Description
Want to understand what a program with no source code actually does — analyzing malware, studying firmware, hunting bugs in closed-source software — but all you have is machine code? That is exactly what Ghidra is for: a software reverse-engineering platform open-sourced by the NSA that disassembles binaries and decompiles them into C-like pseudocode, letting you read a compiled program almost like source.
Its killer feature is that decompiler — almost nothing else offers this quality for free; capability that used to cost thousands in commercial tools is now open on the table. It supports dozens of processor architectures, lets you rename, annotate and define structures for interactive analysis, and scripts in Java/Python with team collaboration on a shared target. For anyone doing security research, CTF, malware analysis or vulnerability hunting, this is an unavoidable piece of kit. Apache 2.0, open source, cross-platform.
Disassembler + decompiler: disassembles a binary into assembly and further decompiles it into C-like pseudocode, so you can read what a program does without reading assembly.
Many processor architectures: analyzes x86, x64, ARM, AArch64, MIPS, PowerPC, SPARC and many more — barely picky about firmware or platform.
Interactive analysis: rename functions and variables, add comments, define data structures, and the analysis updates live, building a readable record of the binary.
Scripting & automation: built-in Java and Python scripting for batch analysis and automated workflows, plus a plugin ecosystem.
Team collaboration: share one analysis project across a team so several people can work a large target together with synced markup.
Free and open source: a professional-grade SRE platform the NSA open-sourced, rivaling disassemblers that cost thousands of dollars, for free.
Its killer feature is that decompiler — almost nothing else offers this quality for free; capability that used to cost thousands in commercial tools is now open on the table. It supports dozens of processor architectures, lets you rename, annotate and define structures for interactive analysis, and scripts in Java/Python with team collaboration on a shared target. For anyone doing security research, CTF, malware analysis or vulnerability hunting, this is an unavoidable piece of kit. Apache 2.0, open source, cross-platform.
Features
Disassembler + decompiler: disassembles a binary into assembly and further decompiles it into C-like pseudocode, so you can read what a program does without reading assembly.
Many processor architectures: analyzes x86, x64, ARM, AArch64, MIPS, PowerPC, SPARC and many more — barely picky about firmware or platform.
Interactive analysis: rename functions and variables, add comments, define data structures, and the analysis updates live, building a readable record of the binary.
Scripting & automation: built-in Java and Python scripting for batch analysis and automated workflows, plus a plugin ecosystem.
Team collaboration: share one analysis project across a team so several people can work a large target together with synced markup.
Free and open source: a professional-grade SRE platform the NSA open-sourced, rivaling disassemblers that cost thousands of dollars, for free.
