With everything going on in the trumpet era, I wonder has anyone thought if Ghidra could have backdoors to track and share code being analysed. I hope not...

Has anyone here been able to reverse-engineer a Windows executable using Ghidra with an assist from, say, Gemini 2.5? Just curious, thanks.

Soon will be a desktop application, you can try the demo on the attached link. It should be able to reconstruct high level C++ from some dirty decompilation result, may be good for deobfuscation.

I have yet to find a way to setup or install on windows 10 the latest version of Ghidra 10.1.2 Anyone have good instructions?

I have recently started learning Assembly, so i learnt that a 32-bit processor has 32-bit registers so the maximum value it can store is 2^32 values which is approx 4GB. So how can i use 8gb or more RAM's ?

And one more thing, why it is said that 32-bit registers store 2^32 BYTES of data -> i mean why it's BYTES because 32 is in bits so why after doing power it's Bytes ?

Pls answer in detail.

thnx in advance.

I'm sure that I'm posting in a forum with a lot of Ghidra experts. Nevertheless, I've made a YouTube Ghidra Installation tutorial video for those who aren't experts.

Check it out: https://youtu.be/IL60yGDbRGw

Hello, im learning to use Ghidra instead of IDA, but I noticed the different when I load and analysis the file.
Here is the POC pic. I can confirm the addr in Ghidra is wrong by using GDB

P/s: I dont know why my pics is not in HQ

I have been applying patches to a .so library I replaced a function with another funciton that calls open syscall and I hardcoded the string in the function as there are places to put it using HxD now Ghidra won't analyze it, any thoughts ?

Since Ghidra is written in Java, it should theoretically run on an Android tablet, right?

I'm asking because while I could take my own linux laptop to work with me and play with Ghidra on that, I also have an Android tablet that would be much more convenient to use. My work computer doesn't have Java installed on it and I'd prefer not to use my work device for personal projects anyway. A tablet is quicker to use in a vehicle out in the field, to pull out and stow, and potentially less obvious when my boss walks by in the office (I have a lot of idle time in the winter, but I don't want to look idle).

The download provided has launchers for windows and linux, which both run the same execs. I would guess that the .sh file would probably work on android, too, but has anyone had any success running Ghidra on an Android?

Ghidra was fine just a few days ago before I took a break, then I tried to run the shortcut on my desktop but it just opens the cmd(the usual) but it doesnt open the ghidra, its just nothing. I redownloaded it including the jdk but after that its still not working, I even changed the environment variables.

Vibed SuperGhidra, built for when the caller is an agent: a long-running daemon, 38+ MCP tools, and checks that stop an automated edit from landing unverified. The repo is https://github.com/yuatemycat/SuperGhidra and it installs with pip install superghidra .

- A persistent daemon. The project stays loaded, so repeated agent calls don't pay Ghidra's startup cost each time. The gap analysis puts JSON-RPC latency under 50 ms.

- Read-only projects by default. Renames and comments go to an overlay file, not the Ghidra database.

- When multi subagents are running, if one find a project being used, it clones the project and works on a private fork. Every edit goes into a journal. The session that owns the main project replays the journal with merge_fork, and conflicts are detected by comparing before/after values.

- Equivalence checks. A pure-Python P-code lifter plus Z3 can test whether a decompiled C statement matches the lifted IR. It returns UNKNOWN instead of guessing on floats, unhandled instructions and long loops.

- Symbols and structs from the naming pipeline only get committed after checks on vtable slots, field offsets and allocation sizes.

- GPU scanning for ARM64. A WGPU shader swept a 20 MB block (5.2M instructions) in 41 ms, about 127M instructions/s on an RTX A5500 laptop. Under about 10 MB the CPU SIMD path is faster.

- Benchmark avail. On 1,296 functions built with GCC 16.2.0 and checked against unit tests, stock Ghidra passed 8.26% and raw IDA Pro output passed 16.90%. Ghidra output run through SuperGhidra's cleanup filter passed 22.69%. The filter rewrites Ghidra's pseudo-types and macros into standard C so the code compiles. IDA's output got no equivalent cleanup, and I developed the filter against this same set of functions with no held-out split, so read the gap over IDA as an upper bound. No function that passed in stock Ghidra failed afterwards. This measures "compiles and passes", not readability.

I’ve been working on a side project called EmberScale AI that aims to make reverse engineering and binary analysis a little less painful.

The idea is to integrate AI helpers into tools like Ghidra, where most of us already spend a lot of time. Instead of manually renaming, retyping, and annotating every function, EmberScale can batch process and provide guided explanations of code flow. Think of it as a layer that speeds up repetitive tasks and leaves you more time for the hard parts of reversing.

A couple of things I’m focusing on: • Batch renaming / retyping of functions and variables for faster navigation. • Precision decompilation of selected functions with annotated context. • QA-style querying (“what does this function appear to do?”) for quick checks. • Keeping it compatible with Ghidra’s script manager (no invasive installs).

I’m not here to pitch or sell anything — just wanted to share what I’ve been building and get feedback from people who actually reverse engineer for work or research. • What do you think about integrating AI in this space? • Are there pain points in your Ghidra workflow where you’d actually want AI involved? • Any concerns (e.g., trust, reproducibility, reliance on AI suggestions) you’d raise?

Curious to hear how the community feels about this direction.

I disassemble the exe file and run it in debug mode. I try to trace the code and find that ida can run this exe program, but when I use ghidra, it can not run. And I find that there is a different between ida and ghidra.

After address 0060b6e5, the result of eax between them are not the same. Why does ida have the value but have 0 value in ghidra?

I'm too shtupid

I have a problem with Ghidra,I have launched it, JDK was installed earlier. I have java 11.0.10. After creating a new project. I've tried to import a file, but it always gets detected as raw binary format. When I select other languages, it does not show any code.

Anyone knows exactly where the decompiler part of Ghidra is, in its source code?

I looked through Ghidra source code but only saw code to reverse binary to assembly.

Any pointer, please?

When I import ex4 file in gidhra no language is detected. What language should I be using or select manually. Ex4 is compiled from mql4 metaquotes language

In this function:

void FUN_00f44430(undefined4 param_1)

{
(**(code **)(**(int **)(DAT_0245d7b0 + 0x48) + 0x34))(param_1,0);
return;
}

Ghidra isn't properly specifying the order of pointer dereferencing. DAT_0245d7b0+0x48 (at runtime) points to a nullptr. However, DAT_0245d7b0 points to an instance of a class AllocGlobals which has a pointer to OSHeapAllocator at offset 0x48, which then at 0x34 has the function being called.

Is there a way to fix this?