Ghidra Reverse Engineering Suite

Ghidra is a free and open-source software reverse engineering (SRE) framework developed by the National Security Agency (NSA) of the United States. Created at the NSA Research Directorate over many years, it was publicly released at the RSA Conference in March 2019. The NSA open-sourced the tool to provide a free alternative to commercial reverse engineering tools like IDA Pro (which costs thousands of dollars per license). Written primarily in Java with native components in C++. Key features: disassembler and decompiler: provides both a disassembler (showing assembly instructions) and a decompiler (generating C-like pseudocode from binary executables). The decompiler supports multiple processor architectures. Multi-architecture: supports over 40 processor architectures and multiple executable formats (PE, ELF, Mach-O, COFF, FAT). Program analysis: function identification, automatic analysis, reference tracking (direct and indirect), data type recovery, and string search. Control flow graphs, call graphs, and data flow analysis. Scripting and automation: full Java API and Python scripting (via Jython or Ghidrathon). Scripts automate analysis tasks, write custom analyzers, and batch-process binaries. Collaborative analysis: the server component allows multiple analysts to work on the same binary simultaneously, sharing annotations, function names, and types. Versioning tracks changes with full history. Patching: modify binaries and create patched versions. Extensibility: plugin architecture for custom analyzers, processors, and file formats. Bookmarks and annotations: mark code locations with bookmarks, comments, and labels. Visual tools: graph views, decompiler view, hex view, and structured data viewer. Java/C++. Apache-2.0.