# Ghidra Ghidra is a software reverse engineering (SRE) framework created and maintained by the Research Directorate of the National Security Agency (NSA). You give it a compiled program, and it helps you figure out what that program does without having the source code. Security teams use it to analyze malicious code (malware) and to assess vulnerabilities. The NSA built it for its own analysts. They needed to scale reverse engineering work, coordinate teams working on the same binaries, and have an extensible platform for research. Ghidra first surfaced publicly in 2017, in the WikiLeaks Vault 7 leak. In March 2019, the NSA released it as [[Open Source]] at the RSA Conference. The code lives on GitHub under the [[Apache 2.0 License]]. ## What it does - Disassembly (machine code back to assembly), assembly, decompilation (assembly back to C-like pseudocode), graphing and scripting - Support for many processor instruction sets and executable formats - Interactive use through the GUI, or a headless mode for automated analysis - Extensions and scripts written in Java or [[Python]] (PyGhidra, started with `support/pyghidraRun`) - Integration with [[Visual Studio Code (VSCode)|VS Code]] and Eclipse (GhidraDev) to write those scripts and extensions - **Multi-user collaboration**: several analysts work on the same project through a shared project server It runs on Windows, macOS and [[Linux]]. ## Installing it Ghidra needs a 64-bit JDK 25. Extract the release zip into a fresh directory (NOT on top of an older install), then run `ghidraRun`. Building from source is more involved: Gradle 9.1+, Python 3.9 to 3.15 and a C/C++ toolchain. Some versions have known vulnerabilities, so check the repository's security advisories before you pick one. ## Why it matters The best-known commercial disassembler and decompiler, IDA Pro, is very expensive. Ghidra costs nothing and ships with a decompiler, which puts serious reverse engineering within reach of students, independent researchers and small security teams. It's also an example of a government building a world-class tool for internal use and then open-sourcing it. The project is also very active: as of October 2026, the repository has about 91.1k stars, 10.2k forks and 18.8k commits. ## Ghidra and AI agents The community has started connecting Ghidra to [[Large Language Models (LLMs)]]. GhidraMCP (LaurieWired, 2025) is a [[Model Context Protocol (MCP)]] server that lets [[AI Agents]] drive Ghidra for automated reverse engineering. This is a community project, not part of the NSA release. Reverse engineering means reading a lot of decompiled code and naming functions and variables, and LLMs are good at that kind of work. I'd still verify whatever an agent concludes about a binary before acting on it. ## References - https://github.com/NationalSecurityAgency/ghidra - https://ghidra-sre.org/ - https://github.com/NationalSecurityAgency/ghidra/security/advisories - https://github.com/LaurieWired/GhidraMCP ## Related - [[Open Source]] - [[Apache 2.0 License]] - [[Python]] - [[Visual Studio Code (VSCode)]] - [[Model Context Protocol (MCP)]] - [[AI Agents]] - [[IT Security (MoC)]]