The Debugger tool connects to native debuggers through Python-based connectors and records target state as traces linked to the static listing. Connector modules in the source tree cover GDB, LLDB, Windows dbgeng (WinDbg), x64dbg, drgn, DAP and Java JPDA. Debugger use requires Python 3; the 12.2 release adds beta timeless debugging with a breakpoint timeline, a dynamic call tree and a variable viewer.
- Emulation The P-code emulator can execute code from the static listing or from a debugger trace, with a P-code stepper to follow individual operations. The Debugger course in the documentation walks through emulating a function and watching registers and memory. A System Emulation feature module is also part of the source tree.
- BSim behavioral similarity BSim finds structurally similar functions across collections of binaries using decompiler-derived features. Signatures can be stored in a local database or a BSim PostgreSQL server, which 12.2 manages with the
bsim_ctlcommandsinit,configure,start,stopand service installation on Linux. Search results can be compared side by side in a decompiler diff view. - Version Tracking and program comparison Version Tracking ports markup such as names, comments and data types from one version of a binary to another by correlating matching functions and data. Related modules include Function ID for recognizing known library functions, Program Diff and a Code Compare view.
- Extensions Extensions add plugins, analyzers, loaders, exporters, processors and visualizations. They are installed from File, Install Extensions into the user settings directory, or extracted into the installation's
Ghidra/Extensionsdirectory for shared or headless setups. The distribution includes Eclipse plugins (GhidraDev, GhidraSleighEditor) and IDA Pro plugins and loaders for exchanging data. - Development environments The GhidraDev plugin for Eclipse supports writing scripts and extensions against a released Ghidra installation. Visual Studio Code can open scripts from the Script Manager, and a CodeBrowser action creates a VS Code module project. Building Ghidra itself uses Gradle, as described in the Developer's Guide.
- Single jar and SBOM The
support/buildGhidraJarscript packages all or part of Ghidra as oneghidra.jarfor command-line use or as a library inside another Java application. Each installation contains abom.jsonsoftware bill of materials in CycloneDX format. - Installation on Windows, Linux and macOS The Getting Started guide lists Windows 10 build 1809 or later, Linux and macOS 10.13 or later, with 4 GB RAM, 1 GB of storage and a 64-bit JDK 25 (for example Adoptium Temurin or Amazon Corretto). Python 3.9 to 3.15 is used for PyGhidra; the debugger supports Python 3.7 to 3.14. 32-bit operating systems are deprecated.
- Native binaries per platform The public release includes native binaries for Windows x86-64, Windows ARM64 (through x86 emulation) and Linux x86-64. macOS x86-64 and ARM64, Linux ARM64, FreeBSD and OpenBSD are supported with user-built native binaries, created with
gradle buildNativesand a C/C++ toolchain. On macOS, Gatekeeper may quarantine the unsigned native components unless the quarantine attribute is removed or the natives are rebuilt.
Where Ghidra fits
Malware analysis
NSA describes the analysis of malicious code as one of the problems Ghidra was applied to internally. A sample is imported into a project, auto-analysis identifies functions, strings and references, and the analyst works through the listing, decompiler and Function Graph while renaming functions, defining structures and adding comments. Projects keep that work in a local database, and checked-in copies on a Ghidra Server let several analysts share it.
Vulnerability research on compiled software
The project cites gaining a better understanding of potential vulnerabilities in networks and systems as a core purpose. The decompiler, data type manager and cross-references help trace how input reaches a function, while the debugger and P-code emulator let researchers observe concrete register and memory values. NSA's 2023 article names Wi-Fi routers, car electronics and voting machines among the consumer devices analyzed with Ghidra.
Firmware and embedded processor analysis
Ghidra's processor modules cover many embedded architectures, including ARM Cortex-M variants, MIPS, PowerPC, 8051, AVR, PIC, MSP430, Xtensa and Hexagon. Raw firmware images can be imported with a chosen language and memory map. Unsupported instruction sets can be added by writing a Sleigh specification, with the GhidraSleighEditor Eclipse plugin providing editing support.
Batch analysis and automation
The Headless Analyzer imports and analyzes directories of binaries and runs Java or Python scripts on each one, which suits repeated processing jobs such as extracting function lists or applying the same annotations to many files. PyGhidra can also start Ghidra from an ordinary Python program, open a project, retrieve a program and run a GhidraScript, so Ghidra becomes one component of a larger Python workflow.
Comparing binaries and porting annotations
When a new build of already-analyzed software appears, Version Tracking correlates matching functions and data and transfers names, comments and types from the earlier analysis. BSim extends comparison to large collections by indexing function features in a database and returning structurally similar functions, documented in the BSim tutorial.
Teaching and training
NSA's release announcement expected Ghidra to support capture-the-flag competitions, school curricula and training, and the 2023 article states it has become a staple in college curricula. The distribution ships Beginner, Intermediate and Advanced class material and a Debugger course under its docs directory, plus context help on F1. Other reverse engineering listings on iThub include REA and reverse-skill.
Reviews of Ghidra
Be the first to share your experience with Ghidra.
Write a review
Loading review form…
Alternatives to Ghidra
REAREA (Reverse Engineer Anything) is an MCP server and CLI, distributed as the rea-agents npm package, that lets coding agents inspect native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs and websites locally and return findings with evidence.
reverse-skillreverse-skill routes AI coding agents to security workflows, checks local tools, and organizes case evidence for reverse engineering, authorized penetration testing, and CTF tasks.