Ghidra

This article is about the reverse-engineering tool. For the fictional monster, see King Ghidorah.

Free reverse engineering tool developed by the National Security Agency

Ghidra

Disassembly of a file in Ghidra

Original author(s)| NSA
Initial release| March 5, 2019; 6 years ago (2019-03-05)
Stable release|

11.3.2[1] / April 15, 2025; 2 months ago (2025-04-15)

Repository| github.com/NationalSecurityAgency/ghidra
Written in| Java, C++
License| Apache License 2.0 / Public domain[2]
Website| ghidra-sre.org

Ghidra (pronounced GEE-druh;[3] /ˈɡiːdrə/[4]) is a free and open source reverse engineering tool developed by the National Security Agency (NSA) of the United States. The binaries were released at RSA Conference in March 2019; the sources were published one month later on GitHub.[5] Ghidra is seen by many security researchers as a competitor to IDA Pro.[6] The software is written in Java using the Swing framework for the GUI. The decompiler component is written in C++, and is therefore usable in a stand-alone form.[7]

Scripts to perform automated analysis with Ghidra can be written in Java or Python (via Jython),[8][9] though this feature is extensible and support for other programming languages is available via community plugins.[10] Plugins adding new features to Ghidra itself can be developed using a Java-based extension framework.[11]

## History

[edit]

Ghidra's existence was originally revealed to the public via Vault 7 in March 2017,[12] but the software itself remained unavailable until its declassification and official release two years later.[5] Some comments in its source code indicate that it existed as early as 1999.[13]

High-level changelog[14][15] Version  | Year  | Major features

|
|

1.0  | 2003  | Proof of concept
2.0  | 2004  | Database, docking windows
3.0  | 2006  | SLEIGH, decompiler, version control
4.0  | 2007  | Scripting, version tracking
5.0  | 2010  | File system browser
6.0  | 2014  | First unclassified version
9.0  | 2019  | First public release
9.2  | 2020  | Graph visualization, new PDB parser
10.0  | 2021  | Debugger
11.0  | 2023  | Rust and Go binaries support, BSim
11.1  | 2024  | Swift and DWARF 5 support, Mach-O improvements

In June 2019, coreboot began to use Ghidra for its reverse engineering efforts on firmware-specific problems following the open source release of the Ghidra software suite.[16]

Ghidra can be used, officially,[17][18] as a debugger since Ghidra 10.0. Ghidra's debugger supports debugging user-mode Windows programs via WinDbg, and Linux programs via GDB.[19]

## Supported architectures

[edit]

The following architectures or binary formats are supported:[20] [21]

* x86 16, 32 and 64 bit
* ARM and AARCH64
* PowerPC 32/64 and VLE
* MIPS 16/32/64
* MicroMIPS
* 68xxx
* Java and DEX bytecode
* PA-RISC
* RISC-V
* eBPF
* BPF
* Tricore
* PIC 12/16/17/18/24
* SPARC 32/64
* CR16C
* Z80
* 6502
* MC6805/6809, HC05/HC08/HC12
* 8048, 8051, 8085
* CP1600
* MSP430
* AVR8, AVR32
* SuperH
* V850
* LoongArch
* Xtensa

## See also

[edit]

* IDA Pro
* JEB decompiler
* radare2
* Binary Ninja

## References

[edit]

1. ^ "Releases · NationalSecurityAgency/ghidra". GitHub. Archived from the original on June 8, 2024. Retrieved October 11, 2024.
2. ^ "ghidra/NOTICE". GitHub.com. Archived from the original on October 27, 2022. Retrieved April 13, 2019.
3. ^ "Frequently asked questions". GitHub.com. Archived from the original on March 5, 2019. Retrieved March 7, 2019.
4. ^ "Come Get Your Free NSA Reverse Engineering Tool!". YouTube.com. May 16, 2019. Archived from the original on December 15, 2021. Retrieved May 17, 2019.
5. ^ a b Newman, Lily Hay. "The NSA Makes Ghidra, a Powerful Cybersecurity Tool, Open Source". Wired. Archived from the original on March 6, 2019. Retrieved March 6, 2019.
6. ^ Cimpanu, Catalin. "NSA releases Ghidra, a free software reverse engineering toolkit". ZDNet. Archived from the original on March 6, 2019. Retrieved March 7, 2019.
7. ^ e. g. as Plugin Archived 2022-10-14 at the Wayback Machine for Radare2 oder Rizin.
8. ^ "Ghidra Scripting Class". GitHub. Archived from the original on February 20, 2023. Retrieved February 19, 2023.
9. ^ "Three Heads are Better Than One: Mastering NSA's Ghidra Reverse Engineering Tool" (PDF). GitHub. Archived (PDF) from the original on March 1, 2020. Retrieved September 30, 2019.
10. ^ "Ghidraal". GitHub. Archived from the original on February 20, 2023. Retrieved February 19, 2023.
11. ^ "Ghidra Advanced Development Class". GitHub. Archived from the original on February 20, 2023. Retrieved February 19, 2023.
12. ^ "NSA to release a free reverse engineering tool". ZDNET. Archived from the original on February 22, 2024. Retrieved February 22, 2024.
13. ^ "Build software better, together". GitHub. Archived from the original on February 22, 2024. Retrieved February 22, 2024.
14. ^ "ghidra/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html at master · NationalSecurityAgency/ghidra". GitHub. Archived from the original on May 8, 2024. Retrieved May 8, 2024.
15. ^ Ghidra - Journey from Classified NSA Tool to Open Source. Archived from the original on May 8, 2024. Retrieved May 8, 2024 – via www.youtube.com.
16. ^ "Coreboot Project Is Leveraging NSA Software To Help With Firmware Reverse Engineering". Archived from the original on June 4, 2019. Retrieved June 5, 2019.
17. ^ "Compiled/built Ghidra 9.3 for Windows with Debugger feature by Galician R&D Center in Advanced Telecommunications employees". Archived from the original on November 25, 2022. Retrieved November 25, 2022.
18. ^ "Analizando el depurador de Ghidra". March 11, 2021. Archived from the original on December 14, 2022. Retrieved December 14, 2022.
19. ^ "What's new in Ghidra 10.0". Archived from the original on June 19, 2023. Retrieved June 24, 2021.
20. ^ Joyce, Rob [@RGB_Lights] (March 5, 2019). "Ghidra processor modules: X86 16/32/64, ARM/AARCH64, PowerPC 32/64, VLE, MIPS 16/32/64,micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, Others+ variants as well. Power users can expand by defining new ones" (Tweet). Archived from the original on March 7, 2019. Retrieved March 6, 2019 – via Twitter.
21. ^ "List of Processors Supported by Ghidra". Github.com. Archived from the original on October 12, 2023. Retrieved September 29, 2023.

## External links

[edit]

* Official website
* ghidra on GitHub

Portal:

* Free and open-source software

This free and open-source software article is a stub. You can help Wikipedia by expanding it.

|

* v
* t
* e

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template