Skip to content

Back to the catalog

Ghidra
github.comrepo

Ghidra

Ghidra is a free, open-source software reverse engineering (SRE) framework developed by the NSA, offering disassembly, decompilation, graphing, and scripting across Windows, macOS, and Linux. It supports a wide range of processor architectures and executable formats, can run interactively or in automated/headless mode, and allows extension development via Java or Python (including the bundled PyGhidra). It is one of the primary open-source alternatives to IDA Pro for malware analysis and vulnerability research.

TL;DR NSA's open-source Ghidra: a cross-platform disassembler/decompiler framework for reverse engineering and malware analysis.
Open original ↗
Document

What it is

Ghidra is the NSA Research Directorate's software reverse engineering framework, hosted at github.com/NationalSecurityAgency/ghidra. The README gives the install and build requirements, the launch commands, and the options for writing scripts and extensions. It also carries a security warning.

Preconditions / Affected

The README warns that certain versions of Ghidra have known security vulnerabilities and points readers to the project's Security Advisories before use. It names no versions or CVEs, so check the advisories page to see whether your version is affected.

Requirements for running a release:

  • JDK 25, 64-bit.

Additional requirements for building from source:

  • Gradle 9.1.0 or newer. The Gradle wrapper works if an Internet connection is available.
  • Python 3, versions 3.9 to 3.15, with bundled pip.
  • GCC or Clang and make, on Linux and macOS.
  • On Windows, Visual Studio 2017 or later, or the Microsoft C++ Build Tools, with MSVC, Windows SDK and C++ ATL.

What to do

Install an official release:

  1. Install JDK 25 64-bit.
  2. Download the file named ghidra_<version>_<release>_<date>.zip from the "Assets" drop-down on the Releases page. The two "Source Code" downloads are the wrong files for this step.
  3. Extract it. Do not extract on top of an existing installation.
  4. Launch it.
./ghidraRun
./support/pyghidraRun

On Windows use ghidraRun.bat and support\pyghidraRun.bat. The second command launches PyGhidra.

Build the development version from source:

gradle -I gradle/support/fetchDependencies.gradle
gradle buildGhidra

The build output is in build/dist/. Use ./gradlew in place of gradle if Gradle is not installed and an Internet connection is available.

Set up the Eclipse environment for developing Ghidra itself (the README recommends Eclipse):

gradle prepdev eclipse buildNatives

Then import the repository with File -> Import -> General -> Existing Projects into Workspace, and check "Search for nested projects".

Write scripts and extensions with one of these:

  • The GhidraDev plugin for Eclipse, found in a release at Extensions/Eclipse/GhidraDev/.
  • Visual Studio Code, opened from the icon in the Script Manager. In CodeBrowser, Tools -> Create VSCode Module project creates a full VS Code project.

Caveats

The GhidraDev plugin and the VS Code integration work only against fully built Ghidra installations from the Releases page. They do not work against a source checkout. The README leaves detailed build and troubleshooting steps to the Developer's Guide, the Known Issues section and the Getting Started document inside the release.

Technologies named here

Techniques named here

  • Software reverse engineering

Related in Malware & RE