Ghidra is a software reverse engineering framework built and maintained by the National Security Agency's Research Directorate, a desktop application suite for taking apart compiled programs when you do not have the source code. It is aimed at security researchers, malware analysts, vulnerability hunters and firmware engineers — anyone who is handed an executable and needs to know what it actually does. The project has been public on GitHub since March 2019, is licensed under Apache-2.0, and has collected more than 76,000 stars and over 8,400 forks in that time.
What it does
Ghidra loads a compiled binary and gives you several views of it at once. The core capabilities named by the project are disassembly, assembly, decompilation, graphing and scripting, alongside hundreds of smaller features layered on top.
In practice that means you can:
- read the raw instruction listing for the binary's architecture
- read a decompiled, C-like reconstruction of the same code beside it
- follow a call graph to see how functions reach one another
- rename, retype and annotate as you work, so the listing becomes progressively more readable
It supports a wide variety of processor instruction sets and executable formats, which is what lets the same tool serve a Windows desktop binary, a Linux server daemon and an embedded firmware image. It can be run interactively by a person, or driven in an automated mode as part of a larger pipeline.
How it works
Ghidra is written in Java and runs as a native-feeling desktop application on Windows, macOS and Linux. Analysis is organised into a project that holds one or more imported programs, and the tool windows — listing, decompiler, graphs — stay synchronised on the same address as you navigate.
The framework was deliberately built to be extended. Users can write their own Ghidra extension components and scripts in either Java or Python, which is the route most teams take when they need a repeatable transformation: a custom loader for an unusual file format, a script that marks up every call to a particular API, a batch job that runs over a directory of samples.
The design goals behind this are stated plainly in the project's own description: Ghidra was built to solve scaling and teaming problems on complex reverse engineering efforts, and to serve as a customisable, extensible research platform. That origin shows in how the software is shaped — it assumes more than one analyst, working over a long period, on a body of binaries rather than a single file.
Getting started
The supported path is the official pre-built multi-platform release. You install a 64-bit JDK 25, download the release archive from the project's releases page, and unpack it — Ghidra is distributed as a zip rather than an installer.
One thing to read before you do any of that: the project publishes its own security advisories and warns explicitly that certain versions of Ghidra contain known security vulnerabilities. Since the whole point of the tool is opening files you do not trust, going through those advisories and running a current version is part of setup, not an optional extra.
Building from source is possible — the repository holds the full Java codebase — but for most people the release archive is the shorter route to a working install.
When to use it / when not
Ghidra is the right tool when you have a binary and no source: inspecting a suspicious executable, checking what a closed-source component sends over the network, auditing firmware, or understanding an old program nobody has the build for any more. It is also the obvious starting point when budget matters, because the capability set it offers has historically sat behind expensive commercial licences, and here it is free and Apache-2.0 licensed.
It is the wrong tool if you have the source code — a debugger and a normal toolchain will tell you more, faster. It is also a poor fit if you want something lightweight: this is a large Java desktop application with a JDK dependency and a real learning curve, not a command you pipe output through. And reverse engineering software you do not have the right to analyse is a legal question that no tool answers for you.
Anyone doing security work on compiled code should have Ghidra installed. It is the rare case of a government-funded internal tool released in full, under a permissive licence, with the decompiler that used to be the expensive part included rather than sold separately. For students and independent researchers it removes the main cost barrier to learning reverse engineering at all; for teams, its scripting and extension model means the knowledge you build about a binary can be captured in code rather than in one analyst's head. The install is heavier than most tools in this catalogue and the advisories are worth taking seriously, but nothing else in the open-source world covers this ground as completely.