Ghidra: The NSA's Own Tool for Turning Compiled Programs Back Into Readable Code

Ghidra is a software reverse engineering framework created and maintained by the National Security Agency Research Directorate, and it is free and open source under the Apache 2.0 license. It is a full suite of high-end software analysis tools for taking compiled code apart on Windows, macOS and Linux, and it supports a wide variety of processor instruction sets and executable formats. The NSA built it to solve scaling and teaming problems on complex reverse engineering efforts, and to provide a customizable and extensible research platform. The same capabilities the NSA uses to analyze malicious code and generate deep insights about potential vulnerabilities in networks and systems are the ones you get when you download it. It runs in both user-interactive and automated modes, so it works for a single analyst at a desk and for a pipeline that processes binaries on its own. It has 99,419 stars.

The core job is turning compiled programs back into readable code. Ghidra disassembles binaries, decompiles them into higher level code you can actually read, and graphs the flow of a program so you can follow how its pieces connect. Scripting ties it together: you can automate repetitive analysis and build your own extension components in Java or Python. That is in addition to the hundreds of other features in the framework. When you are hunting for a specific string, function name or byte pattern across decompiled output, building the pattern first in a Regex Tester saves a round of trial and error before you run the search. The point of the toolset is to go from a binary you cannot read to an understanding you can act on, whether that means finding a vulnerability, understanding what a piece of malware does, or checking what your own compiled code actually contains.

Reverse engineering is rarely a solo job on one binary, and Ghidra was built with that in mind. The framework was designed around teaming: multiple analysts working on complex efforts, sharing results and keeping their work consistent. Comparing two versions of a binary to see what changed between builds is a routine part of that work, and putting the decompiled output side by side in a Text Diff makes the changed lines obvious before you dig into them. Extensions and scripts let a team bend the platform to its own workflow, and the GhidraDev plugin for Eclipse plus Visual Studio Code support mean analysts can write and edit scripts in the editor they already use. The platform is customizable by design, because every reverse engineering effort has its own shape.

Two things are true about Ghidra right now, and neither one caused the other. AI agents like REA can now drive Ghidra too, which means automated agents can operate the framework as part of a larger analysis workflow. Separately, the project gained over 17,000 stars this month, a surge that puts it among the fastest growing open source projects on GitHub. The agent support is a new way to use the tool. The star growth is a sign of how many people want it. Both are worth knowing, and neither needs the other to matter.

Installing Ghidra is straightforward. Install JDK 25 64-bit, download the official multi-platform release file, named like ghidra_<version>_<release>_<date>.zip, from the Assets section of a release, and extract it. Do not extract it on top of an existing installation. Then launch it with ./ghidraRun, or ghidraRun.bat on Windows, or start PyGhidra with ./support/pyghidraRun. If you want the latest development build, clone the repo and build it with Gradle: install JDK 25, Gradle 9.1.0 or newer and Python 3.9 to 3.15, fetch the extra dependencies, then run gradle buildGhidra and find the build in build/dist/. One warning from the README is worth heeding: there are known security vulnerabilities in certain versions of Ghidra, so read the project's security advisories before you install.