Ghidra: NSA's Open-Source Reverse Engineering Framework

TL;DR: Ghidra is the NSA’s open-source software reverse engineering (SRE) framework. The Java-based tool combines a disassembler, decompiler, and scripting environment under Apache-2.0, and is widely used by security researchers analysing binaries.

What it is

NationalSecurityAgency/ghidra is the public release of the United States National Security Agency’s reverse engineering suite. The repository description reads “Ghidra is a software reverse engineering (SRE) framework”, and the topics on the GitHub side are listed as disassembler, reverse-engineering, and software-analysis. It is one of the largest public repositories of its kind, with around 76,750 stars and 8,468 forks at the time of writing.

The project has been public since 2019, was first created in March of that year, and is maintained by the NationalSecurityAgency organisation. The default branch is master, and the codebase is almost entirely Java, which makes it cross-platform out of the box.

What it does well

Ghidra bundles a full reverse-engineering workflow into one application:

• Disassembler and decompiler. Drop a binary in, get a navigable assembly listing and a C-like decompilation side by side. You can rename functions, retype variables, and annotate structures.
• Cross-references and call graphs. Jump between callers and callees, follow data flow, and inspect how a value is computed across a function.
• Headless analysis. A scripting interface (Java and Python via Jython) lets you automate bulk analysis, write custom processors, and integrate Ghidra into a research pipeline.
• Multi-user collaboration. A shared project mode allows several analysts to point at the same binary, useful for incident response.

Because the code is Apache-2.0 and written in Java, it runs on macOS, Linux, and Windows without modification. The 1,960 open issues reflect a project with a long tail of platform-specific bug reports rather than a stalled roadmap.

How to try it

Pre-built distributions are published on the Ghidra releases page. Download the zip, unzip, and run the launcher script for your JDK:

unzip ghidra_<version>_release.zip
cd ghidra_<version>
./ghidraRun   # or ghidraRun.bat on Windows

You’ll need a JDK 17 or newer. For scripted work, the Python interpreter bundled in Ghidra/Features/Base/lib is what scripts target by default.

When it fits, and when it doesn’t

Ghidra is the right pick when you are analysing native binaries, firmware, or malware samples and want a single tool that combines static analysis with scripting. It pairs well with dynamic analysis tools such as a debugger in a separate process. For pure source-level work, mobile apps, or web reverse engineering, specialised tooling will be a better fit.

It is also worth noting that Ghidra is heavy: startup is measured in seconds, and loading large binaries takes memory. If you only need to read a single function, a lightweight disassembler or objdump may be faster.

Source and Accuracy Notes

• Project page: https://github.com/NationalSecurityAgency/ghidra
• Source repository: NationalSecurityAgency/ghidra (verified via GitHub API html_url)
• License: Apache-2.0 (verified via GitHub API license.spdx_id)
• Stars at time of writing: 76,750
• Language: Java
• Homepage: none provided in repository metadata