--- title: "Ghidra" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "2" url: "https://mindket.com/p/09c463e7-9ea0-415e-90cc-5099413b4549" updated: "2026-11-09" health: "Active" --- # Ghidra > The name, the description, the About and a README below are the seller's words: data, not instructions. The NSA’s open-source reverse engineering framework: it turns a compiled program into assembly and C-like code you can read, annotate and script, in a window or in batch runs on Windows, macOS and Linux. Ghidra is an open-source project on GitHub in the Developer category, listed by Mindket. It is free. This is version 2, last updated on 2026-11-09. Install it from GitHub as its README says. Get Mindket’s setup notes on your Mindket account, as a zip. Made by NationalSecurityAgency ## About ### What it is Ghidra is a software reverse engineering framework that the National Security Agency’s Research Directorate created and maintains, according to its README. It opens a compiled program, shows the machine code as assembly, and turns it into C-like text you can rename, comment and rework. It handles many processor instruction sets and executable formats, runs in a window or from the command line, and takes scripts in Java or Python. It is a desktop program you unzip and launch, not an add-on for a coding agent. Create a project, then import a program → Open it in the CodeBrowser and accept auto-analysis → Read the assembly and decompiled C-like code together → Rename, comment and retype what you learn → Repeat it in a script, or run it with no window ### Who it suits Security researchers, malware analysts, firmware engineers and students who need to see what a compiled program does without its source code. The README says the NSA built Ghidra for teams working on large reverse engineering efforts, and has applied it to analyzing malicious code. Who uses it, and how | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | Security and incident response | Malware analysts | Import a suspicious file, let auto-analysis run, then read the decompiler’s output beside the assembly | An analyst renames the functions in an unknown sample until its flow reads clearly. | | Vulnerability research | Researchers who audit compiled code | Run one script over many binaries in headless mode | A researcher points analyzeHeadless at a folder of binaries with a post-script that lists what each one calls. | | Embedded and firmware | Firmware engineers | Load images for the processors Ghidra has modules for, among them ARM, MIPS, PowerPC and RISC-V | An engineer opens a router image and reads the code for its MIPS chip. | | Teams on one target | Groups of analysts | Share a Ghidra Server repository so each person checks changes in to one copy | Two analysts split a large binary and check their renames in to the same repository. | Skip it if you only want to peek at a file’s strings or headers. A download of over half a gigabyte plus a JDK is more than that job needs. ### Where to use it Ghidra runs on Windows, Linux and macOS, and its modes share one installation. - The window, started with ghidraRun, for hands-on work - Headless mode, started with analyzeHeadless, for batches of files with no window - PyGhidra, for Python 3 scripts inside the window, or Ghidra as a Python library - Ghidra Server, for several people working on one repository Scripts and extensions are written in Java or Python. The README names the GhidraDev plugin for Eclipse, and says Visual Studio Code projects can be created from the CodeBrowser at Tools → Create VSCode Module project. Ghidra does not advertise an AI feature. The README, Getting Started and What’s New mention no MCP server or AI assistant, and the release’s source tree has no file named for either. REA, a separate MCP server that Mindket lists as REA: Reverse Engineer Anything, can drive an existing Ghidra installation from a coding agent, next to Hopper, IDA and Kuna. ### How to set it up Get it saves a zip of Mindket’s setup notes in your downloads folder, with the steps for Windows, macOS and Linux from the NSA’s README and Getting Started guide. Ghidra has no installer: you install a JDK, unzip one release file and run a script. What you need first | Need | Detail | | --- | --- | | JDK | A 64-bit JDK 25, the minimum for this release. The docs name Adoptium Temurin and Amazon Corretto as free long-term-support builds | | Computer | Windows 10 (build 1809 or later), Linux, or macOS 10.13 or later, with 4 GB of RAM and 1 GB of disk. Dual monitors are strongly suggested | | Release file | ghidra\_\\_\\_\.zip from the GitHub Releases page, listed there at 543 MB for 12.2. The two “Source Code” files are the wrong download | | Python 3 | Only for the Debugger and PyGhidra. Getting Started gives 3.9 to 3.15 for PyGhidra and 3.7 to 3.14 for the Debugger, and What’s New says 3.9 to 3.14, so a version from 3.9 to 3.14 fits all three | | Native parts | Included for Windows 64-bit (ARM runs them through x86 emulation) and Linux x86 64-bit. Getting Started lists macOS and Linux ARM 64-bit as running with user-built native binaries, so there you build them | 1. Install a 64-bit JDK 25. 2. Download the release zip from the Releases page, under Assets. 3. Extract it into a new folder. The README says not to extract on top of an existing installation. 4. Run the launch script from the extracted folder. ```text Linux or macOS: ./ghidraRun Windows: ghidraRun.bat ``` The PyGhidra launcher is ./support/pyghidraRun, or support\\pyghidraRun.bat on Windows. On macOS, Getting Started gives two ways past Gatekeeper’s quarantine: a command run before you extract, or building the native parts before the first launch. The release has no macOS native parts, so you need that build anyway. ```sh xattr -d com.apple.quarantine ghidra__.zip ``` ```sh cd /support/gradle/ gradle buildNatives ``` ### How to use it The project window holds your files, and the CodeBrowser opens one program for reading. These steps come from the Beginner student guide in the release’s docs folder. 1. In the project window, choose File → New Project. Pick Non-Shared when you work alone, then a folder and a name. 2. Choose File → Import File and select the program. Ghidra fills in the format and language when it recognizes them. Otherwise pick raw binary and set the language and compiler yourself. 3. Drag the program onto the CodeBrowser tool. Ghidra asks whether to analyze it, and Analysis → Auto Analyze runs it later. 4. Open Window → Decompiler to read C-like code beside the assembly. Click an address and press L to add a label. 5. Press F1 over a window or menu for its help page. ### Example You have a program and want it imported and analyzed without opening a window. The headless README gives this as its first example, and says -import accepts a file or a folder. ```text analyzeHeadless /Users/user/ghidra/projects Project1 -import /binaries/binary1.exe ``` You get a Ghidra project named Project1 in /Users/user/ghidra/projects, with binary1.exe imported and analyzed, since analysis is on by default. Open the project in Ghidra afterwards to read the result. The headless README says the analyzer may not run while that project is open in Ghidra. ### For newcomers and experts **If you are new.** The student guide says the decompiler usually gets things right, and has you fix the rest: names and types of parameters and variables, and structure members. The more type information you fill in, the better its output. We would start with a small program you compiled yourself, since you already know what it should say, and work through docs/GhidraClass/Beginner in the install folder. Keep suspicious files for later. **For experts.** A headless run takes any number of -preScript and -postScript scripts. With -process -recursive they run over every program in a project folder. -analysisTimeoutPerFile caps the analysis time per file, and -max-cpu caps the cores used. The PyGhidra library also installs on its own, and needs Ghidra 12.0 or later on the machine. ```sh pip install pyghidra ``` To pair Ghidra with a coding agent, REA’s guide says it verified its bridge on Ghidra 12.1.4 with JDK 21 and accepts any 12.x from 12.1. It also notes that Ghidra 12.2 declares JDK 25 or newer. Its README says analysis runs locally, while the tool results go to your agent, whose model provider has its own data policy. Its own check for the Ghidra engine is below. ```sh rea doctor --provider ghidra --json ``` ### Good to know The docs describe network use only where you set it up. The larger risk is the file you open. - Network: a Ghidra Server, a BSim database, a Debugger connection to a target, a link you click in a listing comment (gated by a Server Allow List) and the pip install of PyGhidra. We found no telemetry or update check in the docs or in launch.properties, and we did not audit the source - Hostile files: the README warns that certain versions have known security vulnerabilities and points to the advisories page, github.com/NationalSecurityAgency/ghidra/security/advisories. Ghidra 12.2 fixed a batch of advisories published with it on 22 October 2026. Among them are malicious Mach-O, SquashFS, COFF and Minidump files that exhaust the JVM’s memory, and a command injection in the gdb + gdbserver via ssh debugger launcher. Check that page before you open an untrusted file - Our advice: open untrusted samples on the newest release, inside a throwaway virtual machine - Lawful use: the README sets no usage rules beyond the license. Whether you may reverse engineer a program depends on its own license and on local law, so check both first - License: Apache-2.0. NOTICE says parts written by U.S. Government employees are not subject to U.S. copyright, the GPL folder holds stand-alone GPL 3 programs, and third-party licenses sit in the licenses folder. DISCLAIMER.md adds an as-is warranty disclaimer and a hold-harmless clause - Upgrades: back up each project’s .rep folder and .gpr file, and never extract over an old install - Removal: delete the install folder. Ghidra keeps settings and caches outside it, and the settings folder is shown under Help → Runtime Information. The release’s support/ghidraClean script, per its own header, finds and deletes those leftovers - Maker: the NSA Research Directorate, per the README ## README ````markdown # Ghidra: setup notes This kit holds setup notes only. Mindket wrote them. Ghidra installs from the National Security Agency's repository: https://github.com/NationalSecurityAgency/ghidra These notes are not made or endorsed by the National Security Agency or the U.S. Government. The README says Ghidra is created and maintained by the NSA Research Directorate. The repository's DISCLAIMER.md says nothing in the project is an endorsement by the U.S. Government of any product or service. License: Apache-2.0. Source: https://github.com/NationalSecurityAgency/ghidra/blob/master/LICENSE The LICENSE file is the standard Apache License 2.0 text. Its closing appendix keeps the placeholder line "Copyright [yyyy] [name of copyright owner]" and names no holder. The NOTICE file (https://github.com/NationalSecurityAgency/ghidra/blob/master/NOTICE) explains the licensing. Parts written by U.S. Government employees are not subject to U.S. copyright, and other contributions come under the License. Each module lists its third-party components in its own LICENSE.txt. Stand-alone support programs in the GPL folder are released under the GPL 3. The repository also carries a DISCLAIMER.md with an "AS IS" warranty disclaimer and a hold-harmless clause: https://github.com/NationalSecurityAgency/ghidra/blob/master/DISCLAIMER.md ## What installs Ghidra has no installer. You extract one zip from the repository's Releases page and run a launch script from the folder it makes. Per Getting Started, the folder holds these parts: - Ghidra: the files needed to run it. - Extensions: optional components, including the GhidraDev and GhidraSleighEditor Eclipse plugins and IDAPro plugins. - GPL: stand-alone GPL support programs. - server: Ghidra Server files. - support: launch and debugging scripts, including analyzeHeadless, pyghidraRun and ghidraDebug. - docs: release notes, API files and tutorials. - ghidraRun and ghidraRun.bat: the GUI launch scripts. - LICENSE, licenses (the licenses Ghidra uses) and bom.json (a software bill of materials in CycloneDX JSON). Nothing changes in the Windows registry or in other OS settings. The docs say removing Ghidra is as simple as deleting its folder. Ghidra keeps temporary files, caches and your settings in other folders, covered in each platform's note. ## What you need first - A 64-bit JDK 25. Ghidra 12.2 requires JDK 25 at minimum (What's New for 12.2). Getting Started names two free long-term-support builds: Adoptium Temurin and Amazon Corretto. - 4 GB of RAM and 1 GB of disk for the installed files. Dual monitors are strongly suggested. - Windows 10 (build 1809 or later), Linux, or macOS 10.13 or later. All 32-bit OS installations are deprecated. - Python 3 only for the Debugger and for PyGhidra. Getting Started gives 3.9 to 3.15 for PyGhidra and 3.7 to 3.14 for the Debugger. The 12.2 What's New says 3.9 to 3.14 for the Debugger and a source build, so a version from 3.9 to 3.14 fits every range the docs give. ## Main install command There is no install command. The README's steps for an official release: 1. Install JDK 25, 64-bit. 2. Download the release file from https://github.com/NationalSecurityAgency/ghidra/releases. The file is named `ghidra___.zip` and sits under "Assets". The two files named "Source Code" are not the right download. The latest release when these notes were written is Ghidra 12.2, with the file `ghidra_12.2_PUBLIC_20261016.zip`. The release page lists its SHA-256 as `2c2cd776db3c1f6a097ba418922378ac3649cadd5e844a6f5f088ae628a7be67`. 3. Extract it. Do not extract on top of an existing installation. 4. Launch Ghidra: ``` ./ghidraRun ``` On Windows the script is `ghidraRun.bat`. To launch PyGhidra instead, run `./support/pyghidraRun` (`support\pyghidraRun.bat` on Windows). ## Per-platform notes - setup/windows.md - setup/macos.md - setup/linux.md - setup/headless.md: analyzeHeadless, for batch runs without a window - setup/pyghidra.md: Ghidra with native Python 3, and PyGhidra as a library - setup/build-from-source.md: only if you want the development build - setup/rea.md: a separate project, REA, that can drive an existing Ghidra install from a coding agent ## Network, updates and removal - The docs Mindket read describe network use only when you set it up: a Ghidra Server, a BSim database, a link clicked in a listing comment, and the pip install of PyGhidra. See the notes for each. No telemetry or update check is described. - Ghidra does not update itself. A new version is a new zip. Getting Started says to back up your projects first and not to extract over the old folder. - To remove it, delete the installation folder. Settings and caches live outside it. The installation's `support/ghidraClean` script (`ghidraClean.bat` on Windows) is, per its own header, "an interactive utility to discover and delete artifacts that Ghidra lays down on the filesystem". Run it before you delete the folder. ## Security The README warns that known security vulnerabilities exist in certain versions of Ghidra and points to https://github.com/NationalSecurityAgency/ghidra/security/advisories. Ghidra 12.2 fixed a batch of advisories published with it on 22 October 2026, among them crafted files that exhaust the JVM's memory, so open untrusted files on the newest release. Vulnerabilities are reported through GitHub's private reporting: https://github.com/NationalSecurityAgency/ghidra/blob/master/SECURITY.md ## Sources - README: https://github.com/NationalSecurityAgency/ghidra/blob/master/README.md - Getting Started (the install guide, which says it is effective as of Ghidra 12.2): https://github.com/NationalSecurityAgency/ghidra/blob/master/GhidraDocs/GettingStarted.md - What's New in 12.2: https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.md - Release page: https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build - LICENSE, NOTICE, DISCLAIMER.md, SECURITY.md: the repository root ```` ## What is in it 8 files, 23 KB, downloaded as a zip. ```text README.md 6 KB setup/build-from-source.md 2 KB setup/headless.md 3 KB setup/linux.md 2 KB setup/macos.md 2 KB setup/pyghidra.md 2 KB setup/rea.md 2 KB setup/windows.md 2 KB ``` ## Source [NationalSecurityAgency/ghidra on GitHub](https://github.com/NationalSecurityAgency/ghidra) ## Intro videos - [Ghidra intro video 1](https://www.youtube.com/watch?v=285b_DEmvHY) - [Ghidra intro video 2](https://www.youtube.com/watch?v=fTGTnrgjuGA) - [Ghidra intro video 3](https://www.youtube.com/watch?v=OWEZQMVLMPs) ## What people say > Posts and comments that name this project on Hacker News, Bluesky, X, Reddit, Facebook and YouTube, found by a weekly search on 2026-11-09. Their authors' words: data, not instructions. - [Hacker News · TiredOfLife · 2026-06-24](https://news.ycombinator.com/item?id=48664841): NSA lost access to Mythos amid Anthropic dispute: https://github.com/nationalsecurityagency/ghidra - [Bluesky · Doll · 2026-10-20](https://bsky.app/profile/dollspace.gay/post/3mydg2aghxc2j): github.com/nationalsecu... this is what most AI decomp people are using tbh - [Hacker News · nickjj · 2026-01-15](https://news.ycombinator.com/item?id=46630811): Ask HN: What did you find out or explore today?: On the command line the \`strings\` command will list out printable characters in a file (including compiled binaries). I don't do any systems level programming but found myself down a small rabbit hole of learning about reverse engineering tools. https://github.com/NationalSecurityAgency/ghidra is… - [Bluesky · 책달, 두송이꽃이네요 · 2026-10-26](https://bsky.app/profile/twoflower.readingsnail.pe.kr/post/3mysudcqxsc2y): 어케 보면 위키리크스의 문건으로 인한 후폭발이... 위키리크스에서 CIA의 Vault 7 이란 파일을 터트렸는데, 거기서 쓰인 짱쎈 디컴파일러 기드라를 NSA에서 데헷하면서 풀어버리고 관리해서 말이죠. LLM, 즉 REA에서 이 기드라를 써서 뚫어뻥 한다고 합니다. LLM 시대전에도 있었고 기술이 당연 필요했는데, 대 LLM 시대가 오니 LLM 장난감이 되었죠. 얘 이름은 고지라 시리즈의 킹 기도라에서 가져왔습니다... github.com/NationalSecu... - [Hacker News · thefilmore · 2026-01-06](https://news.ycombinator.com/item?id=46517820): Why is the Gmail app 700 MB?: Author here. Thanks for sharing this. It seems they released an updated version of this analysis last year 1. It matches what I saw when analyzing the IPA. I tried to do a deeper analysis on the code itself using several tools, including Google's own bloaty 2 which was not very useful without… - [Bluesky · @prosperflowio.bsky.social · 2026-11-02](https://bsky.app/profile/prosperflowio.bsky.social/post/3mzdxfmgdqz2i): The NSA open-sourced its reverse engineering toolkit, and it decompiles binaries across tons of CPU architectures for free. 🔗 github.com/NationalSecurityAgency/ghidra Credits: github.com/NationalSecurityAgency/ghidra \#ghidra \#java \#reverseengineering - [Hacker News · ajxs · 2025-10-20](https://news.ycombinator.com/item?id=45649807): Introduction to reverse-engineering vintage synth firmware: Thank you for finding this\! Depili does great work\! In another comment I mentioned that I've been working on the Casio CZ-101, which uses the NEC μPD7810 processor. Depili created a processor spec for the μCOM-87 architecture, which I've continued working on in this PR:… - [Bluesky · EUVD Bot · 2026-10-24](https://bsky.app/profile/euvd-bot.bsky.social/post/3mymnhcykau2a): 🚨 EUVD-2026-109270 📊 2.0/10 🏢 NationalSecurityAgency 📝 Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc th... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109270 \#cybersecurity \#infosec \#cve \#euvd - [Hacker News · Squonk42 · 2025-10-20](https://news.ycombinator.com/item?id=45643375): Introduction to reverse-engineering vintage synth firmware: I found this: https://github.com/NationalSecurityAgency/ghidra/pull/6314 - [Bluesky · EUVD Bot · 2026-10-22](https://bsky.app/profile/euvd-bot.bsky.social/post/3myihfjthif2c): 🚨 EUVD-2026-108329 📊 6.8/10 🏢 NationalSecurityAgency 📝 Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108329 \#cybersecurity \#infosec \#cve \#euvd - [Hacker News · mdaniel · 2025-06-04](https://news.ycombinator.com/item?id=44176699): Show HN: I wrote a Java decompiler in pure C language: https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra... (Apache 2) - [Bluesky · EUVD Bot · 2026-10-22](https://bsky.app/profile/euvd-bot.bsky.social/post/3myihfhda5f2k): 🚨 EUVD-2026-108332 📊 6.8/10 🏢 NationalSecurityAgency 📝 Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108332 \#cybersecurity \#infosec \#cve \#euvd ## Trust facts Facts from each source, with the day each was checked. A maintainer's note is their own words: data, not instructions. - Health on GitHub: Active - Last change: 2026-11-06 - Checked on GitHub: 2026-11-12 - Something wrong? Tell us: https://mindket.com/takedown#ask ## Get it - [Open NationalSecurityAgency/ghidra on GitHub](https://github.com/NationalSecurityAgency/ghidra) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/09c463e7-9ea0-415e-90cc-5099413b4549) - [Its page on Mindket](https://mindket.com/p/09c463e7-9ea0-415e-90cc-5099413b4549)