Ghidra
U.S. National Security Agency · Ghidra 12 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Who it is for, and when
Ghidra is the main free answer to the question of what an unknown binary actually does — decompiling a dropper found on a suspect machine, identifying hard-coded credentials or command-and-control addresses, or establishing whether two samples share code. Its decompiler is good enough that examiners without commercial licences can produce defensible reverse-engineering findings, and its scripting layer supports repeatable, documentable analysis. Shared projects allow more than one analyst on the same binary.
What it does not cover
Ghidra is static analysis: it does not run the sample, so packed, encrypted, or heavily obfuscated code needs dynamic analysis or unpacking first, and its debugger integration is not a substitute for a purpose-built sandbox. Decompiler output is a reconstruction, not source code, and treating it as literal in a report is an error. It has no role in disk, memory, or mobile examination.
Go to the source
Open at github.com (opens in a new tab)https://github.com/NationalSecurityAgency/ghidra/wiki
Details
- Type
- Tool
- Written for
- AdvancedAdvanced
- Publisher
- U.S. National Security Agency
- Version verified
- Ghidra 12
- Year
- 2026
- Topics
- reverse-engineering, malware, open-source, scripting
- Checked at source
Related entries
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
Binary analysis from the format upward on Linux: ELF and PE structure, writing a loader with libbfd, how disassembly actually works and where it goes wrong, ELF code injection, then binary instrumentation with Pin, dynamic taint analysis with libdft, and symbolic execution with Triton.
The Ghidra Book
PaidThe reference manual for Ghidra: core reverse-engineering technique, Ghidra's data displays, the decompiler, collaborative server-based analysis, customisation and new data types, headless operation, and scripting — with Python 3 support through PyGhidra new to this edition.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
YARA and YARA-X
FreeA pattern-matching language and scanner for identifying files by their content — strings, byte sequences, and structural conditions — used to label malware families and find known artefacts at scale. YARA-X is a ground-up rewrite in Rust from the same maintainers and is now the forward direction of the project; the original YARA 4.x line still receives releases and remains widely deployed.