01 · Product name
Ghidra
NSA's open-source framework for disassembling and decompiling binaries.
Published by National Security Agency Research Directorate.
In short
Ghidra is the National Security Agency Research Directorate's open-source software reverse engineering framework. It disassembles, decompiles, graphs, and scripts binaries across many processors and executable formats, on Windows, macOS, and Linux. The project is free under the Apache 2.0 license. You install a release build and a current JDK, then open a program you are allowed to analyze. A decompiler listing is a reading of the binary. It is not a verdict that the file is malicious.
Product pricing strategy
02
Free
Ghidra is free. The repository is Apache License 2.0, and the project site does not sell a seat or a support plan. You download a release build from the GitHub releases page and install JDK 25, which the README names as the required 64-bit JDK. This listing does not invent a price for vendor support. The license file and the releases page are the sources.
Utility and features
03
The Ghidra README calls the project a software reverse engineering framework created and maintained by the National Security Agency Research Directorate. Capabilities listed there include disassembly, assembly, decompilation, graphing, and scripting, plus support for many processor instruction sets and executable formats. It runs in interactive and automated modes on Windows, macOS, and Linux. Extensions and scripts can be written in Java or Python. The same README says Ghidra was built for team analysis of complex programs and has been applied to analyzing malicious code. The public site, ghidra-sre.org, redirects to NationalSecurityAgency/ghidra.
- Disassembly and decompilation. The README lists disassembly, assembly, decompilation, graphing, and scripting across many processors and executable formats.
- Interactive or scripted. The same page says Ghidra runs in user-interactive and automated modes, with extensions in Java or Python.
- A release build, not the source zip. The install notes say to download the release file named ghidra_<version>_<release>_<date>.zip. The Source Code assets are the wrong file for that step.
Install from an official release zip, not from the Source Code assets attached to a GitHub release. The README requires a 64-bit JDK 25, and it says not to extract a new build over an existing installation. Start the interface with ghidraRun or ghidraRun.bat, or start PyGhidra with support/pyghidraRun. The README also warns that certain versions have known security vulnerabilities and points to the security advisories. Read those before you leave an old build on a shared machine.
GhidraMCP is a separate project that exposes a running Ghidra to an MCP client. VirusTotal and MalwareBazaar answer whether a hash was seen. Ghidra is where you read the program, on a file you are allowed to open.
- 1
Install the 64-bit JDK 25 named in the Ghidra README.
- 2
Download the official multi-platform release zip from the releases page, not the Source Code assets.
- 3
Extract it beside any older install, not on top of one, and start ghidraRun or ghidraRun.bat.
- 4
Import a binary you are allowed to analyze. Read the decompiler as a draft, and check the security advisories for the build you installed.
Caveats
04
The README warns that certain Ghidra versions have known vulnerabilities and points at the security advisories. Install from an official release zip, and do not extract it over an install you already have.
Decompilation is an aid. It can be incomplete. Analyze only binaries you are allowed to open, and do that in a lab when the file is untrusted. This page does not describe how to unpack malware or how to reproduce a vulnerability.
Screenshots
05
Potential use cases
06
- You have a binary you are allowed to open and a hash lookup was not enough. Import it into a Ghidra project on a machine you control, in a lab if the file is untrusted. The output is a disassembly and a decompiler listing, which is a reading of the bytes, not a verdict that the file is malicious. Pivot the hash to VirusTotal or MalwareBazaar before you invest in a long reversing session. This page does not describe unpacking malware or reproducing a vulnerability.
- You need a graph and annotations in a project you control. Create the project, name the functions you actually understood, and export the notes with the Ghidra version. The output is that project. It is not portable truth. Another version of Ghidra can decompile differently. The README is the source for the JDK it requires and for the release zip you should install. Do not extract a new build over an old one.
- A repeatable pass belongs in a script in Java or Python against that project. The output is the script plus the listing it produced. Keep it with the project. GhidraMCP is the separate project if an MCP client needs to talk to a running Ghidra. It is not part of the NSA release. Read the security advisories the README points at before you leave an old build on a shared machine.
Hard cases
The case where the first result is easy to over-read.
The decompiler is briefed as what the program does
The listing is readable and incomplete. Name the function you read, the Ghidra version, and the file hash. Do not write ‘the malware steals passwords’ because a string looked suggestive. If you have not confirmed the behavior from something other than one decompiler pane, say you read the listing. Untrusted files stay in the lab. This page still does not tell you how to unpack them.
Questions
Is Ghidra free?
Yes. The repository is Apache License 2.0. The project site does not list a paid edition or a seat price.
Does Ghidra decide that a file is malware?
No. It reads a binary you import. VirusTotal and MalwareBazaar are the hash lookups. A decompiler listing is not a verdict.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Ghidra project site
https://ghidra-sre.org/Product
Ghidra repository
https://github.com/NationalSecurityAgency/ghidraDocumentation
Ghidra README
https://github.com/NationalSecurityAgency/ghidra/blob/master/README.mdDocumentation
Ghidra getting started
https://github.com/NationalSecurityAgency/ghidra/blob/master/GhidraDocs/GettingStarted.mdDocumentation
Ghidra releases
https://github.com/NationalSecurityAgency/ghidra/releasesDocumentation
Ghidra security advisories
https://github.com/NationalSecurityAgency/ghidra/security/advisories