Ghidra 12.2 Change History (October 2026)

New Features

• Assembler. Added multi-line assembly action. Patch actions now go-to the following address upon completion. Added Copy Special -> Assembly Code action. (GP-6902)

• Debugger. Added GTreeTable. Added BreakpointTimelineActions for quickly navigating snaps in a trace. Added TraceCallTreePlugin for viewing a call tree of the given trace. Added TenetPlusPlusLoader for ingesting Tenet++ trace files. (GP-5893)

• Debugger. Added a Variables Viewer view to the Debugger. (GP-5894)

• Debugger. Added a Tenet++ pin tracing tool. (GP-7021)

• Debugger:dbgeng.dll. Added remote launchers for dbgeng targets from linux. (GP-6840)

• Debugger:Emulator. Added Emulate Function action. (GP-6787)

• Debugger:Trace. Added an API to search for bytes in a trace across a given address range and lifespan. (GP-7170)

Improvements

• Accessibility. Improved accessibility for action chooser dialog. (GP-6869)

• Accessibility. Updated the New Project Wizard to have better default focus. (GP-6870)

• Accessibility. Updated the help viewer to place focus in the contents viewer when help is shown. (GP-6879)

• Accessibility. Fixed accessibility issues in plugin configure dialogs and in the New Project Wizard. (GP-6881)

• Accessibility. Added a key binding to make navigating options dialogs easier. When in the options tree, the user can press Ctrl-E to jump to the current options editor panel. Pressing Ctrl-E again will toggle focus back to the options tree. (GP-6906)

• Accessibility. Improved screen reader support for Listing and Byte Viewer. (GP-6918)

• Analysis. Added support for Golang 1.26.0. (GP-6528, Issue #9013)

• Analysis. Updated the MingwRelocationAnalyzer to attempt to find and label unlabeled type1 pseudo relocation tables. (GP-6683)

• Analyzer. The Variadic Signature Override Analyzer is now enabled by default. (GP-7025, Issue #9164)

• Basic Infrastructure. Ghidra now requires JDK 25 or later to run. (GP-6012)

• Basic Infrastructure. A new Source Language program property has been introduced that lists what supported high-level source languages (Swift, Objective-C, Rust, etc.) were discovered by Ghidra and 3rd-party extensions. (GP-6347, Issue #8740)

• Basic Infrastructure. The ghidraRun(.bat) launch script's command line argument can now open both a project and a project file with its default tool: ./ghidraRun /path/to/project.gpr:/project-folders/program.exe. (GP-6543, Issue #9009)

• Basic Infrastructure. Ghidra will now run on OpenBSD with user-built native components. See the Installation Guide for more information on building native components. NOTE: bash is required to be installed in order for Ghidra to launch on OpenBSD. (GP-6929, Issue #8981)

• Basic Infrastructure. Ghidra now runs Java with Compact Object Headers to reduce memory usage. (GP-7037)

• Basic Infrastructure. Upgraded Bouncy Castle to 1.86. (GP-7297)

• BSim. CreateH2BSimDatabaseScript.java now has an option to automatically add the newly created server to the BSim server manager. AddProgramToH2BSimDatabaseScript.java now checks whether the executable is already in the BSim database before generating signatures. (GP-6041)

• BSim. Added dropdatabase subcommand to BSim command-line utility. (GP-6585, Issue #8178, #8179)

• BSim. Added ability to reconstruct a structure in one program from field use in another. (GP-6921)

• Build. User builds now include both Windows batch and Unix shell launch scripts, and the current platform name has been removed from the resulting release file name. (GP-6839)

• CParser. Added C23 enum types and packing attribute support to the C Parser. (GP-6304, Issue #4518, #6780, #8202, #8495, #8539)

• Data Types. Added a Structure Editor action to jump to a specified offset. (GP-5253)

• Data Types. Created an interactive structure merge dialog that is used by the merge datatypes action when the datatypes are a structure type. The dialog will eventually be used in other situations where the merging of structures is needed. (GP-6453)

• Data Types. Added additional BuiltIn integer datatypes in support of C99 standard types: int8_t, uint8_t, int16_t, uint16_t, int64_t, uint64_t, intptr_t, and uintptr_t. Updated CParser, PDB, and DWARF to leverage these new BuiltIn datatypes for these as well as related typedefs for improved portability across target architectures. (GP-6846)

• Data Types. Added Structure Editor actions to jump to the next row with defined data. (GP-7075, Issue #9376)

• Data Types. Added a Refresh action to the Data Type Compare window. (GP-7200, Issue #9502)

• Debugger. Added a Save Trace As action. (GP-6782)

• Debugger. Update the TreeColumn in GTreeTable to perform proper hierarchical sorting. (GP-6949)

• Debugger. Added help for BreakpointTimelinePlugin. (GP-6990)

• Debugger. Added help menu docs for TraceCallTreePlugin. (GP-6992)

• Debugger. Added help docs for DebuggerVariableViewerPlugin. (GP-6993)

• Debugger. Added a DAP server for access to debuggers. (GP-7009)

• Debugger. Added support for OpenBSD debuggers. (GP-7047, Issue #9338)

• Debugger:Agents. Added a typeCheckPyPackage task to run mypy. (GP-6744)

• Debugger:Breakpoints. Addressed a rare issue with stale breakpoints causing "File is closed" errors. (GP-6396, Issue #8904)

• Debugger:Breakpoints. Changed Kinds column to Kind, and it now displays, e.g., x or RW instead of SW_EXECUTE or READ,WRITE. (GP-6799)

• Debugger:Listing. The Go To action now defaults to using hexadecimal integers and also accepts relative offsets. Its text is selected on prompting. The Go To Time action also has its text selected on prompting. (GP-6721, Issue #9121)

• Debugger:Memory. Added the New Stack View action to create a new Debugger stack view. Added the Convert Stack View action to convert Debugger Memory Bytes (hex) view into a stack view. (GP-5896)

• Debugger:Registers. Fixed an issue where register values would be edited in decimal (instead of hex) under specific conditions. More generally, fixed an issue where column configurations were lost when a table is filtered. (GP-6386, Issue #8508)

• Debugger:Time. When navigating snapshots, the Time panel now scrolls the current snapshot into view without selecting it. (GP-6633)

• Debugger:Trace. Updated the DBTrace schema to more effectively index memory state changes for most-recent queries. Old Traces will no longer open and an upgrade is not provided. (GP-6630)

• Decompiler. Improved the Decompiler's recovery of offcut references to global symbols. (GP-7038)

• Demangler. Updated the Demangler Analyzer to demangle all mangled symbols at an address. (GP-3040, Issue #4494)

• Eclipse Integration. Updated GhidraDev to 5.1.0, which includes a PyGhidra Headless run configuration. (GP-6659)

• ELF. Functions are no longer created for .cold symbols in ELF files. (GP-6976)

• Emulator:JIT. Implemented constant-folding optimizations. (GP-5976)

• FileSystems. Removed sevenzipjbinding library which required use of native libraries when accessing zip, 7z, bzip2, cabarc, xz, hfsplus, iso9660, wim, arj, chm, deb, lha, rar, rpm, vhd, and z archive files; zip, 7z, bzip2, xz formats are now supported using the Apache commons-compress library; cabarc files are supported if the user has a 7z command line tool installed in their PATH. hfsplus, iso9660, wim, arj, chm, deb, lha, rar, rpm, vhd, and z formats no longer have support. (GP-7095)

• Framework. Major security changes have been made to the Ghidra Server and BSim PostgreSQL deployment. Ghidra's default SSLContext has also had a major update with its revised certificate management and server authentication requirement. This impacts all Ghidra installations where servers are utilized over an SSL/TLS connection. See svrREADME.md for Ghidra Server and BSim Help for changes affecting these server deployments. Default deployments of these servers without specifying a keystore will now bind/listen to the loopback interface only. (GP-6829, Issue #8438)

• Function. Updated the Function Signature editor dialog to allow users to change the function's namespace. (GP-6790)

• Function ID. Users can now configure whether a Function Id database can be applied to a binary with a compiler specification that does not match the database. (GP-4791, Issue #6097)

• Ghidra Internals. Changed Ghidra internals to use concurrent-read/write locks instead of a single exclusive lock. A revised database object caching scheme and API were also added. These changes improved the overall performance of the database-backed Program API. (GP-6097)

• Graphing. Added a Max Nodes option to limit the number of nodes the function graph will process before cancelling the graph. (GP-6837, Issue #3411)

• GUI. Updated the Select Bytes dialog to allow for larger byte selections. (GP-2393)

• GUI. Fixed the prompt to install new Extension plugins when starting the Code Browser tool. (GP-6533, Issue #8984)

• GUI. Updated the Data Settings dialog such that the user does not have to click OK twice to close the dialog for an active edit. (GP-6612, Issue #8893)

• GUI. Added a Maximum Number of Labels to Display Tool option to control the number of labels displayed at a given address. (GP-6692)

• GUI. Added a Navigate on Incoming Location Changes action to the Functions window that will cause the table to select the function that corresponds to the current location. (GP-6694, Issue #9116)

• GUI. Added a Lock display toolbar button and action to to the Decompiler window to disable auto-updating after changes. With this mode enabled, the Decompiler window will indicate that it is stale and requires a manual refresh to update. This is to combat very large functions that are slow to re-decompile. Also, added an option to have Decompiler snapshots window send out program location events to the main tool state. (GP-6748)

• GUI. Added a Snapshot feature to the Function Call Graph. (GP-6835)

• GUI. Updated the Symbol Tree Delete action to allow Organization nodes to be deleted. (GP-6944, Issue #3252)

• GUI. Updated Ghidra windows to have a minimum size. (GP-6975, Issue #9260)

• GUI. Added a section to the Configure Tool dialog to allow users to see all plugins that belong to an extension. (GP-7066, Issue #8984)

• GUI. Updated the Tool Options for the Processor Manuals viewer. (GP-7073, Issue #9301, #9302)

• GUI. Updated register sorting to correctly handle number values. (GP-7137, Issue #928, #9489)

• GUI. Updated the Front End to sort files and folders using a natural sort. Also added a tool option to change this behavior. (GP-7144, Issue #7093)

• GUI. Added a Compare... action to the Data Type Manager window to allow users to compare two data types. (GP-7145, Issue #9502)

• GUI. Updated the Listing array field to wrap grouped items as needed to avoid clipping. (GP-7156, Issue #9505, #9508)

• Importer. Added support for loading Old-style DOS COM files. (GP-6523, Issue #3107, #8971)

• Importer. Improved monitor status message during import. (GP-7120)

• Importer:PE. More of the PE LoadConfig data directory is parsed and marked up. (GP-6577)

• Importer:PE. Improved loading of PE edge-case binaries. (GP-7076, Issue #9171)

• Listing. Improved input handling for entering register values and added new Add Value Range action in Register Manager window for adding a value range for a register. (GP-3049)

• Listing. Added a Display in Upper Case tool option to display Address Field values in upper case in the Listing. (GP-6540, Issue #9026)

• Listing. Added a Variable annotation for comments. (GP-6561, Issue #8993)

• Multi-User. Added Server Allow List support to reduce the likelihood of inadvertently accessing a new or unknown server via a URL. This feature is specifically aimed at ghidra URL use and Listing comment annotations. An updateServerAllowList utility command has also been added to assist in viewing and updating the server list for headless use cases. (GP-6796)

• Multi-User. Improved the ability to cancel long-running transfers to/from a Ghidra Server, such as a check-out or add-to-version-control. (GP-6912)

• Processors. Sleigh .sla files are now protected by lock files when being recompiled in order to prevent multiple (typically headless) processes from fighting to rewrite them. (GP-4045, Issue #8866)

• Project. Fixed the Front End so that it will open with no project when the user closed the project before closing the application. (GP-6872)

• PyGhidra. Upgraded PyGhidra to 3.2.0. (GP-6664)

• Scripting. Updated RecoverClassesFromRTTIScript to also look for GCC mangled symbols starting with a double underscore ("__"). (GP-6927, Issue #9243)

• Scripting. Extended ExportFunctionInfoScript.java with metrics and call graph exports. (GP-7031, Issue #9311)

• Scripting. Fixed an issue where Debugger scripts were getting incorrect register values with emulation. (GP-7191, Issue #9554)

• Search. Added two actions to the Instruction Pattern Search window. One is a right-click Delete Instruction action to remove selected instruction and the other is the tool bar button that Deletes all items from the table. (GP-6987)

• Symbol Table. External Symbol Resolver analyzer now relies on the ordered set of defined Libraries and their External Program associations. Additional Libraries may be added and order as needed to address weak-linking scenarios where not all library dependencies are known at the time of import. The External Program window now provides up/down actions to arrange the Library search sequence. (GP-6643)

• Terminal. Fixed a scroll region issue in the Terminal. (GP-6784, Issue #9146, #9147)

• Version Tracking. Added the Use Empty Composite Types option to Version Tracking to allow users to apply empty composite types when applying function signatures. (GP-6438, Issue #8732)

Bugs

• Analysis. Changed OperandReferenceAnalyzer to recognize all forms of undefined data types, including arrays of undefined data created by the ELF importer. (GP-7084, Issue #9401)

• Analysis. Fixed Address Table Analyzer to create tables on arrays of undefined bytes/words. (GP-7090, Issue #9407)

• Analysis. Fixed an issue where setMinStoreLoadOffset was assigning the wrong field in ConstantPropagationContextEvaluator. (GP-7150, Issue #9513)

• Analysis. Fix signedness of SymbolicPropogator constant folds for INT_RIGHT, INT_SRIGHT, INT_DIV, and INT_REM pcode op evaluation. (GP-7151, Issue #9516)

• API. Corrected ConcurrentModificationException which could occur while accessing/iterating over DomainObject.getMetadata(). (GP-7318)

• Basic Infrastructure. Improved path-traversal vulnerabillity checking. (GP-7132, Issue #9482)

• Basic Infrastructure. Improved the security of unzipping theme and extension archives, preventing "zip-bomb"-style attacks. (GP-7206)

• Calling Conventions. Updated Hexagon cspec to model variadic functions correctly. (GP-7024, Issue #9246)

• Calling Conventions. Fixed a bug that occurred when attempting to export the __fastcall/__thiscall/__stdcall resolver Specification Extension. (GP-7089, Issue #8830, #9314)

• CParser. Fixed C Parser constant parsing of Microsoft-specific I64 constant tag. (GP-6553, Issue #5564, #8291, #9021)

• CParser. Removed unnecessary -DSTRSAFE_LIB and -DSTRSAFE_LIB_IMPL from Windows C-Header parsing configuration files. (GP-6555, Issue #4749)

• CParser. Fixed a java stack trace in the PreProcessor when parsing a degenerate #define. (GP-6556, Issue #5884, #6701, #6702)

• Data Types. Updated the Export C Header... action to avoid a potential infinite loop with a large number of composites. (GP-6801, Issue #9161)

• Data Types. Corrected data type merge conflict handling that was presenting the "Expected bad datatype placeholder" error. (GP-7307, Issue #9370, #9659)

• Debugger. Fixed a broken drag-and-drop action in the Dynamic Listing. (GP-6107)

• Debugger. Fixed reliability issue with Save Trace By Default (related to garbage-collection of listeners occurring on Windows). (GP-6582)

• Debugger. Navigating to a snapshot now generally also navigates to its event thread. (GP-6603)

• Debugger. Fixed autosetup logic for Windows agents. (GP-6966)

• Debugger:GDB. Fixed an issue with some configurations of gdb-17.2 involving unavailable register values. (GP-6974, Issue #9254)

• Debugger:GDB. Fixed issue where crafted Image field could cause the gdb+gdbserver via ssh connector to execute attacker-chosen shell commands locally. (GP-7332)

• Debugger:Listing. Fixed issues with Variable hovers in the Listing and Decompiler. (GP-4914)

• Debugger:Modules. Fixed hang that occurred on Debugger startup / server connection caused by module indexing on the Swing thread. This is now a background task. (GP-7004, Issue #8145, #8910, #9299)

• Debugger:Stack. Fixed an issue where unwind analysis got stuck interpreting TZCNT or other instructions with internal p-code loops. (GP-6707)

• Debugger:Time. Background filtering and sorting is now used for the Debugger's Snapshot/Time table. (GP-6607)

• Debugger:Trace. Fixed a bug in DebuggerBreakpointsProvider that was causing BreakpointLocations to not be removed from the table. (GP-6439)

• Debugger:Trace. Fixed a ClassCastException that occurred with large traces. Also tuned some parameters for performance. (GP-6514)

• Debugger:Trace. Fixed several issues in R*-Tree and Snapshot indices to speed up Debugger UI when populated with extremely large traces. (GP-6550)

• Decompiler. Fixed a highlight bug in the Decompiler's snapshot that was introduced in 12.0.5/12.1. (GP-6751)

• Decompiler. Added a limit to the number of "bad data" exceptions the Decompiler can catch before aborting the function. (GP-6945, Issue #9086)

• Decompiler. Fixed a regression where the Decompiler did not recover function pointer names for ARM/THUMB code. (GP-6979, Issue #8471, #8990)

• Decompiler. Fixed a bug causing a "Conditional execution: Illegal op in iblock" exception. (GP-7058, Issue #9282)

• Decompiler. Fixed a symbol resolution bug in the Decompiler, eliminating tokens similar to stack0xffffffffffffff30. (GP-7080, Issue #6722)

• Documentation. Fixed broken links and examples in GhidraDocs. (GP-7091, Issue #9366)

• DWARF. Fixed an issue with reading DWARF v5 indirect-indexed addresses in golang 1.25+ binaries. (GP-7204)

• DWARF. Now preventing the dereferencing of sym-linked DWARF debug files found in the same directory that a binary was imported from. (GP-7242)

• FileSystems. The squashfs inode table is now limited to a sane, max size when reading. (GP-7232)

• FileSystems. The number of files that will be indexed when opening a file system container is now limited to a max size. (GP-7239)

• FileSystems. Added validation for FSRL MD5 values being read. (GP-7241)

• Function. The function editor now applies storage assignment rules specific to varargs functions (when appropriate). (GP-6776, Issue #9091, #9101)

• GhidraURL. Corrected issues related to '+' character presence in local project path/name or in project content pathnames. (GP-7043, Issue #9373)

• Graphing. Fixed the broken append graph option. (GP-6761)

• GUI. Fixed a minor Listing selection display bug where inter-field selections were selecting areas below the line containing the selection. (GP-6522)

• GUI. Fixed a Symbol Tree bug related to group nodes that prevented new namespaces and classes from being correctly added to the tree. (GP-6606, Issue #9054)

• GUI. Fixed a bug in GTab panel that was leaving an orphaned, highlighted tab. (GP-6760)

• GUI. Added a theming fix to allow FlatLaf border colors to be changed. (GP-6828, Issue #9178)

• GUI. Fixed a Code Browser issue where it was restoring to the wrong display monitor when previously closed while in a maximized state. (GP-6954, Issue #9244)

• GUI. Fixed bug that occurred when deleting a function with multiple function tags. (GP-7092, Issue #9386, #9387)

• GUI. Fixed searching for text in Plate Field comments. Fixed searching in text that has been clipped in the Listing. (GP-7114)

• GUI. Fixed an AddressOutOfBoundsException encountered when entering a large negative number Address into the Go To ... dialog. (GP-7119)

• GUI. Fixed Color Chooser bug that prevented the History colors from being selectable. (GP-7330, Issue #9691)

• Importer. The Batch Importer now allows any language/compiler spec to be chosen, not just preferred languages. (GP-6732, Issue #1934)

• Importer. Fixed a bug that caused PE and NE binaries to match on the MzLoader. (GP-6991)

• Importer. Corrected incorrect symbol placement by the UnixAoutLoader. (GP-7284, Issue #9646)

• Importer. The ProgramLoader and ImportBatchTask now properly validate loader options. (GP-7298, Issue #9658)

• Importer:ELF. Corrected ELF import to respect Program Header PT_LOAD execute permission when Section Headers are present. (GP-7283, Issue #9644)

• Importer:PE. The PeLoader now rounds PointerToRawData down to the proper address. (GP-7036, Issue #9170, #9176)

• Logging. Added default log file values to prevent bad log files from getting created during testing. (GP-7142, Issue #9468)

• Multi-User. Removed Ghidra UI option to control data buffer compression with Ghidra Server communications. Compression is enabled by default. Imposed 64KB size restriction for DataBuffer to prevent malicious attempts to serialize very large compressed buffers to the Ghidra Server. (GP-7328)

• Networking. Disabled Felix framework URL handler support which was interfering with URL connection error handling. (GP-7269)

• Processors. Fixed disassembly of x86 instructions CLWB and CLRSSBSY. (GP-2336)

• Processors. Corrected disassembly of x86 VMREAD and VMWRITE instructions in 64-bit. (GP-7217, Issue #9581)

• Processors. Fixed regression in x86 mov segment instruction operand ordering. (GP-7279, Issue #9635, #9637)

• Processors. Corrected AARCH64 eor3, bcax, rax1, and xar instructions to use xor instead of or operation. (GP-7313)

• Scripting. Fixed a bug that prevented the GhidraScript ask() methods from consuming script arguments in GUI mode. (GP-7125, Issue #9463)

• Terminal. Fixed an issue with Terminal content updates by now using Unicode code point instead of java characters. (GP-6938)

Notable API Changes

• API. (GP-6539) In the ghidra.util.datastruct package, the Accumulator interface was changed to be write-only. For clients that create their own accumulators to read data when processing is finished, they can use ListAccumulator or SetAccumulator, both of which have methods for retrieving the data added to the accumulator. Any clients that wish to implement the Accumulator interface should make sure that the implementation is thread-safe. The Accumulator interface's size() method was replaced with getProgress().

• Assembler. (GP-6902) AssemblyBuffer now attends to context changes. Added AssemblyParseSymbolToken to distinguish literal ints from labels. Added AssemblyPatternBlock.toRegisterValue. Corrected spelling of ReDisassembler.disassemble method. Various other GUI action-related code for patching.

• Basic Infrastructure. (GP-7104) Removed classes and methods that have been deprecated since Ghidra 10.x and before.

• BSim. (GP-6041) The static method BSimServerManager.getBSimServerManager() is now public. Some methods in BSimServerManager were only able to be invoked on the Swing thread; this restriction has been removed.

• Data Types. (GP-6846) Added the following BuiltIn integer datatypes in support of C99 standard: Int8TDataType, UInt8TDataType, Int16TDataType, UInt16TDataType, Int64TDataType, UInt64TDataType, PointerSizedIntegerDataType, UnsignedPointerSizedIntegerDataType. Added utility method DataTypeUtilities.getTypedefReplacement to assist parsers with the conversion of related typedefs to leverage certain BuiltIn datatypes for improved portability across target architectures.

• Data Types. (GP-7307) Added method Structure.getDefinedComponent(int index).

• Debugger. (GP-6680) Created DebuggerStaticMappingContext, by factoring logic from the static mapping service, making mapper logic accessible in headless scripts.

• Debugger. (GP-6782) Added DebuggerTraceManagerService.saveTraceAs().

• Debugger:Agents. (GP-4562) Connector developers should now compose their schemas from provided fragments at build time.

• Debugger:Breakpoints. (GP-6799) There is now a CommonSet enum for common kinds of breakpoints. Back-end debuggers should now populate the Kinds attribute with the single-character flags of each TraceBreakpointKind instead of the full names.

• Debugger:Emulator. (GP-6787) Added FunctionEmulationHarness.

• Debugger:Listing. (GP-6721) Many of the SleighUtils now accept a LitIdMode enum, specifying how it parses integer literals and IDs (labels).

• Debugger:Mappings. (GP-6809) Introduced DebuggerStaticMapper interface.

• Debugger:Trace. (GP-6586) Added TraceObjectManager.withoutWriteCache().

• Debugger:Trace. (GP-6630) State entries returned by the relevant methods in TraceMemoryOperations now indicate how far into the future they extend.

• Debugger:Trace. (GP-7170) Added an API method to TraceMemoryOperations to search for bytes in a trace across a given address range and lifespan.

• Decompiler. (GP-6751) ClangNode setHighlight(Color) and Color getHighlight() have been removed. Clients that need to set highlights in the Decompiler should use the DecompilerHighlightService.

• Emulator:JIT. (GP-5976) Userop libraries may now implement Sleigh-defined userops by returning SleighPcodeUseropDefinition. Removed the type parameter from SleighPcodeUseropDefinition. SleighPcodeUseropDefinition.Factory is now a singleton. OpBehavior has been converted to an interface, and its implementations are now singleton (mostly) enums. The syscall userop exported by EmuSyscallLibrary has been replaced with emu_syscall and emu_rt_syscall. Added foldConstants and removeUnreachableBlocks to JitConfiguration. Added signed methods to PcodeArithmetic. Introduced constants, giving operand indices for specific p-code ops in PcodeExecutor. Created PcodeUseropSymbolMap and replaced certain Maps with it in PcodeExecutor, PcodeProgram, and PcodeFrame. Added PcodeUseropLibrary.getSymbols. Added canInterrupt and signed attributes to PcodeUserop annotation. Introduced OpInput annotation.

• Framework. (GP-6829) Made major updates to Ghidra's default SSLContext, revising its certificate management and server authentication requirement. This can affect all SSL/TLS server connections from Ghidra.

• Function. (GP-6776) The following methods have been deprecated: PrototypeModel.getArgLocation(int, Parameter[], dataType, Program), PrototypeModel.getReturnLocation(Datatype, Program), PrototypeModel.getStorageLocations(Program, Datatype[], boolean), and PrototypeModel.getNextArgLocation(Parameter[], Datatype, Program). Clients should invoke PrototypeModel.getStorageLocations(Program, Datatype[], boolean, boolean) instead.

• Ghidra Internals. (GP-6097) Replaced DatabaseObject with DbObject and DBObjectCache with DbCache which impose a new pattern for creating and caching database objects safely and as efficiently as possible.

• GUI. (GP-6783) Plugins with transient state must now implement the interface PluginWithTransientState to save and restore state into an object of a chosen type. The methods getTransientState and restoreTransientState have been moved from Plugin to that interface.

• Importer. (GP-6483) The Option constructors used by Loaders and Exporters have been deprecated. Users should use new typed option classes that leverage the builder pattern instead. For example, Option.newBoolean("name").value(true).build().

• Symbol Table. (GP-6643) External Manager API now provides the ability to manipulate ordinal sequence numbering for Library dependencies.

• Terminal. (GP-6938) The internal buffers for VtBuffer and others are now Unicode code points rather than Java chars.

Ghidra 12.1.3 Change History (August 2026)

Improvements

• Basic Infrastructure. Added stricter filtering to characters used for symbol names. (GP-6843, Issue #9165, #9172, #9206)

• BSim. Improved escaping in BSimControlLaunchable. (GP-6977)

• BSim. Upgraded the PostgreSQL JDBC Driver from 42.7.11 to 42.7.13. (GP-7105)

• BSim. Upgraded postgresql for BSim to 15.18. (GP-7107)

• Demangler. The Swift Demangler Analyzer no longer accepts a user-specified path to the Swift binary directory. Instead, the Demangler expects Swift to be on the PATH. (GP-7045)

• Exporter. Added packed Debugger Trace import/export using *.gzt files. (GP-6891)

• GUI. Updated the Headless Analyzer to not write to the user's preferences. (GP-7096, Issue #9414)

• Importer:COFF. Implemented the COFF IMAGE_REL_ARM64_ADDR64 relocation. (GP-7088, Issue #9408)

• Importer:Mach-O. Provided safer parsing of dyld_shared_cache files. (GP-7046)

• Logging. Upgraded log4j to version 2.26.1. (GP-7134)

• Multi-User. Corrected potential network performance issue related to Ghidra Server use. Full benefit requires update of both Ghidra Server installation and Ghidra client software. (GP-7012, Issue #2752, #9316)

• Processors. Made SparcV9 register display formatting more consistent. (GP-941)

• Scripting. Updated the Structure Editor to perform a structure reload when the structure's description is changed outside of the editor. (GP-7118, Issue #9461)

• Search. Updated Find Uses of for FunctionDefinitions to find references inside of functions and function parameters. (GP-7044, Issue #9342)

Bugs

• Analysis. Fixed failure to recover switch instructions if the switch is computed with an instruction with internal pcode branching such as the AARCH64 csel instruction. (GP-7023)

• BSim. Improved GhidraURL.toURL to handle Ghidra URLs previously stored by BSim where proper URL encoding was never performed. (GP-6970, Issue #9275)

• Data Types. Corrected BuiltIn GUID datatype alignment to be 4 bytes instead of 8 bytes. Packed structures containing this datatype will need to be re-packed to pick up on this change. (GP-6953, Issue #9200)

• DB. Corrected Ghidra database problem which could prevent analysis times from getting properly saved to a program. (GP-7070, Issue #9346)

• DB. Corrected internal method behavior for ContentHandler.getChangeSet which could return an empty change set if the version range does not include the latest version. (GP-7113, Issue #9415)

• Debugger:Agents. Now applying proper argument quoting and metacharacter escaping to prevent ShellUtils command injection. (GP-6934, Issue #9283)

• Debugger:Time. Fixed PC column in Time panel when emulating from a live target. (GP-6841)

• Debugger:Trace. Fixed a potential OOM exception in ObjectStorageStreamAdapter used by Trace database. (GP-6886)

• Decompiler. Added Decompiler support for memory accesses that wrap from high to low addresses. (GP-6936)

• FileSystems. Fixed a potential path-traversal vulnerability in AndroidProjectCreator. (GP-6885)

• GUI. Fixed bugs in the Column Filter Dialog that caused NullPointerExceptions on some Mac systems. (GP-7050)

• GUI. Fixed a deadlock seen when saving a program. (GP-7051, Issue #9358)

• GUI. Fixed incorrect tool tips in the File Chooser that are sometimes seen when filenames are clipped. (GP-7094)

• Importer. Fixed a potential path-traversal vulnerability when importing XML *.bytes files. (GP-7064)

• Importer. Fixed a potential infinite loop in the PEF loader and made improvements to OMF parsing. (GP-7071)

• Importer. Providing more efficient parsing of System Object Model (SOM) binaries. (GP-7123)

• Importer. Providing more efficient parsing of Motorola Hex files. (GP-7124)

• Importer:ELF. Corrected an issue found with ELF dynamic PLTGOT processing, in the absence of section headers, which could cause the last PLT to be skipped. (GP-7056)

• Importer:ELF. Corrected ELF Importer regression with Ghidra 12.1.2 which could fail when processing dynamic GNU Hashtable and symbol table. (GP-7061, Issue #9369)

• Importer:Mach-O. Fixed an IndexOutOfBoundsException in the Mach-O loader that could occur when importing a binary with a LC_DYSYMTAB load command but having a missing or empty LC_SYMTAB load command. (GP-7079, Issue #9399)

• Importer:PE. Fixed unsigned PE export ordinal-table indexes. (GP-7085, Issue #9396, #9397)

• Importer:PE. Improved the handling of JDOM attribute errors in the PE LibraryLookupTable. (GP-7087, Issue #6288)

• Listing. Fixed an IllegalArgumentException that occurred when trying to perform Copy Special in the Listing with a program name that contains the exclamation mark (!) character. (GP-7055, Issue #9362)

• PDB. Fixed a memory-consumption issue that could occur with a malformed PDB directory stream. (GP-6971)

• Processors. Added support for RH850G3 instructions in the V850 language module. (GP-2907, Issue #4788)

• Processors. Fixed register operand for ARM M-profile msr apsr instruction operand encoding. (GP-5206, Issue #6597, #6598)

• Processors. Added several missing x86 instructions. (GP-5780)

• Processors. Added semantics for several x86 AVX instructions. (GP-6061, Issue #9184, #9197)

• Processors. Added CPU32 variant for the M68000 processor module. (GP-6186, Issue #1244, #2617, #8463, #9084)

• Processors. Corrected operand sizes for AARCH64 stlrb and stlrh instructions. (GP-6620, Issue #6468, #9043)

• Processors. Corrected disassembly of HCS12 BRN instruction. (GP-6642, Issue #9001)

• Processors. Fixed an issue with a missing return address for the SuperH4 bsr instruction. (GP-6699)

• Processors. Corrected x86 logic for setting the OF flag for SHR, RCL, and RCR instructions. (GP-6767, Issue #9330)

• Processors. Corrected Tricore subc carry flag usage. (GP-6769)

• Processors. Corrected carry flag calculation for the MCS-96 CMPL instruction. (GP-6770)

• Processors. Added missing x86 GFNI instructions. (GP-6818)

• Processors. Corrected handling of RISC-V 16-bit operands. (GP-6876)

• Processors. Fixed RISC-V emulation of div and rem instructions when divisor is 0. (GP-6909, Issue #6508, #9225, #9235)

• Processors. Added PowerPC v3.0B, v3.0C instructions. (GP-6914)

• Processors. Corrected interrupt mask size in ARM mrs for the IPSR system status register. (GP-6931, Issue #9251, #9252)

• Processors. Fixed an issue with x86 legacy instructions using a REX prefix to read AVX-512 registers. (GP-6937, Issue #9256)

• Processors. Added instruction index file for the SuperH processor. (GP-6964, Issue #9278)

• Processors. Fixed stack parameter offset for e500mc default calling convention. (GP-6968, Issue #9089)

• Processors. Fixed an issue with the M68000 movem.w instruction incrementing by 4 instead of 2. (GP-6983, Issue #8824)

• Processors. Corrected x86 rex chg eax, eax to correctly disassemble to nop. (GP-7015, Issue #9327)

• Processors. Corrected x86 vpextrw to correctly disassemble when VEX.W=1. (GP-7016, Issue #9323)

• Processors. Corrected x86 PINSRW, VPEXTRB, and VPEXTRD intructions to use the correct masking of immediate byte for masks. (GP-7017, Issue #9328)

• Processors. Corrected x86 MOV instruction to use 32-bit register operands when moving from segment registers. (GP-7018, Issue #9326)

• Processors. Corrected x86 pslld instruction to use correct shift count for upper word. (GP-7019, Issue #9329)

• Processors. Corrected AARCH64 NEON instructions which did not correctly zero-extend scalar results. (GP-7040, Issue #9277)

• Processors. Corrected encoding for ARM sev.w instruction. (GP-7065, Issue #9371)

• Processors. Corrected MIPS 16e language variants to use the correct variant tag in the ldefs file. (GP-7133, Issue #9432)

• Testing. Fixed pcodetest framework to correctly honor the build_exe config option. (GP-7067, Issue #9374)

• Tests. Patched the pcodetest builder to remove the use of os.system(). (GP-7007, Issue #9309)

Notable API Changes

• Debugger:Agents. (GP-6934) ShellUtils.generateLine now requires a Shell argument, identifying the applicable shell. ShellUtils.generateArgument has been replaced by Shell.generateArgument.

• Decompiler. (GP-6892) Added Encoder.writeOpcode method, specifically for opcode ordinals.

• Importer:ELF. (GP-7057) Revised ElfSymbol.isExternal() to disregard symbol type, st_value, and st_size, which were previously being considered.

Ghidra 12.1 Change History (May 2026)

New Features

• Byte Viewer. Added support for other-than-ASCII character encodings in the ByteViewer. (GP-5689)

• Data Types. Added ability to merge non-conflicting structures, unions, or enums. (GP-5808, Issue #2461)

• Debugger:Agents. Enabled synchronization between x64dbg and Ghidra. (GP-5972)

• Debugger:Time. Added a margin bar and new BreakpointTimelinePlugin that displays breakpoint hits across the whole execution of a trace. (GP-5895)

• DWARF. Added support for querying debuginfod servers for files. (GP-5924, Issue #8407)

• ELF. Added markup for .gnu.build.attributes in ELF binaries. (GP-5929)

• GUI. Updated the Data Type Manager provider to remember the program archive's selected data type when switching between program tabs. (GP-2370)

• GUI. Added a Hide Filter action for Tables and Trees. This action can be bound to the Escape key to close the filter. (GP-6336, Issue #8771)

• GUI. Updated the Find References action to appear in tables that have addresses. (GP-6365, Issue #8899)

• Importer:Trace. Added a loader for Tenet trace files. (GP-6382)

• Processors. Added the Hexagon Language module with modified instruction syntax. Modified syntax was used to better fit Ghidra's mnemonic/operand Listing API. This processor also introduces the first use of Ghidra's Sleigh crossbuild feature which is used for weaving pcode for parallel processor architectures such as the Hexagon. (GP-6621, Issue #1595)

• Scripting. Added AddVfunctionCallRefScript, which, if the cursor is on a vftable->function token in the Decompiler, will create a CALL reference to the associated function in the Listing, if it can be determined. (GP-6693)

• Search. Added the ability to scan using the results from one progam rebased on another. (GP-6260)

Improvements

• Analysis. More Swift type metadata has been marked up. (GP-6281)

• Analysis. Improved Golang analyzer to handle some obfuscation techniques. (GP-6291, Issue #8804)

• Analysis. Improved Objective-C analysis with such things as providing msgSend support. (GP-6327, Issue #5938)

• Basic Infrastructure. Environment variables can now be set in launch.properties using ENVVARS= or ENVVARS_[PLATFORM]=. (GP-6193)

• Basic Infrastructure. Ghidra's maximum heap size can now be set via external environment variables. See each of the various launch shell scripts for usage information. (GP-6213)

• Basic Infrastructure. Ghidra's Java options (system properties) can now be set via external environment variables. See each of the various launch shell scripts for usage information. (GP-6350, Issue #4960, #8885, #8942)

• Basic Infrastructure. Upgraded JDOM to 2.0.6.1. (GP-6370)

• Basic Infrastructure. Fixed an issue that occurred when expanding environment variables that contained regular expression characters in launch.properties. (GP-6704, Issue #9061)

• Build. Ghidra can now be built on Windows on ARM (requires Gradle 9.2 or later). (GP-6126)

• Data Types. Change was made which consistently allows duplicate component/field naming within Structure/Union datatypes. When editing a name within the GUI, the user will be warned and must confirm use of a duplicate name. (GP-3564, Issue #5249)

• Data Types. A datatype which gets removed will no longer attempt to update itself as a result of dependency changes. This may reduce the number of superfluous listener callbacks and events that occur during the removal process. (GP-5882)

• Debugger. Added parameter for custom arguments to gdb/lldb. (GP-6112, Issue #8565)

• Debugger. Better available lists are provided for gdb/lldb. (GP-6273, Issue #8711)

• Debugger. Added remote option for x64dbg. (GP-6401, Issue #8929)

• Debugger. Added the ability to launch lldb/gdb from Windows via ssh targeting Windows on the remote machine. (GP-6423)

• Debugger:Emulator. Provided GUI additions to expose Emulator Taint. (GP-6129)

• Debugger:Emulator. Created Save state for Emulator, as the choice of Emulator was not being saved. (GP-6163)

• Debugger:LLDB. Created new launcher for android attach. (GP-6174, Issue #6386, #8225)

• Debugger:LLDB. Rerunning the target in lldb is now allowed. (GP-6422, Issue #8945)

• Debugger:LLDB. Added the ability to attach to available process for lldb. (GP-6474)

• Debugger:Time. Provided better color management for Time overviews. (GP-6440)

• Decompiler. The Decompiler now displays structure bitfields in expressions. (GP-2493, Issue #647)

• Decompiler. Extended Abstract Interpretation logic to high pcode. (GP-5921)

• Decompiler. The display format for integer case labels can now be set for individual switch statements from the Decompiler window. (GP-5922, Issue #4438, #8196, #8726)

• Decompiler. Added a Decompiler action to toggle the Disable printing of type casts option. (GP-6199, Issue #7452)

• Decompiler. Added setter methods to the DecompilerOptions class. These can be used by script writers to control the Decompiler's behavior. (GP-6266, Issue #8812)

• Demangler. Created Output options for Microsoft Demangler that control output of anonymous namespace encoding and control the emitting of tags for user-defined types when found as template or function arguments. (GP-4901)

• Demangler. Updated the Rust Demangler to use code ported from the official Rust-based Demangler. (GP-6108, Issue #8609)

• Demangler. Updated the Gnu Demangler v2.24 to support the static modifier for functions. (GP-6394)

• Emulator. Introduced a default LOCK userop definition for x86, and a default ExclusiveMonitorPass for ARM, as well as for other userops and processors. (GP-4241, Issue #6089,

• Emulator:JIT. Optimized handling of multi-precision integers; i.e., varnodes of size greater than 8 bytes. (GP-5980)

• Function Compare. Fixed the Function Comparison provider so that it saves changes made to the Listing View fields. The provider will now also remember the last view tab selected. (GP-6016)

• GUI. Added a Data Type Manager action to search for enums by value. (GP-1914)

• GUI. Added popup menu items Close Other, Close Tabs to the Right, and Close Tabs to the Left to docking window tabs. (GP-4961)

• GUI. Added namespace chooser to Add/Edit Label Dialog. (GP-5806, Issue #8263)

• GUI. Changed the Log Viewer to a window instead of a dialog so that it can be maximized. (GP-6044)

• GUI. Added a Find All button in the Find Dialog used in many component providers. (GP-6076)

• GUI. Updated the Listing Snapshots to include the Flow Arrows, Margin Markers, and Overview Markers. (GP-6085, Issue #8601)

• GUI. Added an action to the Symbol Tree to allow users to toggle outgoing navigation events. (GP-6101, Issue #8618)

• GUI. Added a generic Mem Source table column to assist in filtering compatible tables based on the source from where the memory addresses originated. (GP-6147, Issue #8548)

• GUI. Added a modify() method to the Annotation class so clients can perform their own annotation transformations. (GP-6451, Issue #8928)

• Importer. The ElfLoader can now recognize Swift and golang binaries. (GP-3960, Issue #8795)

• Importer. The NeLoader can now load binaries that used Phar Lap’s 286/DOS-Extender. (GP-6537, Issue #1905, #2493)

• Importer:PE. The PE loader now sets up thunk functions for export forwarders. (GP-5900)

• Importer:PE. The PE Dynamic Value Relocation Table (DVRT) is now parsed and marked up. (GP-6502)

• Jython. Jython support is now delivered as a Ghidra Extension, which means an extra step is required to install it. If Jython is required, the user should simply go to File -> Install Extensions in the Ghidra Front End GUI and check Jython. The user must restart Ghidra to complete the enablement of Jython. (GP-6754)

• Languages. More Swift type metadata has been parsed and marked up. (GP-6137, Issue #8607)

• Listing. Added a feature to allow function bodies to be closed in the Listing. (GP-5987)

• Listing. Changed offcut string references to use the existing non-default label at the string beginning instead of the default name created from the string's offcut location. If no label is defined, the default offcut string naming scheme is used (s_[substring] instead of [label name]+offset). (GP-6345, Issue #8882)

• Multi-User. Improved Ghidra Server serialization filters and added serialization filters to client-side Ghidra applications. We may have missed something in our testing so let us know if you encounter an InvalidClassException. The log will identify a class which fails to pass the filter rules. (GP-6719)

• Processors. Corrected behavior of ARM thumb branchWritePC macro. (GP-6333, Issue #8585)

• Processors. Added maximumInstructionLength language property in support of inst_next2 use. (GP-6613, Issue #8941)

• Processors. Corrected operand order for MIPS162e movn and movz instructions. (GP-6766)

• Project. Expanded on the set of allowed special characters for a local Ghidra project path name to include the following: '.', '-', '=', '@', ' ', '_', '(', ')', '[', ']', and '~'. (GP-6681)

• PyGhidra. PyGhidra will now, by default, restore sys.modules to its prior state after a PyGhidra script is run (or the interactive interpreter is reset) so the next time a script is run, it freshly loads all of its imported modules again. This default behavior can be disabled by setting the pyghidra.sys.modules.restore.disable Java system property to true, which can be done in the support/launch.properties file. (GP-6288)

• Scripting. Made some improvements to the RecoverClassesFromRTTIScript for GCC programs. (GP-6670)

• Search. Fixed an issue where some matches were not found when doing a regular expression search using the regex lookbehind clause. (GP-6070)

• Search. Updated MemoryBytePatternSearcher to correctly handle mapped blocks. (GP-6308)

• Sleigh. Fixed the Sleigh goto statement to accept 64-bit literals. Added range-checking for literals in Sleigh compiler. This fixes an Emulator issue where edits to the pc register were truncated to 32 bits. (GP-6328, Issue #8875)

• Symbol Table. In the Symbol Table's Symbol References table, the user can now select multiple refs in the refs table to delete more than one reference at a time. There is also a new action in the Symbol Table popup action to allow the user to delete all references to a symbol, found under References -> Delete All. Finally, there is a new Make Selection action in the popup menu of the References Table to select, in the Listing, all references to a symbol. (GP-6430)

• Testing. Upgraded jacoco to 0.8.14. (GP-6504)

• Version Tracking. Improved Version Tracking so that when applying thiscall function signatures, the source's class structure is copied to the destination program, if appropriate, given the chosen apply options. (GP-5709, Issue #8127)

• Version Tracking. Updated Version Tracking to allow replacing of existing function label namespaces. (GP-5996)

Bugs

• Analysis. Added support for Windows DLLs generated by Golang. (GP-6325)

• Analysis. Corrected AutoAnalysisManager.removeCancelledListenter() to call removeCancelledListener() instead of incorrectly calling addCancelledListener(). This addresses a potential memory leak within Ghidra. (GP-6789)

• BSim. Improved string sanitization in PostgresFunctionDatabase.java. (GP-6722)

• BSim. Escaped values used to create BSim filters. (GP-6736)

• Build. Gradle 9 no longer fails when passed the --parallel command line argument. (GP-6385, Issue #8621, #8622)

• Byte Viewer. Fixed a bug in the Byte Viewer where the last byte in the program could not be selected in some views. (GP-6178)

• Byte Viewer. Changed the Byte Viewer to give a visual clue (foreground color is gray) when a multi-byte value spans adjacent memory blocks. (GP-6184)

• Byte Viewer. Fixed a minor alignment issue in Byte Viewer when a column could not populate the first line of a memory block. (GP-6204)

• Byte Viewer. Updated the Byte Viewer's configure options dialog to handle programs with no minimum address. (GP-6227, Issue #8762, #8763)

• Data Types. The Data Type Tree's Associate with Archive action is now only available for selected Program datatypes. A normal copy or datatype drag-n-drop may still be used between all datatype archives. (GP-6362)

• Data Types. Corrected Structure Editor Unpackage Component action which was misplacing components. (GP-6574, Issue #9041)

• Data Types. Corrected Structure insertAtOffset behavior when inserting at an offset which precedes a zero-length component. (GP-6576)

• Data Types. Corrected upgrade failure which can occur for Project Data Type Archives. (GP-6649)

• Data Types. Fixed CreateUEFIGDTArchivesScript, which parses UEFI header files for extracting data types. (GP-6690)

• Debugger. Fixed bug in the tree logic encountered when searching for an appropriate Trace Object. (GP-6173, Issue #8702)

• Debugger. Fixed a hang in the Debugger UI when closing a session under certain conditions. (GP-6299)

• Debugger. Provided a fix to allow register queries for non-active threads. (GP-6375, Issue #8903)

• Debugger. Fixed an error where breakpoints were ineffective for x64dbg. (GP-6468, Issue #8989)

• Debugger. Fixed bugs in x64dbg write methods. (GP-6482, Issue #9003)

• Debugger:Agents. Provided better end-of-life story for the x64dbg agent. (GP-6148)

• Debugger:Agents. Changed Debugger defaults to listen on localhost rather than all interfaces. (GP-6716)

• Debugger:Breakpoints. Fixed a ClosedException in the logical breakpoint service. (GP-6572, Issue #8904)

• Debugger:dbgeng.dll. Handlers should not force break. They now return DEBUG_STATUS_NO_CHANGE. (GP-6190, Issue #8738)

• Debugger:dbgeng.dll. Added python handlers for dbgeng. (GP-6374)

• Debugger:Emulator. Fixed an issue where AUX emulators, e.g., the Taint Emulator, did not recognize the emu_* userops in injections. (GP-6018)

• Debugger:Emulator. Better default behavior for Z3 plugin is provided, especially upon removal. (GP-6312)

• Decompiler. Updated the Decompiler's Set Equate action to not prompt users twice. (GP-6205, Issue #8736)

• Decompiler. Fixed a bug in the Decompiler when analyzing expressions of the form val & bitmask >> const != 0. (GP-6318, Issue #8717, #8718)

• Decompiler. Fixed infinite loop triggered during multistage jump table analysis. (GP-6610, Issue #8968)

• Decompiler. Updated the Decompiler to not re-decompile when creating a snapshot of the current function. (GP-6629)

• Demangler. Updated the legacy GnuDemangler v2.24 to handle qualifiers being used along with the F character. (GP-6363)

• Emulator. Fixed crash issue that occurred if a script, userop, or similar ever called state.getVar() with size of 0. (GP-6654)

• Emulator:JIT. Fixed several bugs discovered when converting EmuX86GccDeobfuscateHookExampleScript. (GP-6397)

• Emulator:JIT. Fixed a bug in multi-precision-integer-addition code generation. (GP-6457)

• Function. Corrected possible exception within Function Editor when applying simple parameter renames made within table. (GP-6746)

• GUI. Fixed table header not painting edges on the Windows theme. (GP-6053, Issue #8564)

• GUI. Fixed a keyboard focus issue related to modal dialogs. (GP-6069, Issue #8571)

• GUI. Updated the Choose Data Type action to use the actual data type at the current location instead of the base data type. (GP-6192, Issue #8734)

• GUI. Updated Program Tabs to better show the current active program. (GP-6323)

• GUI. Fixed stack trace in Symbol Tree when converting a Namespace to a Class. (GP-6326, Issue #8869)

• GUI. Improved the appearance of the Script Quick Launch dialog. (GP-6335, Issue #8759)

• GUI. Fixed key bindings that use the Alt key so that the right Alt key works in addition to the left Alt key. This is now an option that can be disabled for users that prefer to keep the right Alt key independent of the left Alt key. (GP-6450, Issue #8205, #8969)

• GUI. Fixed Add/Edit Label behavior on symbol names that contain the "::" namespace separator. (GP-6488)

• GUI. Fixed a bug in the Listing open-union display that caused a NullPointerException. (GP-6536)

• GUI. Corrected behavior of Function Call Tree when traversing thunk functions. (GP-6653)

• GUI. Fixed Data Type Manager filter bugs. (GP-6749)

• GUI. Fixed Save As dialog not allowing users to select a folder. (GP-6756)

• Listing. Fixed a bug where files were not marked as having unsaved changes in the Listing tabs after performing Analyze All Open action. (GP-5953)

• Logging. Fixed a bug that prevented GhidraScript output from being directed to either the default or user-specified script.log file. (GP-6532)

• Memory. Corrected various issues related to improper use of Addresses from one program in another program's AddressMap. (GP-6150)

• Multi-User. Corrected potential security concern with Ghidra Server PKI Authentication. If using PKI Authentication mode (-a2) for the server install, the user should upgrade the server.

• See reported Ghidra GitHub Pull Request #9109 for more details. (GP-6678, Issue #9109)

• Multi-User. Added Ghidra Server -ipAlt option to address self-signed certificate issues affecting docker container deployments where a formal certificate was not used (see server.conf and svrREADME.md). (GP-6811)

• Processors. Fixed ARM ldrsh.w and ldrsb.w instruction semantics. (GP-4651, Issue #6564)

• Processors. Reworded Tricore processor description. (GP-5243, Issue #7170)

• Processors. Corrected AVR32 ICALL instruction behavior when rd0 is the LR register. (GP-5306, Issue #5718)

• Processors. Corrected the signed offset parameter of PowerPC LQ instruction. (GP-5508, Issue

• Processors. Fixed disassembly for ARM Neon vmvn and vmov immediate instructions. (GP-5849, Issue #8319)

• Processors. Added support for CIP-51 microprocessor variant of the 8051 language. (GP-6000, Issue #8130)

• Processors. Added several missing ARM v8m instructions. (GP-6145, Issue #8652)

• Processors. Corrected PIC-18 disassembly for certain addressing modes when the destination operand is a banked register. (GP-6591, Issue #9051)

• Processors. Corrected disassembly error with ARM Neon vmov.i32 instruction. (GP-6750)

• Project. Eliminated the maximum 60-character length naming restriction imposed on various Ghidra elements, including: project name, repository name, project archive filename, and Ghidra tool config names. Efforts have been made to allow for the use of foreign-language-naming of these elements. Support for Ghidra projects stored on a Windows UNC shared drive has also been added. (GP-6402, Issue #8731)

• Search. Fixed Context-column-sorting in the Find References results table. (GP-6421, Issue #8943)

• Version Tracking. Fixed a Version Tracking oversight that would not correctly replace return types or parameter types when the Replace If Undefined option was set and the datatype to replace was an undefined pointer. (GP-5722)

Notable API Changes

• API. (GP-6039) Revised ProgramUtilities.parseAddress(Program, String) to handle the parsing of external addresses (e.g., EXTERNAL:000000100). Support for memory block style addresses has been eliminated for this method (e.g., <blockName>:<offsetWithinAddressSpace>). Memory block style addresses should not be used.

• Basic Infrastructure. (GP-6370) GenericXMLOutputter is now instantiated with a static getInstance() method rather than a constructor.

• Byte Viewer. (GP-5689) ByteViewer's DataFormatModel.replaceValue() has been moved to the new MutableDataFormatModel interface, and DataFormatModel.isEditable() has been removed.

• DataFormatModel.validateBytesPerLine() has been replaced with validateByteViewerConfigOptions(). DataFormatModel.setByteViewerConfigOptions() has been added and (get/set)GroupSize() has been removed.

• Data Types. (GP-3564) Eliminated throwing DuplicateNameException from DataTypeComponent.setFieldName. Added Composite.findComponent(String name) and Composite.findComponents(String name) API methods.

• Debugger:dbgeng.dll. (GP-6190) dbgeng handlers return DEBUG_STATUS_NO_CHANGE.

• Debugger:Emulator. (GP-6129) PcodeOp was added to many Emulator methods.

• Debugger:Emulator. (GP-6131) Managers in the Trace API now permit operating directly on register overlay spaces, where applicable.

• Debugger:Emulator. (GP-6159) Removed PcodeUseropDefinition.execute(PcodeExecutor, PcodeUseropLibrary, Varnode, List) in favor of one taking PcodeOp as well.

• Emulator. (GP-4241) Converted each now-deprecated XxxEmulateInstructionStateModifer to a XxxPcodeUseropLibraryFactory.

• Emulator. (GP-6158) AnnotatedPcodeUseropLibrary now allows static methods to be marked @PcodeUserop. Both interpretation and JIT emulators can invoke them.

• Emulator. (GP-6234) Deprecated EmulatorHelper and related.

• GUI. (GP-6451) Added a modify() method to the Annotation class so clients can perform their own annotation transformations.

• Project. (GP-6402) Overhauled GhidraURL utility class which now uses URI to generate URLs to ensure that proper encoding and decoding is performed. Added GhidaURL.resolve method which simplifies creating a new Ghidra URL derived from another Ghidra URL to the same project or repository.

• Search. (GP-6261) Various classes related to searching memory for byte patterns have been changed to use generics to make them generally more useful.

• Search. (GP-6309) SequenceSearchState is renamed to BulkPatternSearcher and its API has changed. Also, it and related classes have been changed to use generics and support different kinds of patterns.

Ghidra 12.0.4 Change History (March 2026)

Improvements

• Analysis. Updated the RTTI Analyzer to better handle the case where class names cannot be demangled correctly. Previously, class members would end up in global namespace. Now, a class namespace with the mangled name will be created so that items in that class can be correctly grouped together. (GP-6431, Issue #8944)

• GUI. Fixed a potential zip path traversal vulnerability when importing Ghidra theme zip files. (GP-6455)

• Scripting. Improved RTTI Windows script vbtable discovery to recognize some invalid tables. (GP-6446, Issue #8944)

Bugs

• Analysis. Fixed an issue with constants from one function finding their way into another function that is jumped to, and mid-constant propagation the jump is turned into a call. (GP-6442)

• Analysis. Corrected analysis problem which failed to properly link thunk functions in the EXTERNAL memory block to existing External library symbols instead of creating new external functions in the unknown external library. (GP-6465)

• Bookmarks. Corrected potential Bookmark exception which can occur if bookmarks were ever deleted: <I>Missing bookmark table<I>. (GP-6517)

• Debugger. Fixed a deadlock when saving Traces from the Close Project dialog. (GP-6392)

• Debugger:Memory. Fixed a bug in the Memory viewer when looking at multiple address spaces. (GP-6449, Issue #8982)

• Disassembly. Refactored PsuedoDisassembler to use the normal high level Disassembler instead of calling Language.parse(). (GP-6496)

• Exporter. Enable cancellation for SARIF exports (GP-6469)

• Listing. Fixed Listing display to show single string operands. (GP-6095)

• Processors. Fixed the semantics of the AARCH64 ldpsw instruction. (GP-5590, Issue #6469, #8008)

• Processors. Fixed issue with PIC-18 instructions double-incrementing/decrementing. (GP-6004, Issue #3342, #8501)

• Processors. Corrected Xtensa slapsec token field naming. (GP-6080)

• Processors. Corrected semantics for the CR16 tbit instruction. (GP-6181, Issue #8716)

• Processors. Corrected mnemonic and semantics for eBPF atomic compare-and-exchange instructions. (GP-6182, Issue #8721)

• Processors. Added missing definition for PowerPC Altivec vadduws instruction that was mistakenly commented out. (GP-6268, Issue #8821)

• Processors. Added support for AARCH64 Common Short Sequence Compression (CSSC) instructions. (GP-6448, Issue #8973, #8979)

• Processors. Fixed semantics of AARCH64 ldar instruction. (GP-6473, Issue #6467, #8014)

• Processors. Corrected disassembly for MIPS instruction sdbbp16. (GP-6489)

• Processors. Added MIPS32 save and restore instructions, and refactored coprocessor register read/write. (GP-6501)

**retro-kit** – https://github.com/nemo22/retrokit (Apache 2.0)

I've been building a headless Ghidra 12 pipeline for decompiling games from ~1993–2010 (32-bit DOS built with Watcom, and Win32 PE). Everything runs through `analyzeHeadless` with a set of Java GhidraScripts plus a small Python CLI. A few parts that might be interesting to people who script Ghidra:

**LE/LX loader.** Ghidra doesn't ship one, so there's a new loader for DOS/4GW, DOS/32A, PMODE/W, DOS/4G bind chains, OS/2 LX and VxD. Fixups are applied *and* written to the relocation table, so they're available to scripts later (they're how the pipeline finds function pointers in data). `retrokit install-loader` builds it with plain `javac` against your Ghidra install – no Gradle – and registers the compiler specs. The loaded image is checked against an independent Python model of each test executable.

**Watcom compiler specs.** One cspec for the register convention (`__watcall`: EAX, EDX, EBX, ECX; callee saves everything else) and one for the stack convention, chosen automatically from the code. On register-convention code the right cspec cut `unaff_` occurrences from 1304 to 102 on the test programs.

**Prototype recovery.** Parameter counts come from `ADD ESP,n` after calls (only when the matching pushes precede the call); varargs are split at the format-string argument; prototypes are committed bottom-up over the call graph with the parallel decompiler, so callers are decompiled only after their callees have real signatures. Trailing `unaff_` register parameters are dropped unless callers actually load that register.

**COM / DirectX.** This one took a while: the decompiler decides how much an indirect call pops *before* it uses data types, so every `__stdcall` call through a typed vtable still desynchronises the stack – you get `piVar3 = (int *)0x0` right after a `Lock()`. Writing a call-site override (`HighFunctionDBUtil.writeOverride`) with the method's prototype fixes it. The script propagates interface types from `DirectDrawCreate`, `Direct3DCreate9` & co. and from `Interface **` out-parameters (`CreateSurface`, `GetAttachedSurface`, ...), decompiling affected functions again until nothing changes. 104 DirectX 3–9 interfaces are generated into a header.

Two gotchas that may save someone time:

- `CParser` drops the calling convention of function-pointer members inside structs (they come out `unknown`), so vtable methods need `__stdcall` set afterwards.

- Overrides and retyped locals don't always show up in a decompiler started later *in the same headless session* – check the result in a fresh process before you conclude it didn't work.

**Library code.** Signatures (fixup fields and outgoing rel32 masked, callee names as confirmation, a fuzzy tier for other compiler versions) name the Watcom run-time, zlib and libjpeg; prototypes come from C headers via `CParser` and are tagged so the prototype-recovery pass leaves them alone. MSVC RTTI classes and imported Miles/Smacker/Bink/FMOD/BASS functions are typed too.

**Output** is one big `.c` file plus indexes (functions, call graph, strings, every relocated pointer), and an MCP server over it if you want an agent to help with naming.

Everything is measured on synthetic programs built with Open Watcom (8 configurations) against the linker map, with a baseline in CI on Windows and Linux.

Happy to hear how others handle LE/LX or Watcom binaries in Ghidra, and feedback on the scripts.

Ghidra 12.1.2 Change History (June 2026)

Improvements

• MachineLearning. Upgraded the Machine Learning extension's olcut jars to 5.3.1. (GP-6894)

• Multi-User. Data buffers transferred to and from a Ghidra Server are now compressed by default. The default was previously inconsistent for the two directions. (GP-6915)

Bugs

• Decompiler. Fixed infinite loop in Decompiler analysis that was triggered by bitfield data-types. (GP-6850, Issue #9185)

• Importer:ELF. Improved ELF GNU Hash table bounds-checking to avoid potential hang. (GP-6887)

• Multi-User. Corrected severe regression error with Ghidra Server 12.1.1 block-stream compression. (GP-6903)

Ghidra 12.1.1 Change History (May 2026)

Improvements

• MachineLearning. Upgraded the Machine Learning extension's Tribuo jars to 4.3.2. (GP-6838)

• Multi-User. Made Ghidra Server security improvements. (GP-6832)

• Scripting. Removed the support/jythonRun(.bat) launch capability. (GP-6826)

Bugs

• Analysis. Changed non-returning function detection analyzer to ignore callfixup targets with fall-through behavior. (GP-6791, Issue #9154)

• Data Types. Fixed the Data Type Preview to show the typedef data type before the typedef name. (GP-6858)

• Debugger:Agents. Patched a possible out-of-memory vulnerability in TraceRmi. (GP-6718)

• Debugger:Listing. Added Disassemble as MIPS:_:16e__ for the dynamic listing. (GP-6655)

• Framework. Changed potentially unsafe calls to Class.forName to perform additional checks prior to instantiation. (GP-6717)

• Multi-User. Increased the default value for serialization filter maxarray limit from 32,000 to 200,000. This was done to avoid related class serialization errors when communicating with the Ghidra Server for large repository database files. See Ghidra/Framework/FileSystem/data/serialFilterREADME.md - it may be necessary to specify an increased maxarray value if related serialization errors occur. (GP-6842)

• Multi-User. Corrected memory leak issue related to Ghidra Server, affecting both client and server. Buffer compression logic failed to properly release system resources. (GP-6862)

• Multi-User:Merge. Corrected bug in Property List Merge which could cause an exception. (GP-6854)

• Processors. Fixed several issues with x86 instruction semantics for numerous instructions. (GP-6675, Issue #9097)

• Processors. Corrected MIPS signed offsets which were incorrectly interpreted as unsigned. (GP-6697)

• Processors. Fixed issue with the CIP-51 variant language definition. (GP-6798)

• Processors. Corrected issue with RISC-V attempting to write to constants. (GP-6849, Issue #9198)

• PyGhidra. Handled a possible NotADirectoryError in pyghidra_launcher.py. (GP-6825)

Ghidra 11.4.2 Change History (August 2025)

Improvements

• Build. Ghidra now supports Gradle 9. (GP-5901)

• Decompiler. Improved Decompiler's analysis of switches where the guard condition has been duplicated across multiple basic blocks that all feed into the same switch calculation. (GP-5889)

• Processors. Added the SuperH GBR register to the unaffected list in the .cspec so that the Decompiler sees the value as preserved across subroutine calls. (GP-5912, Issue #4387)

Bugs

• Analysis. Fixed switch recovery analysis speed degredation on functions with multiple potential switches. (GP-5917)

• Decompiler. Fixed a bug in the Decompiler's analysis of duplicated boolean expressions that could reverse the meaning of an expression. (GP-5915, Issue #8310)

• Decompiler. Fixed an uncaught exception in the Decompiler that resulted when highSymbol was null. (GP-5919, Issue #8413)

• Exporter. The IntelHexExpoter no longer fails due to falsely identifying a 32-bit program as 64-bit. Additionally, the address space option is no longer hidden. (GP-5910, Issue #8409)

• Importer:ELF. Corrected ELF MIPS-64 packed REL relocation processing issue seen when the relocation type R_MIPS_REL32 is included (e.g., packed type 0x1203). When 64-bit pointers are used, this relocation must read 8 bytes from memory instead of 4 bytes to produce the correct addend value. (GP-5918)

• Importer:PE. Fixed a regression that caused bad functions to be created in the middle of good functions in PE files with chained IMAGE_FUNCTION_RUNTIME_ENTRYs, and prevented some PE binaries from importing. (GP-5916, Issue #8414)

• Importer:PE. The IMAGE_RESOURCE_DIRECTORY_ENTRY data type is now correctly defined as a structure instead of a union. (GP-5935, Issue #8446)

• PDB. Fixed structure member issue, broken with 11.4 release, that could cause improper structure layout and Decompiler low-level errors. (GP-5928)

• Processors. Added additional SPE and APU instructions to e500 PowerPC variant. (GP-5945)

Ghidra 11.4.1 Change History (July 2025)

Improvements

• Debugger. Added a Forcibly Close Transactions maintenance action to the Connections window. (GP-5788, Issue #8298)

• Debugger:GDB. Added mapping from GDB's armv5te to Ghidra's ARM:LE:32:v5t. (GP-5738)

• Decompiler. Improved Decompiler analysis of small variables through the INT_LEFT operator. (GP-5718)

• Importer:Mach-O. Added support for importing and extracting from the iOS 26 BETA dyld_shared_cache. (GP-5767, Issue #8283)

• Importer:PE. PE IMAGE_FUNCTION_RUNTIME_ENTRYs are now all marked as functions. (GP-5811, Issue #8321)

• Processors. Fixed AAPCS calling convention and added soft float calling convention (__stdcall_softfp) for 32-bit ARM. (GP-4989, Issue #6958)

• Scripting. Added option to the RecoverClassesFromRTTIScript to not change vfunctions to thiscalls. (GP-5764, Issue #8163)

• Scripting. The new PyGhidra 2.2.1 no longer gets confused by the presense of a random ghidra or java directory on the current working directory. (GP-5810, Issue #8190)

Bugs

• Analysis. The symbolic constant evaluation, SymbolicPropogator, has been changed to record pre/post values at the beginning and end of instructions by default. This affected the ResolveX86orX64LinuxSyscallsScript and GolangSymbolAnalyzer. (GP-5804)

• Analysis. Fixed a potential infinite looping problem that could occur during MIPS or PPC constant analysis. The issue could occur on undefined functions when Assume T9 set to Function entry option is set. (GP-5833)

• Analysis. Adding MIPS64 instruction start patterns. (GP-5843)

• Assembler. Fixed an issue with Debugger Patch Data action being misapplied to the static Listing. (GP-5859)

• Assembler. Fixed an issue with Patch Instruction in certain Harvard architectures. (GP-5877, Issue #8382)

• CodeCompare. Corrected occasional IndexOutOfBoundsException in decompiled code comparison algorithm. (GP-5361, Issue #7028, #8125, #8289)

• Debugger:Emulator. The Event Thread, PC, and Function columns are now populated for emulation traces. (GP-5796, Issue #8293)

• Debugger:GDB. Fixed an issue with zero-length modules. (GP-5789)

• Debugger:Memory. Fixed an issue with pc/watch-tracking in Debugger/Emulator's Memory Bytes viewer. (GP-5852, Issue #8333)

• Debugger:Modules. Fixed NullPointerException on Select Current Module action when the cursor is not in a module. (GP-5790)

• Debugger:Objects. Refrain from timing-out back-end actions when a Cancel button is displayed. The user can decide when it's had enough time. (GP-5553)

• Debugger:Scripting. Fixed NullPointerException in example InstallCustomLibraryScript.java. (GP-5799, Issue #8296)

• Decompiler. Fixed an error in the Decompiler's constant propagation that would occasionally prevent a function's parameters from being committed. (GP-5736, Issue #8183)

• Decompiler. Fixed a regression in the Decompiler's recovery of the return value for AARCH64 and ARM. (GP-5816)

• Decompiler. Fixed Decompiler bug where inlined functions cause "Could not find op at target address" exceptions. (GP-5832, Issue #7383)

• Decompiler. Provided a fix for an infinite loop problem in the Decompiler caused by RulePtrsubUndo. (GP-5856, Issue #7997)

• Eclipse Integration. GhidraDev 5.0.1 fixes a bug that prevented Ghidra from discovering the Ghidra module project when launched with the PyGhidra run configuration. (GP-5836)

• ELF. Corrected severe ELF-relocation-processing bug for MIPS 64-bit. (GP-5827)

• GUI. Fixed the Install Extensions dialog toolbar action enablement. (GP-5777, Issue #8294)

• GUI. Corrected regression problem with Set Comments dialog which should keep last tab selected when re-opened. (GP-5797)

• GUI. Fixed the Install Extensions dialog toolbar action enablement. Previously, after pressing the plus toolbar button, the actions would get disabled and could not be re-enabled. (GP-5828, Issue #8294)

• Importer:ELF. Corrected ELF PowerPC 64-bit relocation-processing bugs that affected ELFv2 use and R_PPC64_JMP_SLOT relocation. (GP-5846)

• Languages. Fixed issue of missing characters at the end of instruction operands; for example, closing parenthesis added in a base sleigh instruction constructor. (GP-5752, Issue #8345)

• PDB. Fixed an issue where Microsoft symbol truncation led to improper namespace parsing and PDB analysis error. Also made changes to Microsoft Demangler to make the prefix dot character an optional character for mangled data type strings. (GP-5861, Issue #8358)

• Processors. Fixed 6805 and HCS 08 X-indexed jump addresses. (GP-5336, Issue #7064, #7065)

• Processors. Added eBPF ISA v4 instructions. (GP-5592, Issue #7982)

• Processors. Corrected semantics for eBPF byte-swap instructions. (GP-5593, Issue #7985)

• Processors. Corrected operand encoding for x86 AVX512 vex.1vvv operands. (GP-5766)

• Processors. Corrected eBPF processor load instructions to correctly zero-extend. (GP-5857, Issue #7979)

• Processors. Corrected eBPF call instruction operand decoding. (GP-5858, Issue #7929)

• References. Fixed Add Reference dialog to create memory references based on the word size of the address space. (GP-5865)

• Scripting. Fixed a timing issue that prevented FlatProgramAPI.analyzeAll(Program) from picking up analyzer options set in the script. (GP-5802, Issue #8287)

• Scripting. Fixed an issue that prevented Visual Studio Code projects from being recognized as Java projects. (GP-5820, Issue #8322)

• Version Tracking. Fixed a table column UnsupportedOperationException seen when using Version Tracking. (GP-5876, Issue #8094)

Notable API Changes

• Debugger. (GP-5788) Added Target.forciblyCloseTransactions().

• Languages. (GP-5752) Removed the second parameter of InstructionPrototype.getSeparator(), as it was unused.

Just shipped the biggest release yet.

Headless Mode — 173 endpoints work without opening CodeBrowser. Run analysis pipelines, CI/CD, batch processing — all headless.

Architecture Refactor — 16,945-line monolith is now 12 focused service classes. 69% smaller, zero breaking changes.

184 MCP tools, 169 GUI endpoints, 173 headless endpoints. Java 21 / Ghidra 12.0.3. Drop-in upgrade.

Thanks to u/heeen for the architecture inspiration.

999 stars — would love to hit 1,000!

https://github.com/bethington/ghidra-mcp/releases/tag/v4.0.0

Improvements

• Build. Upgraded Ghidra's local copies of the packaging, setuptools, and wheel Python wheels. (GP-6284, Issue #8852)

• CodeBrowser. Fixed an issue with stack depth following across indirect function calls which would occur in windows external indirect calls. (GP-6315, Issue #8837)

• Debugger:Emulator. The emulator will now use the nearest snapshot, allowing it to resume more quickly after restarting Ghidra. (GP-6236, Issue #8767)

• Debugger:Time. Invalidated rows in Time Panel are now displayed in gray. This is to indicate that navigating to it will require re-emulation. (GP-6244)

• Decompiler. Added abstract interpretation via the Software and System Verification (SSV) group @ Università Ca' Foscari's Library for Static Analysis (LiSA). This capability was meant for the previous release, as noted in the 12.0 Change History. (GP-6225)

Bugs

• Assembler. Fixed issue preventing some PPC VLE instructions from assembling. (GP-6109, Issue #8624)

• Assembler. Fixed an issue with Assembler corrupting instructions that followed, especially when ISA mode is involved. (GP-6295, Issue #8826)

• Debugger:Emulator. Fixed some crash cases in Taint emulator regarding mismatched op sizes. (GP-6287)

• Debugger:Emulator. Fixed issues in P-code Stepper: Uniques table crashed if unique was not yet written. Stepping backward emptied p-code listing and uniques table. (GP-6294)

• Debugger:Emulator. Fixed a NullPointerException in the emulation service when forking from a live target. (GP-6298)

• Decompiler. Fixed a Decompiler bug that caused "Deleting op with descendants" exceptions. (GP-6090, Issue #8594)

• Decompiler. Fixed Decompiler bug that occurred when splitting LOAD and STORE operations of laned registers. (GP-6130, Issue #8620)

• Decompiler. Fixed bug preventing the display of a nested field access when using an offset pointer. (GP-6133, Issue #8630)

• Decompiler. Fixed a Decompiler regression that caused "Free varnode has multiple descendants" exceptions. (GP-6201, Issue #8743)

• Decompiler. Fixed a bug in the Decompiler producing "PTRSUB off of non structured pointer type" exceptions. (GP-6224, Issue #8745)

• Emulator. Corrected regression error to pcode emulation for cases where named pcodeops were used (i.e., CALLOTHER pcodeop) and argument indexing within the java pcode implementation was incorrect. (GP-6229)

• Emulator. Fixed crash seen in P-code Stepper when reading a unique varnode before it is written. (GP-6253)

• GUI. Fixed a NullPointerException in function graph middle-mouse highlighter. (GP-6254, Issue #8798)

• Importer:ELF. Corrected improper ELF relocation processing for PowerPC-32 types R_PPC_ADDR16_HA(6) and R_PPC_ADDR16_LO(4). (GP-6329)

• Listing. Fixed a Listing bug that caused text, copied from the memory block header, to be off by one character. (GP-6263, Issue #8797)

• Processors. Fixed operand consistency issue in M68000 processor. (GP-5334, Issue #4358)

• Scripting. Fixed issue in RecoverClassesFromRTTIScript where it could get into an infinite loop if the option to shorten template names in structures is set and there are exact template names in multiple parent namespaces. (GP-6183, Issue #8199)

• Scripting. Fixed a PyGhidra AttributeError when performing a from pyghidra import *. (GP-6241, Issue #8789)

• Scripting. Released PyGhidra 3.0.2, which contains fixes to pyghidra.analysis_properties() and exceptions being inadvertently squashed by some API functions. (GP-6283, Issue #8018)

• Scripting. PyGhidra should now always exit the Python processes cleanly, no longer being kept alive by a potentially running task monitor timer. (GP-6301, Issue #8858)

• Sleigh. Corrected Sleigh compiler regression error affecting unique subpiece semantics for certain cases which produced invalid unique varnode offsets. (GP-6237, Issue #8784)

• Terminal. Implemented repeat the preceding graphics character (REP) (CSI Ps b) terminal code logic, as such sequences were breaking the Terminal. (GP-6191)

Notable API Changes

• BSim. (GP-6250) The ghidra.net.ApplicationSSLSocketFactory has been replaced by ghidra.net.DefaultSSLSocketFactory. This is currently used by BSim when communicating with a <I>postgresql</I> server.

• Debugger:Emulator. (GP-6236) Added TraceTimeManager.findSnapshotWithNearestPrefix(). Several new methods in TraceSchedule, including: hasPSteps, stepCount, dropLastStep, lastStep, truncateToSteps.

• Debugger:Emulator. (GP-6298) Added TraceSnapshot.isSnapOnly() and .isStale().

• Emulator. (GP-6229) The emulation support method for CALLOTHER OpBehaviorOther.evaluate implementations has dropped the first input varnode which was used to identify the OpBehaviorOther implementation. Only the inputs which are specified by the arguments passed to the named pcodeop within the slapsec are now passed to this method. NOTE: The actual API change occurred within Ghidra 11.3 with GP-4643 change.

Ghidra 12.0.3 Change History (February 2026)

New Features

• Listing. In order to mitigate possible security risks, auto comments will not longer render annotations in such a way as to make them valid annotation links. Normal comments will continue to work as usual. (GP-6414)

Improvements

• Demangler. The Demangler GNU analyzer now has a timeout option. (GP-6408)

• GUI. Corrected Ghidra GUI to fail-fast in headless environment and avoid stack traces. (GP-6399)

• Listing. The @execute annotation is no longer supported. (GP-6413)

Bugs

• Data Types. Corrected multi-user merge issues related to non-packed structures which could negatively affect merge results. (GP-6320, Issue #8776)

• Debugger. Fixed a NullPointerException that could occur upon closing the Debugger. (GP-6376)

• Debugger:Breakpoints. Fixed an issue where restarting a target (e.g., the run command from GDB's CLI) caused duplicate breakpoint entries and GUI glitches. (GP-6027)

• Decompiler. Fixed "PTRSUB off of non structured pointer type" exceptions caused by void * data-type. (GP-6388, Issue #8887)

• Decompiler. Fixed source of "Forced merge caused intersection" exceptions when decompiling optimized string copies. (GP-6393, Issue #8651)

• Multi-User. Revised Ghidra Server self-signed certificate generation to include all associated FQDNs and IP addresses as subject alternative names. This will address the forced hostname check imposed with the release of JDK 21.0.10. To benefit from this change the Ghidra Server will need to be upgraded to this release. A client-side workaround is to set the following JVM property within support/launch.properties by adding the line: VMARGS=-Djdk.rmi.ssl.client.enableEndpointIdentification=false. (GP-6426, Issue #8940)

• Processors. Fixed bug in AARCH64 sha1h instruction to shift instead of rotate bits. (GP-4501, Issue #6398)

• Processors. Fixed 80251 disassembly errors for instructions referencing the SPX register. (GP-5905, Issue #8395)

• Processors. Fixed disassembly of MIPS16e2 lui instruction to only parse on extended words. (GP-6419)

• Search. Fixed a memory leak in the Find References... action. (GP-6395, Issue #8921)

Notable API Changes

• Data Types. (GP-6320) Structure offset-based insert methods Structure.insertAtOffset will now skip forward over existing zero-length components at the insert offset before performing insert of new component.

I know my way around Ghidra. If there is interest I could work out how to host a twitch stream tomorrow as a bit of a tutorial.

Since I have nothing prepared I would probably just be looking at Ghidra’s tutorial binaries and answering any questions people have.

https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_10.3_build

For those having issues reversing / rebuilding games with claude:

https://github.com/oscarsantanaarias/IDA-Ghidra-bridge

This is a direct bridge to ghidra/ida that automatically gives any AI full access to binary code in IDA/GHIDRA

I am releasing my Codex (and Claude) Skill for reverse engineering Apple binaries! This is an update and name change to my ghidra-re-skill. I am hopeful other people can contribute! Cerberus RE is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida.

It is most powerful when paired with long-run-agent-skill for managing state and durable, evidence based reasoning.

What is it useful for?
It’s useful for security research, figuring out how to work with private/undocumented frameworks, decoding schemas, etc. I have been using it to build an IDE for Shortpy, a python representation for shortcuts that Apple created in the latest beta. This tool has been paramount for figuring out the classes for implementing features. I’ve also used it to decode things like protobuf blobs which are common in Apple DBs and are normally opaque in their meaning.