Ghidra

What it is

Ghidra is a software reverse engineering framework that the National Security Agency’s Research Directorate created and maintains, according to its README. It opens a compiled program, shows the machine code as assembly, and turns it into C-like text you can rename, comment and rework. It handles many processor instruction sets and executable formats, runs in a window or from the command line, and takes scripts in Java or Python. It is a desktop program you unzip and launch, not an add-on for a coding agent.

1. Create a project, then import a program
2. Open it in the CodeBrowser and accept auto-analysis
3. Read the assembly and decompiled C-like code together
4. Rename, comment and retype what you learn
5. Repeat it in a script, or run it with no window

Who it suits

Security researchers, malware analysts, firmware engineers and students who need to see what a compiled program does without its source code. The README says the NSA built Ghidra for teams working on large reverse engineering efforts, and has applied it to analyzing malicious code.

Skip it if you only want to peek at a file’s strings or headers. A download of over half a gigabyte plus a JDK is more than that job needs.

Where to use it

Ghidra runs on Windows, Linux and macOS, and its modes share one installation.

• The window, started with ghidraRun, for hands-on work
• Headless mode, started with analyzeHeadless, for batches of files with no window
• PyGhidra, for Python 3 scripts inside the window, or Ghidra as a Python library
• Ghidra Server, for several people working on one repository

Scripts and extensions are written in Java or Python. The README names the GhidraDev plugin for Eclipse, and says Visual Studio Code projects can be created from the CodeBrowser at Tools → Create VSCode Module project.

Ghidra does not advertise an AI feature. The README, Getting Started and What’s New mention no MCP server or AI assistant, and the release’s source tree has no file named for either. REA, a separate MCP server that Mindket lists as REA: Reverse Engineer Anything, can drive an existing Ghidra installation from a coding agent, next to Hopper, IDA and Kuna.

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with the steps for Windows, macOS and Linux from the NSA’s README and Getting Started guide. Ghidra has no installer: you install a JDK, unzip one release file and run a script.

1. Install a 64-bit JDK 25.
2. Download the release zip from the Releases page, under Assets.
3. Extract it into a new folder. The README says not to extract on top of an existing installation.
4. Run the launch script from the extracted folder.

Linux or macOS: ./ghidraRun
Windows: ghidraRun.bat

The PyGhidra launcher is ./support/pyghidraRun, or support\pyghidraRun.bat on Windows. On macOS, Getting Started gives two ways past Gatekeeper’s quarantine: a command run before you extract, or building the native parts before the first launch. The release has no macOS native parts, so you need that build anyway.

xattr -d com.apple.quarantine ghidra_<version>_<date>.zip

cd <GhidraInstallDir>/support/gradle/
gradle buildNatives

How to use it

The project window holds your files, and the CodeBrowser opens one program for reading. These steps come from the Beginner student guide in the release’s docs folder.

1. In the project window, choose File → New Project. Pick Non-Shared when you work alone, then a folder and a name.
2. Choose File → Import File and select the program. Ghidra fills in the format and language when it recognizes them. Otherwise pick raw binary and set the language and compiler yourself.
3. Drag the program onto the CodeBrowser tool. Ghidra asks whether to analyze it, and Analysis → Auto Analyze runs it later.
4. Open Window → Decompiler to read C-like code beside the assembly. Click an address and press L to add a label.
5. Press F1 over a window or menu for its help page.

Example

You have a program and want it imported and analyzed without opening a window. The headless README gives this as its first example, and says -import accepts a file or a folder.

analyzeHeadless /Users/user/ghidra/projects Project1 -import /binaries/binary1.exe

You get a Ghidra project named Project1 in /Users/user/ghidra/projects, with binary1.exe imported and analyzed, since analysis is on by default. Open the project in Ghidra afterwards to read the result. The headless README says the analyzer may not run while that project is open in Ghidra.

For newcomers and experts

If you are new. The student guide says the decompiler usually gets things right, and has you fix the rest: names and types of parameters and variables, and structure members. The more type information you fill in, the better its output. We would start with a small program you compiled yourself, since you already know what it should say, and work through docs/GhidraClass/Beginner in the install folder. Keep suspicious files for later.

For experts. A headless run takes any number of -preScript and -postScript scripts. With -process -recursive they run over every program in a project folder. -analysisTimeoutPerFile caps the analysis time per file, and -max-cpu caps the cores used. The PyGhidra library also installs on its own, and needs Ghidra 12.0 or later on the machine.

pip install pyghidra

To pair Ghidra with a coding agent, REA’s guide says it verified its bridge on Ghidra 12.1.4 with JDK 21 and accepts any 12.x from 12.1. It also notes that Ghidra 12.2 declares JDK 25 or newer. Its README says analysis runs locally, while the tool results go to your agent, whose model provider has its own data policy. Its own check for the Ghidra engine is below.

rea doctor --provider ghidra --json

Good to know

The docs describe network use only where you set it up. The larger risk is the file you open.

• Network: a Ghidra Server, a BSim database, a Debugger connection to a target, a link you click in a listing comment (gated by a Server Allow List) and the pip install of PyGhidra. We found no telemetry or update check in the docs or in launch.properties, and we did not audit the source
• Hostile files: the README warns that certain versions have known security vulnerabilities and points to the advisories page, github.com/NationalSecurityAgency/ghidra/security/advisories. Ghidra 12.2 fixed a batch of advisories published with it on 22 October 2026. Among them are malicious Mach-O, SquashFS, COFF and Minidump files that exhaust the JVM’s memory, and a command injection in the gdb + gdbserver via ssh debugger launcher. Check that page before you open an untrusted file
• Our advice: open untrusted samples on the newest release, inside a throwaway virtual machine
• Lawful use: the README sets no usage rules beyond the license. Whether you may reverse engineer a program depends on its own license and on local law, so check both first
• License: Apache-2.0. NOTICE says parts written by U.S. Government employees are not subject to U.S. copyright, the GPL folder holds stand-alone GPL 3 programs, and third-party licenses sit in the licenses folder. DISCLAIMER.md adds an as-is warranty disclaimer and a hold-harmless clause
• Upgrades: back up each project’s .rep folder and .gpr file, and never extract over an old install
• Removal: delete the install folder. Ghidra keeps settings and caches outside it, and the settings folder is shown under Help → Runtime Information. The release’s support/ghidraClean script, per its own header, finds and deletes those leftovers
• Maker: the NSA Research Directorate, per the README