Repolode
Submit
NationalSecurityAgency

NationalSecurityAgency/ghidra

Ghidra is an open-source software reverse engineering framework from the NSA, offering disassembly, decompilation, graphing and scripting for compiled code.

Open-source alternative to:IDA Pro

View on GitHub
Stars
91,215
Forks
10,209
Open issues
2,122
Last commit
yesterday

What is it?

Ghidra is a software reverse engineering framework created and maintained by the NSA Research Directorate. It provides a suite of analysis tools for compiled code on Windows, macOS and Linux, covering disassembly, assembly, decompilation, graphing and scripting.

It supports a wide range of processor instruction sets and executable formats, and can be used interactively through its GUI or in automated, headless modes. Users can extend it with their own extensions and scripts written in Java or Python.

The project was built to help analysts work on large reverse engineering efforts and to serve as a customizable research platform. Ghidra has been used for analyzing malicious code and studying vulnerabilities in systems.

Key features

  • 01Decompiler that turns compiled machine code into readable C-like pseudocode.
  • 02Disassembler and assembler supporting many processor instruction sets.
  • 03Graphing views for visualizing control flow and program structure.
  • 04Scripting and extensions in Java and Python.
  • 05Runs interactively in a GUI or in automated modes.

Use cases

  • Analyzing malware samples to understand their behavior.
  • Auditing compiled binaries for security vulnerabilities.
  • Studying proprietary or legacy software without source code.
  • Automating repetitive binary analysis tasks with scripts.

Quick start

  1. 1

    Install JDK 25 64-bit

  2. 2

    Download the official release zip from the releases page

  3. 3

    Extract the release file (not on top of an existing install)

  4. 4

    Launch Ghidra

    ./ghidraRun

Things to know

  • Requires JDK 25 64-bit to be installed first.
  • Source builds need Gradle, Python 3.9 to 3.15, and platform-specific compilers, which makes building from source more involved.
  • The README warns of known security vulnerabilities in certain versions.

Topics

#reverse-engineering#disassembler#decompiler#security#binary-analysis#java#software-analysis

FAQ

What is ghidra?
Ghidra is an open-source software reverse engineering framework from the NSA, offering disassembly, decompilation, graphing and scripting for compiled code. Ghidra is a software reverse engineering framework created and maintained by the NSA Research Directorate. It provides a suite of analysis tools for compiled code on Windows, macOS and Linux, covering disassembly, assembly, decompilation, graphing and scripting.
Is ghidra free to use? What license does it have?
ghidra is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is ghidra still maintained?
Actively maintained. The last commit to ghidra was on Oct 19, 2026.
What can I use ghidra for?
Analyzing malware samples to understand their behavior. Auditing compiled binaries for security vulnerabilities. Studying proprietary or legacy software without source code. Automating repetitive binary analysis tasks with scripts.
How do I install ghidra?
Install JDK 25 64-bit Download the official release zip from the releases page Extract the release file (not on top of an existing install) Launch Ghidra: ./ghidraRun
Where can I get ghidra?
The source code and installation instructions are on GitHub: https://github.com/NationalSecurityAgency/ghidra

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects