Ghidra: Software reverse engineering framework
NSA's open-source tool for analyzing compiled binaries.
Learn more about Ghidra
Ghidra is a software reverse engineering framework written in Java that performs static analysis on compiled code. The tool operates through a modular architecture supporting multiple processor instruction sets and executable formats, with a graphical interface for interactive analysis and command-line interfaces for automation. Key capabilities include disassembly, assembly, decompilation to C-like pseudocode, control flow graphing, and data flow analysis across Windows, macOS, and Linux binaries. Organizations use Ghidra for vulnerability analysis, malware investigation, binary auditing, and security research on closed-source or legacy software.
Multi-Architecture Binary Support
Analyzes executables across x86, ARM, MIPS, PowerPC, and dozens of other processor architectures from a single interface. Handles Windows PE, Linux ELF, macOS Mach-O, and embedded firmware formats without external conversion tools.
Shared Project Repositories
Multi-user server enables teams to work on the same binary simultaneously with change tracking and merge capabilities. Coordinates reverse engineering efforts across distributed analysts without manual file synchronization.
Java and Python Scripting
Automate analysis workflows and build custom tools using full API access through Java or Python scripts. Extends core functionality with domain-specific analyzers, import/export handlers, and integration bridges to existing security toolchains.
from ghidra.program.model.listing import *
program = currentProgram
functionManager = program.getFunctionManager()
for function in functionManager.getFunctions(True):
print("Function: {} at {}".format(
function.getName(),
function.getEntryPoint()
))See how people are using Ghidra
Related Repositories
Discover similar tools and frameworks used by developers
Semgrep
Pattern-based code scanner for 30+ languages.
CAI
LLM-powered Python framework for automated penetration testing workflows.
Sigma
YAML-based detection rules with SIEM query conversion.
uBO Lite
Manifest V3 content blocker using declarative rules without persistent background processes.
OpenSSL
C-based cryptographic library implementing TLS, DTLS, and QUIC protocols.