Ghidra — security analysis and diagnostics

An open-source software reverse engineering framework released by the U.S. NSA, featuring a decompiler and a collaborative analysis server.

Basic information

What is this program?

Ghidra is a software reverse engineering framework released by the U.S. National Security Agency (NSA) in 2019. When you open an executable such as PE or ELF, it disassembles it into assembly and converts it to C-like pseudo-code so you can understand the program's behavior.

Like radare2, it can also be used from the command line, but its built-in GUI decompiler and Ghidra Server—which allows multiple analysts to open the same binary simultaneously—are major strengths. It is widely used in security research, vulnerability analysis, and malware investigation.

What problems does it solve?

• ('In reverse engineering', 'when you need to understand the internal logic of a closed binary without source code', 'you can compare assembly and pseudo-code to infer the role of functions.')
• ('In vulnerability analysis', 'when looking for memory vulnerabilities in products or libraries', 'you can follow function graphs and string references to narrow down problem locations.')
• ('In malware investigation', 'when pre-analyzing the behavior of a suspicious executable', 'you can see the flow of network and file operation API calls at a glance.')

Key features

Decompilation

Translates selected functions from assembly to high-level pseudo-code

• Use case: when reading pivoting or obfuscated functions
• What you get: see function arguments and variable roles in code form
• Limitations: it is not a perfect reconstruction, so obfuscated code can be difficult to interpret.

Multi-architecture support

Disassembles dozens of architectures including x86, ARM, MIPS, and PowerPC

• Use case: when analyzing embedded or mobile binaries
• What you get: handle binaries from multiple platforms with the same tool
• Limitations: rare architectures may require additional support offsets or plugins.

Ghidra Server (collaboration)

Multiple analysts can analyze the same project simultaneously

• Use case: team-based malware investigation or collaborative reverse engineering
• What you get: analysis results (comments and labels) are shared on the server
• Limitations: requires additional server operation and project management.

Debugger integration

Connects to GDB, LLDB, and WinDbg to trace running processes

• Use case: when static analysis leaves the control flow unclear
• What you get: validate assumptions with runtime values
• Limitations: requires setting up the debugger and preparing the target process.

Installation and execution

Linux (Ubuntu / Debian)

Install OpenJDK 21 first, then extract and run the official ZIP. Java is required because the main Ghidra application is written in Java.

sudo apt update
sudo apt install openjdk-21-jdk
# After downloading the ZIP from ghidra-sre.org or GitHub releases
unzip ghidra_12.14_PUBLIC_*.zip
cd ghidra_12.14_PUBLIC
./ghidraRun

Windows

Install 64-bit OpenJDK 21, then extract the official ZIP and run ghidraRun.bat.

# After installing Temurin 21 from adoptium.net
ghidraRun.bat

macOS

Install OpenJDK 21 with brew, then extract the official ZIP and run ghidraRun.

brew install openjdk@21
unzip ghidra_12.14_PUBLIC_*.zip
./ghidraRun

Practical usage examples

Creating a new project

Create a project with File > New Project, then add the executable to analyze with File > Import File. A project is the unit that stores analysis results and comments.

File > New Project… > Non-Shared > /home/analyst/proj
File > Import File… > sample.bin

Reading functions with the decompiler

When CodeBrowser opens, select a function from the list on the left and view the pseudo-code in the Decompiler window on the right. You can switch between disassembly and decompilation with the x and d keys.

Listing: sample.bin  ·  Decompiler: main()
int main(int argc,char **argv){ ... network_connect(); }

Checking strings and cross-references

Use Search > For Strings to collect strings, then click the xref (reference location) of a selected string to jump to its usage.

Search > For Strings… ( minLength=5 )
String: "http://192.0.2.10/upload"  →  xref 3 references

Advantages and limitations

Advantages

• Free and open source (Apache-2.0), so you can set up a reverse engineering environment without commercial tools
• Built-in GUI decompiler — makes it easy to understand function flow even if you don't know assembly well
• Supports multiple architectures and multi-analyst collaboration server
• Integrates with GDB and LLDB to handle static and dynamic analysis in one environment

Things to consider before use

• Because it is Java-based, initial loading is slow and it uses a lot of memory (at least 4 GB RAM recommended).
• Because it is GUI-oriented, batch analysis of large numbers of files from the command line requires scripting effort (a headless mode is available).
• There is a learning curve for the project and workspace concepts at first.

Comparison with similar programs

Official resources and further learning

• Official website — https://ghidra-sre.org/
• Official documentation / knowledge base — https://ghidra-sre.org/ghidra_docs/
• Official download — https://github.com/NationalSecurityAgency/ghidra/releases
• Release notes — https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md
• Source / development resources — https://github.com/NationalSecurityAgency/ghidra

Version and supported environment information was confirmed on the official site as of 2026-10-18. Installation commands may vary depending on your distribution and version, so also check the official installation documentation.

Actual execution screen

Below is a synthetic example screen created to illustrate the usage flow (not an actual execution result). The screen is a synthetic example, not an actual execution result.

!Example Ghidra analysis session: headless import, automatic analysis complete, decompilation output

Actual production server

Source (HTML): https://games.aidebatehub.com/programs/apps/security/ghidra.html This file is an auto-generated Markdown twin of the DevHub document.