The Ghidra Book
Kara Nance, Chris Eagle · No Starch Press · Second edition · 2026
Identifier: ISBN 978-1-7185-0468-4
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
The reference manual for Ghidra: core reverse-engineering technique, Ghidra's data displays, the decompiler, collaborative server-based analysis, customisation and new data types, headless operation, and scripting — with Python 3 support through PyGhidra new to this edition.
Who it is for, and when
The practical route into reverse engineering for anyone who cannot justify an IDA licence, which is most people outside a large lab. The headless and scripting chapters are what turn Ghidra into something you can run across many samples in a case rather than one at a time. Note the byline order reversed from the first edition.
What it does not cover
A tool manual, not a malware or exploitation course — it teaches Ghidra, not what to look for. Published in March 2026, so there is no accumulated community errata yet, and like any tool-specific book it will date on the project's release cadence.
Go to the source
Open at nostarch.com (opens in a new tab)https://nostarch.com/ghidra-book-2e
Details
- Type
- Book
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Kara Nance, Chris Eagle
- Publisher
- No Starch Press
- Version verified
- Second edition
- Year
- 2026
- Identifier
- ISBN 978-1-7185-0468-4
- Topics
- reverse-engineering, malware, scripting
- Checked at source
Related entries
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
Binary analysis from the format upward on Linux: ELF and PE structure, writing a loader with libbfd, how disassembly actually works and where it goes wrong, ELF code injection, then binary instrumentation with Pin, dynamic taint analysis with libdft, and symbolic execution with Triton.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
OpenSecurityTraining2
Partly freeAn Open edX platform hosting long-form, university-length classes in low-level computing: x86-64 assembly, OS internals, firmware and UEFI, debuggers (WinDbg, GDB, IDA, Ghidra, Binary Ninja, HyperDbg), reverse engineering, vulnerability classes, exploitation, fuzzing, trusted computing and Bluetooth security. Actively maintained — 2025 additions include AFL++ fuzzing, Bluetooth reconnaissance and TPM programming in Python, with an introductory emulator course listed for 2026.