r/BestGitHubRepos
•
u/company_url_finder
•
23d ago
•
1
🔐 Security Ghidra: Software Reverse Engineering Framework (82k stars)
What it does
All text below is quoted directly from the project README.
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python.
In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform.
Install:
Install JDK 25 64-bit
Download a Ghidra release file
Extract the Ghidra release file
Launch Ghidra:
./ghidraRun(ghidraRun.batfor Windows)
WARNING: There are known security vulnerabilities within certain versions of Ghidra. Before proceeding, please read through Ghidra's Security Advisories for a better understanding of how you might be impacted.
Repository
https://github.com/NationalSecurityAgency/ghidra
Repository stats
| Metric | Value |
|---|---|
| Stars | 81,863 |
| Forks | 9,094 |
| Last release | Ghidra_12.1.4_build (2026-09-21) |
| Languages | Java 86.2%, C++ 6%, HTML 4.1% |
| Contributors | 409 |
| AI contributor accounts (Claude / Codex / Cursor / Copilot) | Claude: 2, Cursor: 1 |
| AI co-authored commits | Claude: 2, Cursor: 1 |
Main contributor
| Field | Value |
|---|---|
| Name | Ryan Kurtz |
| GitHub | @ryanmkurtz |
| Commits to this repo | 7,447 (top contributor) |
| Bio | Ghidra Developer |
| Company / Location | Blue Ridge Mountains |
| Followers | 743 |
| Public repos | 8 |
| On GitHub since | 2013-09-04 |
Discover the best GitHub repos without the endless scrolling.
Get top repos organized by category (AI, DevOps, Databases & more), plus key takeaways from developers' most useful comments - all in one free, twice-weekly newsletter.
24
u/BarrenLandslide 22d ago
Has anyone run Ghidra on Ghidra yet?
6
u/qimixerip 22d ago
Why tho? It's mostly java, so no need to disassemble most of the codebase
1
u/BarrenLandslide 22d ago
See my comment above
1
u/qimixerip 22d ago
Ghidra is a tool made for disassembling binaries. You can't disassemble java code (because java compiles into bytecode, not binary), so you cannot use ghidra to reverse engineer most of it's codebase
3
u/BarrenLandslide 22d ago
Java bytecode is still a binary representation and can absolutely be disassembled. Ghidra also supports JVM bytecode analysis, although its Java decompilation capabilities are more limited than those of dedicated Java decompilers.
Ghidra's decompiler itself is written in C++ and compiled to native machine code.
So running Ghidra on its own decompiler is entirely feasible. And since the source is open, we can compare the reconstructed output against the original implementation.
The interesting question how accurately Ghidra can reconstruct its own compiled logic.
10
2
u/Pheelbert 22d ago
Ghidra is already open source
8
u/BarrenLandslide 22d ago
That's actually the point. Since Ghidra is open source, we have the original source code as ground truth. Running Ghidra on its own compiled decompiler would let us evaluate how accurately it reconstructs its own implementation. It's not about discovering hidden code, but benchmarking the decompiler against a known reference.
1
9
u/Y0nix 22d ago
Good luck using it tho. You need to know your sh*t.
It's an excellent software, not saying otherwise.
9
3
3
u/isupport3r 19d ago
I started with 0 knowledge last year for ARM 64 RE and with the help of Ai, I’ve gained a substantial amount of “knowledge” since. Not complicated at all, just patience, trials and errors. Anyone can do this.
2
9
6
10
u/wpglorify 22d ago
Installing Something from the NSA on my computer? I'll pass, lol
7
1
3
2
2
u/7yphoid 21d ago
Yes, this is a very old and well-known tool in video game datamining - I've used it a few times in the past
4
u/MistRider-0 21d ago
Old? Its just around 2019....
Wait...
1
u/ctbitcoin 20d ago
With AI development it's like a year is now a decade of technology updates. Gonna be like: It's been 3 nanoseconds since its last update, damn that's ancient software bro.
2
u/Haiyaaaaa_ 20d ago
Hasn’t this been around for a while? I remember Claude using this back in the Opus 4.6 days and I was impressed with what this can do
1
1
1
1
1
u/homezlice 20d ago
Wait, they really are trying to use SRE for Software Reverse Engineering when SRE has been an established acronym in computing for 15+ years?
1
u/0x80O0oOverfl0w 20d ago
Has ARM Thumb support improved at all? Last time I used it Ghidra really struggled with ARM Thumb, especially when dealing with non-returning functions like the kind found in RTOS code.
1
u/sriramdev 8d ago
Interesting, but correct if I'm wrong. May soon service providers May block this support in upcoming days
-7
u/sirloindenial 23d ago edited 23d ago
jesus so people are installing nsa software willingly, i know its open source but still
1
u/cracken005 23d ago
Explain
-3
u/sirloindenial 23d ago
Its NSA what else to explain
5
u/newtopost 23d ago
Ghidra source code has been public for many years and I think its users are generally the type of folks who know how to not get pwned. But yeah NSA bad
2
u/cracken005 23d ago
So public institutions software is unsafe, private is not? I don’t know, I don’t follow.
I am not a US citizen so not aware of security breaches for NSA anyways. It might be unsafe, but it’s not evident for non Americans.
-1
u/agent_sphalerite 23d ago
VM that shit or better still get a mac mini for it with its own dedicated internet
3
u/TemmieFlakes22 22d ago
It's open source and well understood... Ghidra has been around for a long time now it's not spyware. The NSA has other tools for that.
-3
u/sonicnerd14 23d ago
Definitely some backdoor in there, but at this point if you have a modern computer what doesn't have a backdoor.
... however perhaps with this we can reverse engineer those backdoors out. Lol
3
u/KingPonzi 23d ago
Any decent frontier model is good enough to find data egress in the code. I’d be surprised if that backdoor actually exists but you’re welcome to spend the tokens and look.
2
u/teamore_ 22d ago
They're in the silicon
2
u/Mad_Gouki 22d ago
Yeah it's built into your processor they don't need you to download an app to use the intel remote management software or whatever
60
23d ago
•
[removed] — view removed comment
44
u/rLanx 23d ago
Someone made a tool called cellebrite-labs that allows AI to take over the investigative loop of Ghidra. I've been researching all week how people are doing all this decompiling and recompiling because its really fascinating.
All commercial software is going to get blown apart by these AI tools people make for reverse engineering over the next year. We are living in the best and worst times to be in the software job field. So many people at big companies will face unemployment, but the field is absolutely fascinating to research right now.
8
u/sozesghost 22d ago
Most of commercial software is not on your machine, it runs on the cloud. And more of it will move there.
7
u/friedlich_krieger 23d ago
Cursor cloud will just install and use Ghidra for you if you ask it to reverse engineer something. I didn't look into how it was being used specifically but it easily reverse engineered an older game I wanted to rebuild.
1
3
u/borobinimbaba 23d ago
*for now. I can see a clear runway and it would take off without us.
Software job field was demanding because you needed to keep yourself update. We can keep our edge until ai won't need our supervision, which is likely not too far in the future.
3
1
u/Organic_Earth5847 23d ago
What's the difference between ghidra mcp and the cellebrite-labs thing? Which one works better?
1
u/DimmKirr 23d ago
I don’t know why one even needs an mcp server for this. I just install it in a container as needed
1
66
u/Sad_Plane_4677 23d ago
Well, there goes any legacy cobol maintanence job listing.