Ghidra is a software reverse engineering framework developed by the US National Security Agency’s Research Directorate. It provides a comprehensive collection of tools for examining compiled programs, including applications for which the original source code is unavailable.
The software combines disassembly, decompilation, graphing and debugging in an integrated environment. Its decompiler translates machine code into a higher-level representation, helping analysts understand program logic and investigate unfamiliar binaries.
Ghidra is particularly useful for malware analysis, vulnerability research and understanding proprietary file formats or executable code. It can handle large projects and supports collaborative analysis by multiple researchers.
This is free and open source software.
Key Features
- Disassemble and analyse executable code across numerous processor architectures and binary formats.
- Decompile machine code into a C-like representation that can be inspected alongside the disassembly.
- Identify functions, references, strings, symbols and other structures within compiled programs.
- Display control-flow graphs and function-call relationships to help understand program behaviour.
- Rename symbols, define data types and annotate code as the analysis progresses.
- Provide debugging and emulation facilities for examining program execution.
- Support collaborative reverse engineering through shared projects and versioned analysis.
- Automate repetitive analysis using Java and Python scripting.
- Extend functionality through custom processors, loaders, analysers and other components.
- Run analysis interactively or automate processing through its headless analyser.
Website: github.com/NationalSecurityAgency/ghidra
Support: GitHub Code Repository
Developer: NSA’s Research Directorate
License: Apache License v2.0
Ghidra is written in Java. Learn Java with our recommended free books and free tutorials.
Related Software
| Binary Analysis Tools | |
|---|---|
| Ghidra | Software reverse engineering framework |
| Radare2 | Portable reversing framework |
| Cutter | Graphical reverse engineering platform |
| Capstone | Lightweight multi-architecture disassembly framework |
| Detect it Easy | File inspection utility |
| ImHex | Analyze binary data |
| Miasm | Reverse engineering framework for analysing and emulating binaries |
| Reko | General-purpose decompiler for machine-code binaries |
| capa | Command line malware analysis tool |
| binwalk | Search a given binary image for embedded files |
| FLOSS | FLARE Obfuscated String Solver |
| unblob | Extraction suite for working with unknown binary blobs |
| Rizin | UNIX-like reverse engineering framework |
| REDasm | Cross-platform disassembler with an extensible graphical interface |
| Pharos | Framework for automated static analysis of binary programs |
| LIEF | Work with executable and binary formats |
| RetDec | Retargetable machine-code decompiler |
| knife | Static binary triage, disassembly and vulnerability analysis toolkit |
Read our verdict in the software roundup.
| Debuggers | |
|---|---|
| LLDB | Next generation, high-performance debugger |
| Ghidra | Software reverse engineering framework |
| Delve | Source level debugger for the Go programming language |
| GDB | The GNU Debugger |
| Valgrind | A memory debugger and profiler |
| Radare2 | Portable reversing framework |
| BugStalker | Rust debugger |
| Xdebug | Extension for PHP to aid debugging and development |
| Seer | GUI frontend to GDB |
| iaito | Graphical interface for radare2 |
| React Native Debugger | Standalone app for debugging React Native apps |
| KDbg | Graphical user interface to GDB |
| strace | Diagnostic, debugging and instructional userspace utility |
| rr | Record-and-replay debugger |
| drgn | Programmable debugger that puts scripting at the centre |
| cgdb | Lightweight console frontend to the GNU debugger |
| PuDB | Console-based visual debugger for Python |
| nnd | Partially inspired by RemedyBG |
| bashdb | Source-code debugger for bash; follows the GDB command syntax |
| Sysprof | Profile an application or entire system |
| crash | Linux kernel crash analysis utility |
| Nemiver | Standalone graphical debugger for GNOME |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.