The NSA gives away its reverse engineering framework. Seven years on, it remains one of the most widely used free reverse engineering tools.
What Is Ghidra?
Ghidra is the NSA's open-source software reverse engineering (SRE) framework, released publicly in 2019. It disassembles and decompiles compiled binaries, so an analyst can read what a program does without having the source code.
It runs on Windows, macOS, and Linux, supports a wide range of processor architectures and executable formats, and covers disassembly, decompilation, debugging, emulation, and scripting in one package. (GitHub)
The current release is Ghidra 12.1.3, released on 18 August 2026. The project continues to receive regular releases and maintenance updates. (GitHub)
How Does It Work?
You load a binary. Ghidra disassembles it into instructions, then lifts those into P-code, its processor-independent intermediate language. The decompiler turns P-code into C-like output you can read.
Setup has two paths. Running an official release needs JDK 21, 64-bit. For the Ghidra 12.1.3 release source, building requires JDK 21, Gradle 8.5 or later, and Python 3.9 to 3.14. The current development branch has since moved to JDK 25 and Gradle 9.1.0+. (GitHub)
Download the release from the project's GitHub repository, extract it, then run ghidraRun.bat on Windows or ./ghidraRun on macOS and Linux.
What Changed in Ghidra 11.3?
Version 11.3, released in February 2025, introduced several important features that remain part of current Ghidra builds. (Help Net Security)
- Visual Studio Code integration. Ghidra can create VS Code module projects and open scripts for editing in VS Code, although Eclipse remains the recommended environment for developing Ghidra itself.
- PyGhidra. Native CPython 3 access to the Ghidra API through JPype, originally built by the Department of Defense Cyber Crime Center.
- JIT P-code emulator. A just-in-time emulator that acts as a near drop-in replacement for the existing one.
- Debugger rework. The legacy IN-VM and GADP launchers were removed in favour of TraceRmi. macOS kernel debugging arrived via lldb, and Windows kernel debugging inside a VM via dbgeng.
- String handling. LibreTranslate support for self-hosted translation, plus full-text search across every decompiled function in a binary.
- Processor support. x86 AVX-512 EVEX masking, corrected ARM VFPv2 instruction handling, and better TI_MSP430 decompilation.
One compatibility note: programs created in 11.3 cannot be opened by earlier Ghidra versions. (Help Net Security)
What Do Analysts Use It For?
Malware analysis. Working out what a sample does when there is no source and the vendor report is thin.
Vulnerability research. Reading closed-source binaries for memory-safety and logic flaws.
Firmware and IoT. Router, camera, and embedded images rarely ship with source, and the architectures vary.
Patch diffing. Comparing a patched binary against the previous version to locate the flaw a vendor fixed but did not describe.
Why Does It Matter?
Cost is the obvious part. Because Ghidra is free and open source, teams can deploy it without per-seat reverse-engineering licensing costs.
The more useful part is P-code. Because P-code provides a processor-independent intermediate representation, analysis written against P-code-level abstractions can often be reused across architectures with less architecture-specific logic.
Common Mistakes
- Treating decompiler output as source code. It is a reconstruction, and it can be wrong. Check it against the disassembly before drawing conclusions.
- Opening malware on a working machine. Importing and statically analysing a binary does not normally execute the target program, but launching it through the debugger does.
- Ignoring version alignment across a team. Newer Ghidra versions may upgrade project data in ways that older versions cannot read.
How to Reduce the Risk
- Analyse samples in an isolated VM with no network route to production
- Keep the debugger off any host holding client data or credentials
- Verify downloads against the SHA-256 published with each release
- Pin one Ghidra version across the team so project files stay portable
- Treat third-party scripts and extensions as code you are choosing to run
What Should Security Testing Cover?
If you ship compiled software, ask your testers to establish:
- Whether your binaries leak secrets, internal endpoints, or licensing logic when decompiled
- What an attacker learns from your firmware or mobile app in an afternoon
- Whether obfuscation or anti-tamper survives contact with a decompiler
How OraSec Can Help
Reverse engineering finds what a source code review misses, because it examines what actually shipped rather than what was written. OraSec's mobile application security testing and IoT penetration testing include binary analysis of the artefacts your customers receive.
Conclusion
Ghidra is not a scanner and it will not tell you what is wrong. It gives you a readable view of a binary and leaves the judgement to you.
That is the whole value. The tool is free, and the skill is not.
FAQs
Is Ghidra free for commercial use? Yes. It is open source under the Apache 2.0 licence, with no commercial restriction.
Is Ghidra 11.3 still worth using? It works, but it is from February 2025 and several releases behind. Use the current version unless a project file ties you to an older one.
Does Ghidra replace IDA Pro? Ghidra is a genuine alternative to IDA Pro for many reverse-engineering workflows. Teams often run both, because the two decompilers fail in different places.
Do I need to know assembly? It helps considerably. The decompiler makes binaries readable, but verifying its output means reading the disassembly underneath.
Can Ghidra analyse mobile apps and firmware? Yes. It handles a wide range of architectures and executable formats, which is why it is common in IoT and mobile assessments.
