Analyze compiled code to uncover hidden vulnerabilities
Open binary files, convert their instructions into a human-readable format, and visualize execution flow as graphs. Ghidra is a software reverse engineering framework created by the National Security Agency (NSA) Research Directorate, consolidating the tools needed to analyze compiled code. Using this tool allows you to understand malware or internal system structures to identify potential vulnerabilities.
A tool born from NSA's cybersecurity mission
Ghidra was created to address scale and team collaboration issues that arise in complex reverse engineering tasks. The NSA has applied this tool to gain deep insights for malware analysis and understanding network and system vulnerabilities. Users can analyze compiled code in Windows, macOS, and Linux environments, with support for both interactive and automation modes. Additionally, you can develop custom scripts and extensions in Java or Python to tailor your analysis workflow.
Core features for analysis and development
This framework provides various features, including disassembly, assembly, decompilation, graph generation, and scripting.
- Diverse analysis capabilities It includes essential reverse engineering tools ranging from disassembly to decompilation and graph generation.
- Extensibility You can develop custom scripts and extension components using Java and Python.
- Development environment integration It supports Eclipse and Visual Studio Code to assist with script writing and developing the tool itself.
Installation and build process
To install the official release, you must install JDK 25 64-bit and then download the ghidra_<version>_<release>_<date>.zip file from the release files. After extracting the archive, running the ./ghidraRun command starts Ghidra, while running ./support/pyghidraRun starts PyGhidra. To build directly from source, you need JDK 25, Gradle 9.1.0 or higher, Python 3.9 to 3.14, and a compiler suitable for your operating system (GCC/Clang or MSVC). The build command is gradle buildGhidra, and the generated files are located in the build/dist/ folder.
Security warnings to check before use
Certain versions of Ghidra have known security vulnerabilities, so you must check the Security Advisories before use. Using the tool without reading these advisories may expose you to unexpected security risks. Additionally, if you wish to participate in Ghidra development or fix bugs and add features, you should refer to the contributor guide. Since this tool is used in fields requiring professional reverse engineering knowledge, beginners should be cautious, as indiscriminately analyzing executable files can lead to unintended results.
