Ghidra

Ghidra is a free and open-source software reverse engineering (SRE) framework developed by the United States National Security Agency (NSA). It was released to the public in 2019 and is distributed under the Apache License 2.0. The tool runs on Windows, macOS, and Linux and requires Java 11 or later.

Key capabilities include a powerful disassembler, a decompiler that produces C-like pseudo code, a programmable analysis environment, and a graphical user interface. It supports a wide range of processor architectures (including x86, x86-64, ARM, AArch64, MIPS, PowerPC) and common executable formats (PE, ELF, Mach-O), as well as multiple object formats. Analysts can import binaries, inspect control flow, annotate, search for patterns, and compare versions. The integrated decompiler helps recover high-level constructs from compiled code. Ghidra also supports scripting and automation via Java and Python (via Jython), and can be extended with plugins and headless batch analysis for large-scale workflows.

Internally, Ghidra uses a project-based design with a graphical user interface and a pipeline of analyzers. It is designed to be extensible through a plugin architecture, allowing researchers to add processors, data types, and analysis routines. The headless mode enables automation without the GUI, suitable for CI pipelines or batch processing.

Since its release, Ghidra has been adopted by researchers, security teams, and malware analysts around the world and has a growing community contributing plugins, scripts, and documentation.