Ghidra: what it is and how to use it

What is Ghidra?

Ghidra is a software reverse engineering (SRE) framework developed by the NSA and released as open source in 2019. It includes a disassembler, a decompiler to C-like pseudocode, graph analysis, Java and Python scripting, collaborative work and support for a huge number of architectures (x86, x64, ARM, AArch64, MIPS, PowerPC and many more). It is cross-platform (Windows, Linux and macOS) and completely free.

Before Ghidra, having a quality decompiler meant paying for expensive licenses. Its release democratized reversing: today it is the default static analysis tool in courses, CTFs and malware analysis teams.

What Ghidra is used for

Malware analysis: understanding what a sample does without running it, locating its configuration, encryption routines or C2 protocol.
Vulnerability research: reviewing closed-source binaries, diffing patched versions and finding dangerous functions.
Firmware and IoT: analyzing binaries from routers, cameras or microcontrollers with unusual architectures.
CTFs and crackmes: reading the pseudocode of the validation function instead of fighting raw assembly.

How to install Ghidra

Install a 64-bit JDK in the version required by the release notes of the version you will use (Ghidra is written in Java).
Download the ZIP from the official website or GitHub releases and unzip it.
Launch the tool:

# Linux / macOS
./ghidraRun

# Windows
ghidraRun.bat

On Kali Linux it is also available from the repositories:

sudo apt install ghidra

Then create a project (File → New Project), import the binary with I or by dragging it, open it in the CodeBrowser and accept auto-analysis.

Practical Ghidra examples

Basic CodeBrowser workflow

In Symbol Tree → Functions look for main or the entry point.
Open Window → Defined Strings to find interesting messages and jump to their references.
Read the pseudocode in the Decompile window and rename variables and functions with L as you understand them.
Change types with Ctrl+L and add comments with ;. The decompiler improves as you feed it information.
Use Show References to (Ctrl+Shift+F) to see where a function is called from.

Headless analysis

To analyze many binaries or plug Ghidra into a pipeline, it ships analyzeHeadless:

./support/analyzeHeadless /tmp/projects Samples \
  -import ./sample.bin \
  -postScript ListFunctions.py \
  -deleteProject

A simple script

From the Script Manager you can create scripts. This one lists every function with its address:

# @category Examples
fm = currentProgram.getFunctionManager()
for f in fm.getFunctions(True):
    print("%s %s" % (f.getEntryPoint(), f.getName()))

Only analyze your own binaries, lab samples or software you are authorized to examine.

Pro tips

If the binary is packed, the analysis will be garbage: check first with Detect It Easy or PEiD and unpack it.
Apply signatures (Function ID) and library types so libc or Windows functions show up with names.
Define structures in the Data Type Manager: turning a generic pointer into struct config * transforms the pseudocode.
Use Version Tracking to port your annotations to a new version of the same binary.
For dynamic analysis, pair it with x64dbg or Ghidra's built-in debugger.

Ghidra pros and cons

Pros	Cons
Free and open source	Java interface feels heavy and dated
Powerful decompiler for many architectures	Uses a lot of memory on large binaries
Scripting, headless mode and extensions	The API is large and takes time to master
Collaboration via Ghidra Server	Steep learning curve at first

Ghidra alternatives

Binary Ninja: more modern interface, very clean ILs and an excellent API (paid, with a free edition).
x64dbg: the ideal dynamic companion on Windows.
Binwalk: to extract firmware before loading it into Ghidra.
IDA Pro: the classic commercial industry standard.

Frequently asked questions

Is Ghidra free?

Yes. Ghidra is free and open source under the Apache 2.0 license, decompiler included.

Is it safe to use Ghidra if the NSA made it?

The source code is public and has been reviewed by the community for years. As with any software, download it only from the official website or the official GitHub repository.

Ghidra or IDA Pro?

IDA is still very strong in some scenarios, but for learning and for most analysis work Ghidra is more than enough and costs nothing.

How do I start using Ghidra?

Create a project, import a simple crackme, let auto-analysis run and read the main function in the decompiler while renaming variables. Repeat with increasingly complex binaries.

If you want to practice reversing with progressive challenges, there are exercises in the Hackers en Acción Academy.

Ghidra

// DESCRIPTION