Ghidra
| Company type | Open source software |
|---|---|
| Industry | Software reverse engineering, cybersecurity |
| Founded | March 2019 |
| Founder | United States National Security Agency (NSA) |
| Headquarters | United States |
| Products | Software reverse engineering platform |
| Owner | United States National Security Agency (NSA) |
| Website | ghidra-sre |
Ghidra (pronounced GEE-druh; ) is a no-cost, open source software reverse engineering platform developed by the United States' National Security Agency (NSA). Its executable files were unveiled at the RSA Conference in March 2019, followed by the release of its source code on GitHub a month afterward. Ghidra is commonly viewed as a rival to IDA Pro within the cybersecurity industry. The application is mainly coded in Java, utilizing the Swing toolkit for its graphical user interface, while its decompiler module is implemented in C++, enabling it to operate independently.
Scripts for automated analysis in Ghidra can be authored using Java or Python through Jython, with further language options provided by community-developed plugins. Its extensible framework, based on Java, also facilitates plugin creation that broadens Ghidra’s functionality, allowing adaptation to various reverse engineering requirements.
History
Ghidra was initially exposed publicly as part of Vault 7 in March 2017 but was not accessible until it was declassified and officially launched two years later. Comments within the source code imply that development began as early as 1999.
| Version | Year | Key enhancements |
|---|---|---|
| 1.0 | 2003 | Concept demonstration |
| 2.0 | 2004 | Introduction of database and docking windows |
| 3.0 | 2006 | SLEIGH language, decompiler, version control system |
| 4.0 | 2007 | Scripting capabilities and version tracking |
| 5.0 | 2010 | File system browsing features |
| 6.0 | 2014 | First release without classification restrictions |
| 9.0 | 2019 | Initial public launch |
| 9.2 | 2020 | Graph visualization tools, updated PDB parser |
| 10.0 | 2021 | Debugger support integration |
| 11.0 | 2023 | Support for Rust and Go binaries, BSim addition |
| 11.1 | 2024 | Added support for Swift and DWARF 5, enhancements to Mach-O format handling |
After becoming open source in 2019, the coreboot initiative incorporated Ghidra for firmware analysis tasks, underscoring its increasing significance in the sector.
Starting with version 10.0, Ghidra features an official debugger that supports user-mode Windows applications via WinDbg and Linux applications through GDB, boosting its effectiveness for software inspection and debugging processes.
Supported architectures
Ghidra accommodates an extensive variety of architectures and binary formats, providing comprehensive reverse engineering support across numerous platforms. Notable supported architectures include:
- x86 16-bit, 32-bit, and x86 64-bit
- ARM and AARCH64
- PowerPC 32/64-bit and VLE variants
- MIPS architecture 16/32/64-bit along with MicroMIPS
- Motorola 68000 series
- Java virtual machine and DEX bytecode
- PA-RISC
- RISC-V
- eBPF and Berkeley Packet Filter
- Tricore
- Various PIC microcontrollers including PIC12/16/17/18/24 series
- SPARC 32/64-bit processors
- CompactRISC CR16C series
- Zilog Z80
- MOS Technology 6502
- Motorola MC6805/6809, HC05/HC08/HC12 families
- Intel 8048, 8051, 8085 processors
- General_Instrument_CP1600
- TI MSP430 microcontrollers
- Both AVR microcontrollers AVR8 and AVR32 variants
- Architectures such as SuperH, V850, LoongArch, and Xtensa