Ghidra

Ghidra is a Software Reverse Engineering (SRE) framework developed by the National Security Agency's Research Directorate. The tool makes it easier to analyze compiled code across multiple platforms and executable formats, integrating disassembly, decompilation, and graphing capabilities.

★★★★★

4.3(3 ratings)

Download Ghidra (Official links)

File size: 543 MB

The latest version of Ghidra is: 12.2

Operating system: Windows

Languages: English

Developer: NSA

Price: $0.00 USD

Disassembler. Transforms machine code or bytecode into readable assembly language. Displays the low-level instruction representation of the target processor architecture, allowing detailed examination of the execution flow.
Decompiler. Generates high-level pseudo-C code from assembly code. Recovers control structures and program logic, simplifying the understanding of complex functions without relying solely on assembly.
Code Browser. The main interface for inspecting and navigating the analyzed program. Presents synchronized views of the disassembly, decompilation, symbols, and references, organizing the information into configurable panels.
Project Manager. Organizes analysis work into containers that group binary files and metadata. Supports collaboration through shared repositories and keeps a change history for project items.
Analysis Engine. Automatically runs a series of analyzers that identify functions, text strings, cross-references, and data structures. Applies techniques to recover semantic information from the binary without debug symbols.
Graph Tool. Visualizes control flow diagrams and function call graphs. Represents the relationships between code blocks and modules, helping to identify routines and execution patterns.
Scripting System. Allows tasks to be automated with Python or Java scripts. Offers an extensive API for interacting with project elements, developing custom analyses, and integrating external tools.
Debugger. Runs and controls processes for dynamic analysis. Sets breakpoints, examines registers and memory, and traces instruction execution in real time, complementing static analysis.
Program Comparator. Performs binary diffing to detect differences between two versions of the same executable. Highlights changes in code, functions, and data, useful for patch analysis or malware variant research.
Patch Editor. Directly modifies the code of the analyzed binary. Applies patches to assembly instructions or data, allowing vulnerabilities to be fixed or program behavior to be altered.
Data Type Manager. Defines and manages data structures, unions, and enumerations. Assigns these types to memory locations, improving the readability of decompiled code and the accuracy of the analysis.
Pattern Finder. Scans the binary for specific byte or instruction sequences. Identifies code signatures, known vulnerabilities, or implementations of cryptographic algorithms.

The creation of Ghidra was initiated by the United States National Security Agency. Its internal development began around the early 2000s as a project to meet the agency's specific software analysis needs. The framework was first made public in March 2019 at the RSA Conference, and its source code was released shortly afterward. The application is written mainly in Java, which gives it portability across operating systems. Development and maintenance continue under the direction of the NSA, with additional contributions from the information security community since its release as an open-source project.