ghidra README

The project's README from github.com/NationalSecurityAgency/ghidra. As one markdown file: README.md.

Ghidra Software Reverse Engineering Framework

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python.

In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems.

If you are a U.S. citizen interested in projects like this, to develop Ghidra and other cybersecurity tools for NSA to help protect our nation and its allies, consider applying for a career with us.

Security Warning

WARNING: There are known security vulnerabilities within certain versions of Ghidra. Before proceeding, please read through Ghidra's Security Advisories for a better understanding of how you might be impacted.

Install

To install an official pre-built multi-platform Ghidra release:

For additional information and troubleshooting tips about installing and running a Ghidra release, please refer to the Getting Started document which can be found at the root of a Ghidra installation directory.

Build

Build Ghidra

To create the latest development build for your platform from this source repository:

Install build tools:
Download and extract the source:

Download from GitHub

unzip ghidra-master
cd ghidra-master

NOTE: Instead of downloading the compressed source, you may instead want to clone the GitHub repository: git clone https://github.com/NationalSecurityAgency/ghidra.git

Download additional build dependencies into source repository:

NOTE: If an Internet connection is available and you did not install Gradle, the ./gradlew (or gradlew.bat) command may be used in place of the gradle command in the following instructions.

gradle -I gradle/support/fetchDependencies.gradle
Create development build:
gradle buildGhidra

The compressed development build will be located at build/dist/.

For more detailed information on building Ghidra, please read the Developer's Guide.

For issues building, please check the Known Issues section for possible solutions.

Develop

User Scripts and Extensions

Ghidra installations support users writing custom scripts and extensions via the GhidraDev plugin for Eclipse. The plugin and its corresponding instructions can be found within a Ghidra release at Extensions/Eclipse/GhidraDev/ or at this link. Alternatively, Visual Studio Code may be used to edit scripts by clicking the Visual Studio Code icon in the Script Manager. Fully-featured Visual Studio Code projects can be created from a Ghidra CodeBrowser window at Tools -> Create VSCode Module project.

NOTE: Both the GhidraDev plugin for Eclipse and Visual Studio Code integrations only support developing against fully built Ghidra installations which can be downloaded from the Releases page.

Advanced Development

To develop the Ghidra tool itself, it is highly recommended to use Eclipse, which the Ghidra development process has been highly customized for.

Install build and development tools:
Prepare the development environment:
gradle prepdev eclipse buildNatives
Import Ghidra projects into Eclipse:

When Eclipse finishes building the projects, Ghidra can be launched and debugged with the provided Ghidra Eclipse run configuration.

For more detailed information on developing Ghidra, please read the Developer's Guide.

Contribute

If you would like to contribute bug fixes, improvements, and new features back to Ghidra, please take a look at our Contributor's Guide to see how you can participate in this open source project.

ghidra (NationalSecurityAgency/ghidra)

Searching Database…

89.8K ·GitHub
Ghidra
What is this?Ghidra is a software reverse engineering (SRE) framework created and maintained by the NSA's Research Directorate, used to disassemble, decompile, graph, and analyze compiled code.
Is this a GUI application or a command-line tool?It's mainly a desktop GUI application with a full suite of high-end analysis tools (disassembly, decompilation, graphing), but it can also run in headless/automated mode and be scripted with Java or Python.
How do I install and run Ghidra?Install JDK 21 64-bit, download the official multi-platform release zip from the Releases page, extract it, then launch it with ./ghidraRun (ghidraRun.bat on Windows), or ./support/pyghidraRun for the Python-based PyGhidra launcher.
What do I need before building it from source instead of using a release?Building from source needs JDK 25 64-bit, Gradle 9.1.0+ (or the gradlew wrapper), Python3 3.9-3.14 with pip, plus GCC/Clang and make on Linux/macOS, or Visual Studio/MSVC Build Tools with Windows SDK and C++ ATL on Windows.
Who typically uses Ghidra?Security researchers, malware analysts, and reverse engineers who need to analyze compiled code to understand vulnerabilities in networks and systems.
Can I write my own scripts or extensions for Ghidra?Yes, users can write custom scripts and extensions in Java or Python using the GhidraDev plugin for Eclipse, or edit scripts through Visual Studio Code integration.
Can Ghidra be run in an automated, non-interactive way?Yes, Ghidra can run in both user-interactive and automated modes, which is useful for large-scale or scripted analysis workflows.
Why did the NSA build and release Ghidra?NSA built Ghidra to solve scaling and teaming problems on complex software reverse engineering efforts, and to provide a customizable, extensible research platform in support of its cybersecurity mission.
What kinds of binaries can Ghidra analyze?Ghidra supports a wide variety of processor instruction sets and executable formats, letting it disassemble and decompile code from many different platforms.
What are similar projects?ablation, reverse-engineering, Seep-Reverse-Lab, Detect-It-Easy, radare2, dnSpy, awesome-reverse-engineering, ida-pro-mcp
Which topics is it in?disassembler, decompiler, malware-analysis, binary-analysis, scripting, infosec, static-analysis, reverse-engineering, cybersecurity, security-tools, java, framework
Creator
NationalSecurityAgency
Size
405.8 MB
Stars
89.8K
Updated
CommitOct 16ReleaseGhidra_12.1.4_buildSep 21
Age
7y
Commits · 90 Days