Ghidra

Ghidra
Original authorNational Security Agency
ReleaseMarch 5, 2019; 7 years ago (2019-03-05)
Stable release
12.1.4 / August 18, 2026; 2 months ago (2026-08-18)
Written inJava, C++
LicenseApache License 2.0 / Public domain
Websiteghidra-sre.org
Repositorygithub.com/NationalSecurityAgency/ghidra

Ghidra (/ˈɡiːdrə/ GEE-druh) is a free and open source reverse engineering tool developed by the National Security Agency (NSA) of the United States. The binaries were released at the RSA Conference in March 2019; the source code was published one month later on GitHub.

The software is written in Java using the Swing framework for the GUI. The decompiler component is written in C++, and is therefore usable in a stand-alone form. Scripts to perform automated analysis with Ghidra can be written in Java or Python; current versions support Python through PyGhidra, while Jython is available as an optional extension. Plugins adding new features to Ghidra itself can be developed using a Java-based extension framework.

Many security researchers consider Ghidra to be a viable open source alternative to the proprietary IDA Pro.[weasel words]

History

Ghidra's existence was originally revealed to the public via Vault 7 in March 2017, but the software itself remained unavailable until its official declassification and release two years later. Some comments in its source code indicate that it existed as early as 1999.

High-level changelog
Version Year Major features
1.0 2003 Proof of concept
2.0 2004 Database, docking windows
3.0 2006 SLEIGH, decompiler, version control
4.0 2007 Scripting, version tracking
5.0 2010 File system browser
6.0 2014 First unclassified version
9.0 2019 First public release
9.2 2020 Graph visualization, new PDB parser
10.0 2021 Debugger
11.0 2023 Rust and Go binaries support, BSim
11.1 2024 Swift and DWARF 5 support, Mach-O improvements

In June 2019, coreboot began to use Ghidra for its reverse engineering efforts on firmware-specific problems following the open source release of the Ghidra software suite.

Ghidra can be used as a debugger since Ghidra 10.0. Ghidra's debugger supports debugging user-mode Windows programs via WinDbg, Linux programs via GDB and macOS programs via LLDB.

Supported architectures

Over twenty CPU architectures or binary formats are supported.

See also

References

  1. ↑ "Releases · NationalSecurityAgency/ghidra". GitHub. Archived from the original on September 16, 2026. Retrieved September 24, 2026.
  2. ↑ "ghidra/NOTICE". GitHub.com. Archived from the original on October 27, 2022. Retrieved April 13, 2019.
  3. ↑ "Come Get Your Free NSA Reverse Engineering Tool!". YouTube.com. May 16, 2019. Archived from the original on December 15, 2021. Retrieved May 17, 2019.
  4. ↑ "Frequently asked questions". GitHub.com. Archived from the original on March 5, 2019. Retrieved March 7, 2019.
  5. 1 2 Newman, Lily Hay. "The NSA Makes Ghidra, a Powerful Cybersecurity Tool, Open Source". Wired. Archived from the original on March 6, 2019. Retrieved March 6, 2019.
  6. ↑ e. g. as Plugin Archived 2022-10-14 at the Wayback Machine for Radare2 or Rizin.
  7. ↑ "What's New in Ghidra 12.1". GitHub. Retrieved August 30, 2026.
  8. ↑ "Ghidra Advanced Development Class". GitHub. Archived from the original on February 20, 2023. Retrieved February 19, 2023.
  9. ↑ Cimpanu, Catalin. "NSA releases Ghidra, a free software reverse engineering toolkit". ZDNet. Archived from the original on March 6, 2019. Retrieved March 7, 2019.
  10. ↑ "NSA to release a free reverse engineering tool". ZDNET. Archived from the original on February 22, 2024. Retrieved February 22, 2024.
  11. ↑ "Build software better, together". GitHub. Archived from the original on February 22, 2024. Retrieved February 22, 2024.
  12. ↑ "ghidra/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html at master · NationalSecurityAgency/ghidra". GitHub. Archived from the original on May 8, 2024. Retrieved May 8, 2024.
  13. ↑ Ghidra - Journey from Classified NSA Tool to Open Source. Archived from the original on May 8, 2024. Retrieved May 8, 2024 – via www.youtube.com.
  14. ↑ NationalSecurityAgency. "ghidra/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md at master · NationalSecurityAgency/ghidra". GitHub. Retrieved March 12, 2026.
  15. ↑ "Coreboot Project Is Leveraging NSA Software To Help With Firmware Reverse Engineering". Archived from the original on June 4, 2019. Retrieved June 5, 2019.
  16. ↑ "What's new in Ghidra 10.0". Archived from the original on June 19, 2023. Retrieved June 24, 2021.
  17. ↑ Joyce, Rob [@RGB_Lights] (March 5, 2019). "Ghidra processor modules: X86 16/32/64, ARM/AARCH64, PowerPC 32/64, VLE, MIPS 16/32/64, micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, Others+ variants as well. Power users can expand by defining new ones" (Tweet). Archived from the original on March 7, 2019. Retrieved March 6, 2019 – via Twitter.
  18. ↑ "List of Processors Supported by Ghidra". Github.com. Archived from the original on October 12, 2023. Retrieved September 29, 2023.