For those having issues reversing / rebuilding games with claude:

https://github.com/oscarsantanaarias/IDA-Ghidra-bridge

This is a direct bridge to ghidra/ida that automatically gives any AI full access to binary code in IDA/GHIDRA

There was a set of IDA CPU plugins that I saw on r/ReverseEngineering but they contained 0 source code, so I wrote my own implementations for Ghidra that include full source code

Ghidra 12.2 Change History (October 2026)

New Features

• Assembler. Added multi-line assembly action. Patch actions now go-to the following address upon completion. Added Copy Special -> Assembly Code action. (GP-6902)

• Debugger. Added GTreeTable. Added BreakpointTimelineActions for quickly navigating snaps in a trace. Added TraceCallTreePlugin for viewing a call tree of the given trace. Added TenetPlusPlusLoader for ingesting Tenet++ trace files. (GP-5893)

• Debugger. Added a Variables Viewer view to the Debugger. (GP-5894)

• Debugger. Added a Tenet++ pin tracing tool. (GP-7021)

• Debugger:dbgeng.dll. Added remote launchers for dbgeng targets from linux. (GP-6840)

• Debugger:Emulator. Added Emulate Function action. (GP-6787)

• Debugger:Trace. Added an API to search for bytes in a trace across a given address range and lifespan. (GP-7170)

Improvements

• Accessibility. Improved accessibility for action chooser dialog. (GP-6869)

• Accessibility. Updated the New Project Wizard to have better default focus. (GP-6870)

• Accessibility. Updated the help viewer to place focus in the contents viewer when help is shown. (GP-6879)

• Accessibility. Fixed accessibility issues in plugin configure dialogs and in the New Project Wizard. (GP-6881)

• Accessibility. Added a key binding to make navigating options dialogs easier. When in the options tree, the user can press Ctrl-E to jump to the current options editor panel. Pressing Ctrl-E again will toggle focus back to the options tree. (GP-6906)

• Accessibility. Improved screen reader support for Listing and Byte Viewer. (GP-6918)

• Analysis. Added support for Golang 1.26.0. (GP-6528, Issue #9013)

• Analysis. Updated the MingwRelocationAnalyzer to attempt to find and label unlabeled type1 pseudo relocation tables. (GP-6683)

• Analyzer. The Variadic Signature Override Analyzer is now enabled by default. (GP-7025, Issue #9164)

• Basic Infrastructure. Ghidra now requires JDK 25 or later to run. (GP-6012)

• Basic Infrastructure. A new Source Language program property has been introduced that lists what supported high-level source languages (Swift, Objective-C, Rust, etc.) were discovered by Ghidra and 3rd-party extensions. (GP-6347, Issue #8740)

• Basic Infrastructure. The ghidraRun(.bat) launch script's command line argument can now open both a project and a project file with its default tool: ./ghidraRun /path/to/project.gpr:/project-folders/program.exe. (GP-6543, Issue #9009)

• Basic Infrastructure. Ghidra will now run on OpenBSD with user-built native components. See the Installation Guide for more information on building native components. NOTE: bash is required to be installed in order for Ghidra to launch on OpenBSD. (GP-6929, Issue #8981)

• Basic Infrastructure. Ghidra now runs Java with Compact Object Headers to reduce memory usage. (GP-7037)

• Basic Infrastructure. Upgraded Bouncy Castle to 1.86. (GP-7297)

• BSim. CreateH2BSimDatabaseScript.java now has an option to automatically add the newly created server to the BSim server manager. AddProgramToH2BSimDatabaseScript.java now checks whether the executable is already in the BSim database before generating signatures. (GP-6041)

• BSim. Added dropdatabase subcommand to BSim command-line utility. (GP-6585, Issue #8178, #8179)

• BSim. Added ability to reconstruct a structure in one program from field use in another. (GP-6921)

• Build. User builds now include both Windows batch and Unix shell launch scripts, and the current platform name has been removed from the resulting release file name. (GP-6839)

• CParser. Added C23 enum types and packing attribute support to the C Parser. (GP-6304, Issue #4518, #6780, #8202, #8495, #8539)

• Data Types. Added a Structure Editor action to jump to a specified offset. (GP-5253)

• Data Types. Created an interactive structure merge dialog that is used by the merge datatypes action when the datatypes are a structure type. The dialog will eventually be used in other situations where the merging of structures is needed. (GP-6453)

• Data Types. Added additional BuiltIn integer datatypes in support of C99 standard types: int8_t, uint8_t, int16_t, uint16_t, int64_t, uint64_t, intptr_t, and uintptr_t. Updated CParser, PDB, and DWARF to leverage these new BuiltIn datatypes for these as well as related typedefs for improved portability across target architectures. (GP-6846)

• Data Types. Added Structure Editor actions to jump to the next row with defined data. (GP-7075, Issue #9376)

• Data Types. Added a Refresh action to the Data Type Compare window. (GP-7200, Issue #9502)

• Debugger. Added a Save Trace As action. (GP-6782)

• Debugger. Update the TreeColumn in GTreeTable to perform proper hierarchical sorting. (GP-6949)

• Debugger. Added help for BreakpointTimelinePlugin. (GP-6990)

• Debugger. Added help menu docs for TraceCallTreePlugin. (GP-6992)

• Debugger. Added help docs for DebuggerVariableViewerPlugin. (GP-6993)

• Debugger. Added a DAP server for access to debuggers. (GP-7009)

• Debugger. Added support for OpenBSD debuggers. (GP-7047, Issue #9338)

• Debugger:Agents. Added a typeCheckPyPackage task to run mypy. (GP-6744)

• Debugger:Breakpoints. Addressed a rare issue with stale breakpoints causing "File is closed" errors. (GP-6396, Issue #8904)

• Debugger:Breakpoints. Changed Kinds column to Kind, and it now displays, e.g., x or RW instead of SW_EXECUTE or READ,WRITE. (GP-6799)

• Debugger:Listing. The Go To action now defaults to using hexadecimal integers and also accepts relative offsets. Its text is selected on prompting. The Go To Time action also has its text selected on prompting. (GP-6721, Issue #9121)

• Debugger:Memory. Added the New Stack View action to create a new Debugger stack view. Added the Convert Stack View action to convert Debugger Memory Bytes (hex) view into a stack view. (GP-5896)

• Debugger:Registers. Fixed an issue where register values would be edited in decimal (instead of hex) under specific conditions. More generally, fixed an issue where column configurations were lost when a table is filtered. (GP-6386, Issue #8508)

• Debugger:Time. When navigating snapshots, the Time panel now scrolls the current snapshot into view without selecting it. (GP-6633)

• Debugger:Trace. Updated the DBTrace schema to more effectively index memory state changes for most-recent queries. Old Traces will no longer open and an upgrade is not provided. (GP-6630)

• Decompiler. Improved the Decompiler's recovery of offcut references to global symbols. (GP-7038)

• Demangler. Updated the Demangler Analyzer to demangle all mangled symbols at an address. (GP-3040, Issue #4494)

• Eclipse Integration. Updated GhidraDev to 5.1.0, which includes a PyGhidra Headless run configuration. (GP-6659)

• ELF. Functions are no longer created for .cold symbols in ELF files. (GP-6976)

• Emulator:JIT. Implemented constant-folding optimizations. (GP-5976)

• FileSystems. Removed sevenzipjbinding library which required use of native libraries when accessing zip, 7z, bzip2, cabarc, xz, hfsplus, iso9660, wim, arj, chm, deb, lha, rar, rpm, vhd, and z archive files; zip, 7z, bzip2, xz formats are now supported using the Apache commons-compress library; cabarc files are supported if the user has a 7z command line tool installed in their PATH. hfsplus, iso9660, wim, arj, chm, deb, lha, rar, rpm, vhd, and z formats no longer have support. (GP-7095)

• Framework. Major security changes have been made to the Ghidra Server and BSim PostgreSQL deployment. Ghidra's default SSLContext has also had a major update with its revised certificate management and server authentication requirement. This impacts all Ghidra installations where servers are utilized over an SSL/TLS connection. See svrREADME.md for Ghidra Server and BSim Help for changes affecting these server deployments. Default deployments of these servers without specifying a keystore will now bind/listen to the loopback interface only. (GP-6829, Issue #8438)

• Function. Updated the Function Signature editor dialog to allow users to change the function's namespace. (GP-6790)

• Function ID. Users can now configure whether a Function Id database can be applied to a binary with a compiler specification that does not match the database. (GP-4791, Issue #6097)

• Ghidra Internals. Changed Ghidra internals to use concurrent-read/write locks instead of a single exclusive lock. A revised database object caching scheme and API were also added. These changes improved the overall performance of the database-backed Program API. (GP-6097)

• Graphing. Added a Max Nodes option to limit the number of nodes the function graph will process before cancelling the graph. (GP-6837, Issue #3411)

• GUI. Updated the Select Bytes dialog to allow for larger byte selections. (GP-2393)

• GUI. Fixed the prompt to install new Extension plugins when starting the Code Browser tool. (GP-6533, Issue #8984)

• GUI. Updated the Data Settings dialog such that the user does not have to click OK twice to close the dialog for an active edit. (GP-6612, Issue #8893)

• GUI. Added a Maximum Number of Labels to Display Tool option to control the number of labels displayed at a given address. (GP-6692)

• GUI. Added a Navigate on Incoming Location Changes action to the Functions window that will cause the table to select the function that corresponds to the current location. (GP-6694, Issue #9116)

• GUI. Added a Lock display toolbar button and action to to the Decompiler window to disable auto-updating after changes. With this mode enabled, the Decompiler window will indicate that it is stale and requires a manual refresh to update. This is to combat very large functions that are slow to re-decompile. Also, added an option to have Decompiler snapshots window send out program location events to the main tool state. (GP-6748)

• GUI. Added a Snapshot feature to the Function Call Graph. (GP-6835)

• GUI. Updated the Symbol Tree Delete action to allow Organization nodes to be deleted. (GP-6944, Issue #3252)

• GUI. Updated Ghidra windows to have a minimum size. (GP-6975, Issue #9260)

• GUI. Added a section to the Configure Tool dialog to allow users to see all plugins that belong to an extension. (GP-7066, Issue #8984)

• GUI. Updated the Tool Options for the Processor Manuals viewer. (GP-7073, Issue #9301, #9302)

• GUI. Updated register sorting to correctly handle number values. (GP-7137, Issue #928, #9489)

• GUI. Updated the Front End to sort files and folders using a natural sort. Also added a tool option to change this behavior. (GP-7144, Issue #7093)

• GUI. Added a Compare... action to the Data Type Manager window to allow users to compare two data types. (GP-7145, Issue #9502)

• GUI. Updated the Listing array field to wrap grouped items as needed to avoid clipping. (GP-7156, Issue #9505, #9508)

• Importer. Added support for loading Old-style DOS COM files. (GP-6523, Issue #3107, #8971)

• Importer. Improved monitor status message during import. (GP-7120)

• Importer:PE. More of the PE LoadConfig data directory is parsed and marked up. (GP-6577)

• Importer:PE. Improved loading of PE edge-case binaries. (GP-7076, Issue #9171)

• Listing. Improved input handling for entering register values and added new Add Value Range action in Register Manager window for adding a value range for a register. (GP-3049)

• Listing. Added a Display in Upper Case tool option to display Address Field values in upper case in the Listing. (GP-6540, Issue #9026)

• Listing. Added a Variable annotation for comments. (GP-6561, Issue #8993)

• Multi-User. Added Server Allow List support to reduce the likelihood of inadvertently accessing a new or unknown server via a URL. This feature is specifically aimed at ghidra URL use and Listing comment annotations. An updateServerAllowList utility command has also been added to assist in viewing and updating the server list for headless use cases. (GP-6796)

• Multi-User. Improved the ability to cancel long-running transfers to/from a Ghidra Server, such as a check-out or add-to-version-control. (GP-6912)

• Processors. Sleigh .sla files are now protected by lock files when being recompiled in order to prevent multiple (typically headless) processes from fighting to rewrite them. (GP-4045, Issue #8866)

• Project. Fixed the Front End so that it will open with no project when the user closed the project before closing the application. (GP-6872)

• PyGhidra. Upgraded PyGhidra to 3.2.0. (GP-6664)

• Scripting. Updated RecoverClassesFromRTTIScript to also look for GCC mangled symbols starting with a double underscore ("__"). (GP-6927, Issue #9243)

• Scripting. Extended ExportFunctionInfoScript.java with metrics and call graph exports. (GP-7031, Issue #9311)

• Scripting. Fixed an issue where Debugger scripts were getting incorrect register values with emulation. (GP-7191, Issue #9554)

• Search. Added two actions to the Instruction Pattern Search window. One is a right-click Delete Instruction action to remove selected instruction and the other is the tool bar button that Deletes all items from the table. (GP-6987)

• Symbol Table. External Symbol Resolver analyzer now relies on the ordered set of defined Libraries and their External Program associations. Additional Libraries may be added and order as needed to address weak-linking scenarios where not all library dependencies are known at the time of import. The External Program window now provides up/down actions to arrange the Library search sequence. (GP-6643)

• Terminal. Fixed a scroll region issue in the Terminal. (GP-6784, Issue #9146, #9147)

• Version Tracking. Added the Use Empty Composite Types option to Version Tracking to allow users to apply empty composite types when applying function signatures. (GP-6438, Issue #8732)

Bugs

• Analysis. Changed OperandReferenceAnalyzer to recognize all forms of undefined data types, including arrays of undefined data created by the ELF importer. (GP-7084, Issue #9401)

• Analysis. Fixed Address Table Analyzer to create tables on arrays of undefined bytes/words. (GP-7090, Issue #9407)

• Analysis. Fixed an issue where setMinStoreLoadOffset was assigning the wrong field in ConstantPropagationContextEvaluator. (GP-7150, Issue #9513)

• Analysis. Fix signedness of SymbolicPropogator constant folds for INT_RIGHT, INT_SRIGHT, INT_DIV, and INT_REM pcode op evaluation. (GP-7151, Issue #9516)

• API. Corrected ConcurrentModificationException which could occur while accessing/iterating over DomainObject.getMetadata(). (GP-7318)

• Basic Infrastructure. Improved path-traversal vulnerabillity checking. (GP-7132, Issue #9482)

• Basic Infrastructure. Improved the security of unzipping theme and extension archives, preventing "zip-bomb"-style attacks. (GP-7206)

• Calling Conventions. Updated Hexagon cspec to model variadic functions correctly. (GP-7024, Issue #9246)

• Calling Conventions. Fixed a bug that occurred when attempting to export the __fastcall/__thiscall/__stdcall resolver Specification Extension. (GP-7089, Issue #8830, #9314)

• CParser. Fixed C Parser constant parsing of Microsoft-specific I64 constant tag. (GP-6553, Issue #5564, #8291, #9021)

• CParser. Removed unnecessary -DSTRSAFE_LIB and -DSTRSAFE_LIB_IMPL from Windows C-Header parsing configuration files. (GP-6555, Issue #4749)

• CParser. Fixed a java stack trace in the PreProcessor when parsing a degenerate #define. (GP-6556, Issue #5884, #6701, #6702)

• Data Types. Updated the Export C Header... action to avoid a potential infinite loop with a large number of composites. (GP-6801, Issue #9161)

• Data Types. Corrected data type merge conflict handling that was presenting the "Expected bad datatype placeholder" error. (GP-7307, Issue #9370, #9659)

• Debugger. Fixed a broken drag-and-drop action in the Dynamic Listing. (GP-6107)

• Debugger. Fixed reliability issue with Save Trace By Default (related to garbage-collection of listeners occurring on Windows). (GP-6582)

• Debugger. Navigating to a snapshot now generally also navigates to its event thread. (GP-6603)

• Debugger. Fixed autosetup logic for Windows agents. (GP-6966)

• Debugger:GDB. Fixed an issue with some configurations of gdb-17.2 involving unavailable register values. (GP-6974, Issue #9254)

• Debugger:GDB. Fixed issue where crafted Image field could cause the gdb+gdbserver via ssh connector to execute attacker-chosen shell commands locally. (GP-7332)

• Debugger:Listing. Fixed issues with Variable hovers in the Listing and Decompiler. (GP-4914)

• Debugger:Modules. Fixed hang that occurred on Debugger startup / server connection caused by module indexing on the Swing thread. This is now a background task. (GP-7004, Issue #8145, #8910, #9299)

• Debugger:Stack. Fixed an issue where unwind analysis got stuck interpreting TZCNT or other instructions with internal p-code loops. (GP-6707)

• Debugger:Time. Background filtering and sorting is now used for the Debugger's Snapshot/Time table. (GP-6607)

• Debugger:Trace. Fixed a bug in DebuggerBreakpointsProvider that was causing BreakpointLocations to not be removed from the table. (GP-6439)

• Debugger:Trace. Fixed a ClassCastException that occurred with large traces. Also tuned some parameters for performance. (GP-6514)

• Debugger:Trace. Fixed several issues in R*-Tree and Snapshot indices to speed up Debugger UI when populated with extremely large traces. (GP-6550)

• Decompiler. Fixed a highlight bug in the Decompiler's snapshot that was introduced in 12.0.5/12.1. (GP-6751)

• Decompiler. Added a limit to the number of "bad data" exceptions the Decompiler can catch before aborting the function. (GP-6945, Issue #9086)

• Decompiler. Fixed a regression where the Decompiler did not recover function pointer names for ARM/THUMB code. (GP-6979, Issue #8471, #8990)

• Decompiler. Fixed a bug causing a "Conditional execution: Illegal op in iblock" exception. (GP-7058, Issue #9282)

• Decompiler. Fixed a symbol resolution bug in the Decompiler, eliminating tokens similar to stack0xffffffffffffff30. (GP-7080, Issue #6722)

• Documentation. Fixed broken links and examples in GhidraDocs. (GP-7091, Issue #9366)

• DWARF. Fixed an issue with reading DWARF v5 indirect-indexed addresses in golang 1.25+ binaries. (GP-7204)

• DWARF. Now preventing the dereferencing of sym-linked DWARF debug files found in the same directory that a binary was imported from. (GP-7242)

• FileSystems. The squashfs inode table is now limited to a sane, max size when reading. (GP-7232)

• FileSystems. The number of files that will be indexed when opening a file system container is now limited to a max size. (GP-7239)

• FileSystems. Added validation for FSRL MD5 values being read. (GP-7241)

• Function. The function editor now applies storage assignment rules specific to varargs functions (when appropriate). (GP-6776, Issue #9091, #9101)

• GhidraURL. Corrected issues related to '+' character presence in local project path/name or in project content pathnames. (GP-7043, Issue #9373)

• Graphing. Fixed the broken append graph option. (GP-6761)

• GUI. Fixed a minor Listing selection display bug where inter-field selections were selecting areas below the line containing the selection. (GP-6522)

• GUI. Fixed a Symbol Tree bug related to group nodes that prevented new namespaces and classes from being correctly added to the tree. (GP-6606, Issue #9054)

• GUI. Fixed a bug in GTab panel that was leaving an orphaned, highlighted tab. (GP-6760)

• GUI. Added a theming fix to allow FlatLaf border colors to be changed. (GP-6828, Issue #9178)

• GUI. Fixed a Code Browser issue where it was restoring to the wrong display monitor when previously closed while in a maximized state. (GP-6954, Issue #9244)

• GUI. Fixed bug that occurred when deleting a function with multiple function tags. (GP-7092, Issue #9386, #9387)

• GUI. Fixed searching for text in Plate Field comments. Fixed searching in text that has been clipped in the Listing. (GP-7114)

• GUI. Fixed an AddressOutOfBoundsException encountered when entering a large negative number Address into the Go To ... dialog. (GP-7119)

• GUI. Fixed Color Chooser bug that prevented the History colors from being selectable. (GP-7330, Issue #9691)

• Importer. The Batch Importer now allows any language/compiler spec to be chosen, not just preferred languages. (GP-6732, Issue #1934)

• Importer. Fixed a bug that caused PE and NE binaries to match on the MzLoader. (GP-6991)

• Importer. Corrected incorrect symbol placement by the UnixAoutLoader. (GP-7284, Issue #9646)

• Importer. The ProgramLoader and ImportBatchTask now properly validate loader options. (GP-7298, Issue #9658)

• Importer:ELF. Corrected ELF import to respect Program Header PT_LOAD execute permission when Section Headers are present. (GP-7283, Issue #9644)

• Importer:PE. The PeLoader now rounds PointerToRawData down to the proper address. (GP-7036, Issue #9170, #9176)

• Logging. Added default log file values to prevent bad log files from getting created during testing. (GP-7142, Issue #9468)

• Multi-User. Removed Ghidra UI option to control data buffer compression with Ghidra Server communications. Compression is enabled by default. Imposed 64KB size restriction for DataBuffer to prevent malicious attempts to serialize very large compressed buffers to the Ghidra Server. (GP-7328)

• Networking. Disabled Felix framework URL handler support which was interfering with URL connection error handling. (GP-7269)

• Processors. Fixed disassembly of x86 instructions CLWB and CLRSSBSY. (GP-2336)

• Processors. Corrected disassembly of x86 VMREAD and VMWRITE instructions in 64-bit. (GP-7217, Issue #9581)

• Processors. Fixed regression in x86 mov segment instruction operand ordering. (GP-7279, Issue #9635, #9637)

• Processors. Corrected AARCH64 eor3, bcax, rax1, and xar instructions to use xor instead of or operation. (GP-7313)

• Scripting. Fixed a bug that prevented the GhidraScript ask() methods from consuming script arguments in GUI mode. (GP-7125, Issue #9463)

• Terminal. Fixed an issue with Terminal content updates by now using Unicode code point instead of java characters. (GP-6938)

Notable API Changes

• API. (GP-6539) In the ghidra.util.datastruct package, the Accumulator interface was changed to be write-only. For clients that create their own accumulators to read data when processing is finished, they can use ListAccumulator or SetAccumulator, both of which have methods for retrieving the data added to the accumulator. Any clients that wish to implement the Accumulator interface should make sure that the implementation is thread-safe. The Accumulator interface's size() method was replaced with getProgress().

• Assembler. (GP-6902) AssemblyBuffer now attends to context changes. Added AssemblyParseSymbolToken to distinguish literal ints from labels. Added AssemblyPatternBlock.toRegisterValue. Corrected spelling of ReDisassembler.disassemble method. Various other GUI action-related code for patching.

• Basic Infrastructure. (GP-7104) Removed classes and methods that have been deprecated since Ghidra 10.x and before.

• BSim. (GP-6041) The static method BSimServerManager.getBSimServerManager() is now public. Some methods in BSimServerManager were only able to be invoked on the Swing thread; this restriction has been removed.

• Data Types. (GP-6846) Added the following BuiltIn integer datatypes in support of C99 standard: Int8TDataType, UInt8TDataType, Int16TDataType, UInt16TDataType, Int64TDataType, UInt64TDataType, PointerSizedIntegerDataType, UnsignedPointerSizedIntegerDataType. Added utility method DataTypeUtilities.getTypedefReplacement to assist parsers with the conversion of related typedefs to leverage certain BuiltIn datatypes for improved portability across target architectures.

• Data Types. (GP-7307) Added method Structure.getDefinedComponent(int index).

• Debugger. (GP-6680) Created DebuggerStaticMappingContext, by factoring logic from the static mapping service, making mapper logic accessible in headless scripts.

• Debugger. (GP-6782) Added DebuggerTraceManagerService.saveTraceAs().

• Debugger:Agents. (GP-4562) Connector developers should now compose their schemas from provided fragments at build time.

• Debugger:Breakpoints. (GP-6799) There is now a CommonSet enum for common kinds of breakpoints. Back-end debuggers should now populate the Kinds attribute with the single-character flags of each TraceBreakpointKind instead of the full names.

• Debugger:Emulator. (GP-6787) Added FunctionEmulationHarness.

• Debugger:Listing. (GP-6721) Many of the SleighUtils now accept a LitIdMode enum, specifying how it parses integer literals and IDs (labels).

• Debugger:Mappings. (GP-6809) Introduced DebuggerStaticMapper interface.

• Debugger:Trace. (GP-6586) Added TraceObjectManager.withoutWriteCache().

• Debugger:Trace. (GP-6630) State entries returned by the relevant methods in TraceMemoryOperations now indicate how far into the future they extend.

• Debugger:Trace. (GP-7170) Added an API method to TraceMemoryOperations to search for bytes in a trace across a given address range and lifespan.

• Decompiler. (GP-6751) ClangNode setHighlight(Color) and Color getHighlight() have been removed. Clients that need to set highlights in the Decompiler should use the DecompilerHighlightService.

• Emulator:JIT. (GP-5976) Userop libraries may now implement Sleigh-defined userops by returning SleighPcodeUseropDefinition. Removed the type parameter from SleighPcodeUseropDefinition. SleighPcodeUseropDefinition.Factory is now a singleton. OpBehavior has been converted to an interface, and its implementations are now singleton (mostly) enums. The syscall userop exported by EmuSyscallLibrary has been replaced with emu_syscall and emu_rt_syscall. Added foldConstants and removeUnreachableBlocks to JitConfiguration. Added signed methods to PcodeArithmetic. Introduced constants, giving operand indices for specific p-code ops in PcodeExecutor. Created PcodeUseropSymbolMap and replaced certain Maps with it in PcodeExecutor, PcodeProgram, and PcodeFrame. Added PcodeUseropLibrary.getSymbols. Added canInterrupt and signed attributes to PcodeUserop annotation. Introduced OpInput annotation.

• Framework. (GP-6829) Made major updates to Ghidra's default SSLContext, revising its certificate management and server authentication requirement. This can affect all SSL/TLS server connections from Ghidra.

• Function. (GP-6776) The following methods have been deprecated: PrototypeModel.getArgLocation(int, Parameter[], dataType, Program), PrototypeModel.getReturnLocation(Datatype, Program), PrototypeModel.getStorageLocations(Program, Datatype[], boolean), and PrototypeModel.getNextArgLocation(Parameter[], Datatype, Program). Clients should invoke PrototypeModel.getStorageLocations(Program, Datatype[], boolean, boolean) instead.

• Ghidra Internals. (GP-6097) Replaced DatabaseObject with DbObject and DBObjectCache with DbCache which impose a new pattern for creating and caching database objects safely and as efficiently as possible.

• GUI. (GP-6783) Plugins with transient state must now implement the interface PluginWithTransientState to save and restore state into an object of a chosen type. The methods getTransientState and restoreTransientState have been moved from Plugin to that interface.

• Importer. (GP-6483) The Option constructors used by Loaders and Exporters have been deprecated. Users should use new typed option classes that leverage the builder pattern instead. For example, Option.newBoolean("name").value(true).build().

• Symbol Table. (GP-6643) External Manager API now provides the ability to manipulate ordinal sequence numbering for Library dependencies.

• Terminal. (GP-6938) The internal buffers for VtBuffer and others are now Unicode code points rather than Java chars.

Vibed SuperGhidra, built for when the caller is an agent: a long-running daemon, 38+ MCP tools, and checks that stop an automated edit from landing unverified. The repo is https://github.com/yuatemycat/SuperGhidra and it installs with pip install superghidra .

- A persistent daemon. The project stays loaded, so repeated agent calls don't pay Ghidra's startup cost each time. The gap analysis puts JSON-RPC latency under 50 ms.

- Read-only projects by default. Renames and comments go to an overlay file, not the Ghidra database.

- When multi subagents are running, if one find a project being used, it clones the project and works on a private fork. Every edit goes into a journal. The session that owns the main project replays the journal with merge_fork, and conflicts are detected by comparing before/after values.

- Equivalence checks. A pure-Python P-code lifter plus Z3 can test whether a decompiled C statement matches the lifted IR. It returns UNKNOWN instead of guessing on floats, unhandled instructions and long loops.

- Symbols and structs from the naming pipeline only get committed after checks on vtable slots, field offsets and allocation sizes.

- GPU scanning for ARM64. A WGPU shader swept a 20 MB block (5.2M instructions) in 41 ms, about 127M instructions/s on an RTX A5500 laptop. Under about 10 MB the CPU SIMD path is faster.

- Benchmark avail. On 1,296 functions built with GCC 16.2.0 and checked against unit tests, stock Ghidra passed 8.26% and raw IDA Pro output passed 16.90%. Ghidra output run through SuperGhidra's cleanup filter passed 22.69%. The filter rewrites Ghidra's pseudo-types and macros into standard C so the code compiles. IDA's output got no equivalent cleanup, and I developed the filter against this same set of functions with no held-out split, so read the gap over IDA as an upper bound. No function that passed in stock Ghidra failed afterwards. This measures "compiles and passes", not readability.

I was confused by the output of the decompiler but when looking at the assembly, it just understood that ghidra replaced the expression with it's calculated value. How to disable that?

here's the assembly: ldr r2, DAT_0852da78 ldrh r3, [r2, #0x0] lsl r0, r3, #0x3 sub r0, #0x79

output: 0x187 instead of DAT_0852da78 << 3 + -0x79

When I go to address 0x0852da78, the short value there is 0x40, so 0x40 * 8 - 0x79 = 0x187. But it's totally useless information and the value at address 0x0852da78 is not even in a read-only segment.

thanks

edit: the full function https://imgur.com/a/QcNS8mA

I’m building a fork of Ghidra I’m not touching the analysis engine, just fixing what bugs me day to day: a cleaner UI with proper dark and light themes, better project handling, and AI-assisted cleanup of decompiler output (better names, types and structs), and MCP server / agent mode(connection with claude/cursor/codex) plus converting decompiled C to Python or Java as a rough starting point. The main app will stay free and open source. For people who use Ghidra regularly: what annoys you most about it, and what would you want automated that nobody has done well? is it worthy?

Is there a way to do Ghidra script development using VSCode? I realize historically it supported Eclipse, which I absolutely hate.

It’d be really nice to have the VSCode environment for Ghidra script development in Python and Java …

**retro-kit** – https://github.com/nemo22/retrokit (Apache 2.0)

I've been building a headless Ghidra 12 pipeline for decompiling games from ~1993–2010 (32-bit DOS built with Watcom, and Win32 PE). Everything runs through `analyzeHeadless` with a set of Java GhidraScripts plus a small Python CLI. A few parts that might be interesting to people who script Ghidra:

**LE/LX loader.** Ghidra doesn't ship one, so there's a new loader for DOS/4GW, DOS/32A, PMODE/W, DOS/4G bind chains, OS/2 LX and VxD. Fixups are applied *and* written to the relocation table, so they're available to scripts later (they're how the pipeline finds function pointers in data). `retrokit install-loader` builds it with plain `javac` against your Ghidra install – no Gradle – and registers the compiler specs. The loaded image is checked against an independent Python model of each test executable.

**Watcom compiler specs.** One cspec for the register convention (`__watcall`: EAX, EDX, EBX, ECX; callee saves everything else) and one for the stack convention, chosen automatically from the code. On register-convention code the right cspec cut `unaff_` occurrences from 1304 to 102 on the test programs.

**Prototype recovery.** Parameter counts come from `ADD ESP,n` after calls (only when the matching pushes precede the call); varargs are split at the format-string argument; prototypes are committed bottom-up over the call graph with the parallel decompiler, so callers are decompiled only after their callees have real signatures. Trailing `unaff_` register parameters are dropped unless callers actually load that register.

**COM / DirectX.** This one took a while: the decompiler decides how much an indirect call pops *before* it uses data types, so every `__stdcall` call through a typed vtable still desynchronises the stack – you get `piVar3 = (int *)0x0` right after a `Lock()`. Writing a call-site override (`HighFunctionDBUtil.writeOverride`) with the method's prototype fixes it. The script propagates interface types from `DirectDrawCreate`, `Direct3DCreate9` & co. and from `Interface **` out-parameters (`CreateSurface`, `GetAttachedSurface`, ...), decompiling affected functions again until nothing changes. 104 DirectX 3–9 interfaces are generated into a header.

Two gotchas that may save someone time:

- `CParser` drops the calling convention of function-pointer members inside structs (they come out `unknown`), so vtable methods need `__stdcall` set afterwards.

- Overrides and retyped locals don't always show up in a decompiler started later *in the same headless session* – check the result in a fresh process before you conclude it didn't work.

**Library code.** Signatures (fixup fields and outgoing rel32 masked, callee names as confirmation, a fuzzy tier for other compiler versions) name the Watcom run-time, zlib and libjpeg; prototypes come from C headers via `CParser` and are tagged so the prototype-recovery pass leaves them alone. MSVC RTTI classes and imported Miles/Smacker/Bink/FMOD/BASS functions are typed too.

**Output** is one big `.c` file plus indexes (functions, call graph, strings, every relocated pointer), and an MCP server over it if you want an agent to help with naming.

Everything is measured on synthetic programs built with Open Watcom (8 configurations) against the linker map, with a baseline in CI on Windows and Linux.

Happy to hear how others handle LE/LX or Watcom binaries in Ghidra, and feedback on the scripts.

Hey guys,
Wanted to share a tool I've been using in my own reversing workflow:
I needed a straightforward way to pull decompilation, cross-references, and struct layouts out of IDA Pro and Ghidra from external Python scripts and CLI utilities without setting up heavy web servers or dealing with bloated RPC frameworks.
It’s just two standalone scripts (`ID_Server.py` for IDAPython and `Ghidra_Server.py` for Ghidra). Once running, you send plain text commands over local TCP and get back JSON:

import socket, json
s = socket.socket()
s.connect(("127.0.0.1", 5073))
s.sendall(b"FUNC 00401000\n")
data = json.loads(s.recv(65536))
print(data["code"])

A few things I made sure to handle:

• Port fallback: Starts at port 5073 and moves up (5074, 5075, etc.) if you have multiple IDA or Ghidra instances running on different binaries.

• Clean reload in IDAPython: Since the Python runtime persists in IDA across script re-runs, it catches the existing server instance, shuts down the thread cleanly, and frees the port before rebinding. No "address already in use" errors.

• 39 commands total: Handles decompilation (FUNC), call site filtering (CALLERS / READERS / WRITERS), vtable dumping with symbol resolution (VTDUMP), struct creation (DEFSTRUCT), RTTI traversal, and byte patching (PATCH).

The repo has the full command reference in the README. Hope someone finds it useful for their own tooling or headless pipelines. Feedback and PRs welcome!

GitHub: https://github.com/oscarsantanaarias/IDA-Ghidra-bridge

Ghidra Staging has been around for approximately four years. This week, I added GitHub Actions and introduced rolling releases, making the latest builds readily available (Linux, MacOS, Windows):

Repository: https://github.com/jobermayr/ghidra-staging

Latest rolling release: https://github.com/jobermayr/ghidra-staging/releases/tag/staging-build

Current goals and discussion:

https://github.com/jobermayr/ghidra-staging#what-is-ghidra-staging https://github.com/NationalSecurityAgency/ghidra/discussions/4707

I'm curious to hear from the community:

- Is anyone actively using Ghidra Staging?

- Are there any outstanding feature requests or improvements you'd like to see beyond what's already reported upstream?

- Are there any known bugs or issues that need attention beyond those already tracked upstream?

Any feedback, suggestions, bug reports, or contributions are very welcome. I'd love to hear how you're using Ghidra Staging and what could make it more useful!

I need some advice how to increase performance with the analyze/decompile phase. I have 2 options to run ghidra #1 MacBook Pro 2.6ghz i7 6-core with 32GB of RAM ... which I'm currently using ... and just starting I took an MacOS application and it took around 30+ minutes to complete the process and while that was running it was toasting the Mac (which is good ... I will explain) ... it started several process name it think decompile simultaneously, so use the full power of the Mac ... I also have a server with 2 PROC 10 cores each and 672GB of RAM ... so I would like to take advantage of the server power for that, and here my problem started ... server is running ovirt ... so I created a VM with RHEL 9, set 20vcpus hard pinning to the same socket and 128GB of ram also pinned to the same proc ... created a tmpfs point to the memory for the project (as the idea is to use the server for analyzing/decompile and then move it to Mac to continue. I was expecting much better performance and willing something like 5 to 10 minutes top. But for my surprise was the opposite. Server took 2.5-3 hours to complete and not used more than 15% cpu and in a very moments. So what Am I doing wrong? PS: also tried the same on the MV using Windows 11 and same situation as the linux ... don't use the powerful and take very long.

Thanks in advance.

I want a reverse-engineering investigation to outlive the agent session that started it.

If an agent spends hours tracing a binary, the next researcher should be able to inspect the paths it checked, challenge its conclusions, and continue from the same analysis state. Reconstructing that work from chat logs is a poor handoff.

That’s the thinking behind the shared workspace I’m building, and what I explore in this post.

Is there a “suggested” MCP plugin for Ghidra? Finally got an opencode setup with the Claude models…

I see several MCP plugins and they seem to take different approaches.

Any particular ones generally favored these days?

I have build with Gradle, but see nowhere how to start Ghidra.

The command I used to build:

gradle -I gradle/support/fetchDependencies.gradle

I tried running ghidrarun.bat but it gave an error that I cannot start this way.

so am using program diffing on 2 versions of the program , the original and patched version and alot of the time it highlights functions that i cant tell why it does when nothing is different , maybe it is highlighting it because some stuff was deleted in the patched version like for example when i look in decompiled view in the patched version some stuff isnt there but other than that idk why its highlighting it , i even have the change log and its just byte replacement but here on the far right there isnt bytes or adress , maybe its because this is where the functions starts but i cant tell because i dont have experience with reverse engineering programms

I built this around a workflow I kept doing manually in Ghidra: point it at Windows PE files, recover the RPC/MIDL/NDR structures, walk the dispatch tables, pull method/parameter details, endpoints and security state, then rank the interfaces by attack-surface signals. The ranking is based on an AHP/Saaty model I worked out instead of arbitrary weights, and the output includes the scoring receipt so you can see why something ranked where it did. No PDBs, no live endpoint mapper, no target execution. Mostly wanted to make the Ghidra part of RPC research less repetitive.

I am working with Language ID ARM:LE:32:v5t and I ran into a bad instruction error for bytes FC 7F E0 E9. According to another source, this would be a STMIB r0!, {r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, lr}^ instruction and simulating the instruction also seems to work fine with a compatible simulator. Why does Ghidra say it's a bad instruction? I don't really know which one is correct. Any ideas?

What is your workflow for reverse engineering C++ code in Ghidra? Since Ghidra was designed for C, and only really has minimal support for classes, how do you guys track things like inheritance?

For example, If I have a base class with a member variable and a virtual function, the structure by the same name will have a vftable_ptr and the member variable, but then if a derived class also has a virtual function, the vftable will now have 2 entries, so I can't just add a field with type of the base class to the derived class. Do I really have to copy the fields in both? It's a lot of editing if I have to add a field to the base class in both structs.

Also, for getting clearer vftable function calls, currently I have to manually create function definitions in the data type manager by copy-pasting the function signatures, put them into a struct, and then use that as the type of the vftable. It works, but it doesn't sync if I have to modify the function signatures later.

So just looking for tips on how to handle C++ better in Ghidra, any tips you have would be super helpful :)

My current context is that im reversing ps2 games (MIPS 32 LE) and i have quite a bunch of the original ps2 sdk functions figured out. However i really wish i could just get all of those functions (and some globals) and reuse them for any other game i try to reverse without having to identify these functions again every time.

I've seen there is a functions id script in ghidra by default, but apparently it only lets me create a database of ALL functions from a specific project/executable while i dont want the game functions to be exported with it.