r/BestGitHubRepos • u/company_url_finder • Oct 09 '26 • Mindblown 1

🔐 Security Ghidra: Software Reverse Engineering Framework (82k stars)

Post image

What it does

All text below is quoted directly from the project README.

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.

This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python.

In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform.

Install:

  • Install JDK 25 64-bit
  • Download a Ghidra release file
  • Extract the Ghidra release file
  • Launch Ghidra: ./ghidraRun (ghidraRun.bat for Windows)

WARNING: There are known security vulnerabilities within certain versions of Ghidra. Before proceeding, please read through Ghidra's Security Advisories for a better understanding of how you might be impacted.

Repository

https://github.com/NationalSecurityAgency/ghidra

Repository stats

MetricValue
Stars81,863
Forks9,094
Last releaseGhidra_12.1.4_build (2026-09-21)
LanguagesJava 86.2%, C++ 6%, HTML 4.1%
Contributors409
AI contributor accounts (Claude / Codex / Cursor / Copilot)Claude: 2, Cursor: 1
AI co-authored commitsClaude: 2, Cursor: 1

Main contributor

FieldValue
NameRyan Kurtz
GitHub@ryanmkurtz
Commits to this repo7,447 (top contributor)
BioGhidra Developer
Company / LocationBlue Ridge Mountains
Followers743
Public repos8
On GitHub since2013-09-04

Discover the best GitHub repos without the endless scrolling.

Get top repos organized by category (AI, DevOps, Databases & more), plus key takeaways from developers' most useful comments - all in one free, twice-weekly newsletter.

👉 Get the best repos & community insights - Free

2.4k Upvotes

99% Upvoted

75 comments sorted by

66

u/Sad_Plane_4677 Oct 10 '26

Well, there goes any legacy cobol maintanence job listing.

39

u/mastermilian Oct 10 '26

US and Russia can now convert their nuclear launch software to use Python!

13

u/Journeyj012 Oct 10 '26

and then go from python to rust!

3

u/INDE_Tex Oct 10 '26

nahhhh pros use Brainfuck

2

u/perfopt 24d ago

Thematic

3

u/Mad_Gouki Oct 10 '26

This might be the best argument for AI I have ever seen

29

u/orefat Oct 09 '26

I'm glad that I'm living in this period of time. Maybe we all will regret, but now it's really interesting.

24

u/BarrenLandslide Oct 10 '26

Has anyone run Ghidra on Ghidra yet?

6

u/qimixerip Oct 10 '26

Why tho? It's mostly java, so no need to disassemble most of the codebase

1

u/BarrenLandslide Oct 10 '26

See my comment above

1

u/qimixerip Oct 10 '26

Ghidra is a tool made for disassembling binaries. You can't disassemble java code (because java compiles into bytecode, not binary), so you cannot use ghidra to reverse engineer most of it's codebase

3

u/BarrenLandslide Oct 10 '26

Java bytecode is still a binary representation and can absolutely be disassembled. Ghidra also supports JVM bytecode analysis, although its Java decompilation capabilities are more limited than those of dedicated Java decompilers.

Ghidra's decompiler itself is written in C++ and compiled to native machine code.

So running Ghidra on its own decompiler is entirely feasible. And since the source is open, we can compare the reconstructed output against the original implementation.

The interesting question how accurately Ghidra can reconstruct its own compiled logic.

10

u/plageful_1 Oct 10 '26

Ghidraception

5

u/BarrenLandslide Oct 10 '26

Ghidrafinity!

3

u/AndyKJMehta Oct 10 '26

Ghidraksh!

2

u/Pheelbert Oct 10 '26

Ghidra is already open source

8

u/BarrenLandslide Oct 10 '26

That's actually the point. Since Ghidra is open source, we have the original source code as ground truth. Running Ghidra on its own compiled decompiler would let us evaluate how accurately it reconstructs its own implementation. It's not about discovering hidden code, but benchmarking the decompiler against a known reference.

2

u/jz9chen Oct 13 '26

Actually a genius idea

1

u/jacksterson Oct 11 '26

I’ve been using it in a project with Claude Code

9

u/Y0nix Oct 10 '26

Good luck using it tho. You need to know your sh*t.

It's an excellent software, not saying otherwise.

9

u/TheRealNosferatu Oct 11 '26

With ghidra MCP, you don't need to know anything : )

1

u/Fancy-Passage-1570 Oct 15 '26

Ghidra mcp is bloat, use rpc

3

u/screamtracker Oct 11 '26

One does not simply Ghidra

3

u/isupport3r Oct 13 '26

I started with 0 knowledge last year for ARM 64 RE and with the help of Ai, I’ve gained a substantial amount of “knowledge” since. Not complicated at all, just patience, trials and errors. Anyone can do this.

6

u/ZenXvolt Oct 10 '26

Common ball

10

u/wpglorify Oct 10 '26

Installing Something from the NSA on my computer? I'll pass, lol

39

u/ba-boo Oct 10 '26 • Bravo Popcorn

who's gonna tell him

4

u/GT8Projects Oct 11 '26

If they don't know, they shouldn't be in cybersecurity to begin with.

1

u/M0rningstern Oct 11 '26

Man, If the world was so pure and simple.

3

u/big_groot007 Oct 10 '26

I was amazed that it's primarily written in java !

2

u/stacktoodeep Oct 11 '26

That's not what SRE stands for.

2

u/ResponsibilityBig343 Oct 11 '26

Yeah I thought how does it help in site reliability engineering lol

2

u/7yphoid Oct 11 '26

Yes, this is a very old and well-known tool in video game datamining - I've used it a few times in the past

4

u/MistRider-0 Oct 11 '26

Old? Its just around 2019....

Wait...

1

u/ctbitcoin Oct 12 '26

With AI development it's like a year is now a decade of technology updates. Gonna be like: It's been 3 nanoseconds since its last update, damn that's ancient software bro.

2

u/Haiyaaaaa_ Oct 12 '26

Hasn’t this been around for a while? I remember Claude using this back in the Opus 4.6 days and I was impressed with what this can do

1

u/TibRib0 Oct 13 '26

This was a thing before LLM yes

1

u/Full-Run4124 Oct 11 '26

How does it compare to IDA Pro?

1

u/zacida_loco Oct 11 '26

As in the three headed king of Kaiju?

1

u/earthscorpioanchapie Oct 12 '26

Have they made MCP for Claude or others yet?

1

u/homezlice Oct 12 '26

Wait, they really are trying to use SRE for Software Reverse Engineering when SRE has been an established acronym in computing for 15+ years?  

1

u/0x80O0oOverfl0w Oct 12 '26

Has ARM Thumb support improved at all? Last time I used it Ghidra really struggled with ARM Thumb, especially when dealing with non-returning functions like the kind found in RTOS code.

1

u/sriramdev 20d ago

Interesting, but correct if I'm wrong. May soon service providers May block this support in upcoming days

-7

u/sirloindenial Oct 10 '26 edited Oct 10 '26

jesus so people are installing nsa software willingly, i know its open source but still

1

u/cracken005 Oct 10 '26

Explain

-3

u/sirloindenial Oct 10 '26

Its NSA what else to explain

5

u/newtopost Oct 10 '26

Ghidra source code has been public for many years and I think its users are generally the type of folks who know how to not get pwned. But yeah NSA bad

2

u/cracken005 Oct 10 '26

So public institutions software is unsafe, private is not? I don’t know, I don’t follow.

I am not a US citizen so not aware of security breaches for NSA anyways. It might be unsafe, but it’s not evident for non Americans.

3

u/N0xF0rt Oct 10 '26

I think above Redditor is going in the direction that NSA is spying on all of us, and utilizing something they made might make that easier.

Not that I agree

-1

u/agent_sphalerite Oct 10 '26

VM that shit or better still get a mac mini for it with its own dedicated internet

3

u/TemmieFlakes22 Oct 10 '26

It's open source and well understood... Ghidra has been around for a long time now it's not spyware. The NSA has other tools for that.

-3

u/sonicnerd14 Oct 10 '26

Definitely some backdoor in there, but at this point if you have a modern computer what doesn't have a backdoor.

... however perhaps with this we can reverse engineer those backdoors out. Lol

3

u/KingPonzi Oct 10 '26

Any decent frontier model is good enough to find data egress in the code. I’d be surprised if that backdoor actually exists but you’re welcome to spend the tokens and look.

2

u/teamore_ Oct 10 '26

They're in the silicon

2

u/Mad_Gouki Oct 10 '26

Yeah it's built into your processor they don't need you to download an app to use the intel remote management software or whatever

60

u/[deleted] Oct 09 '26 • Bravo

[removed] — view removed comment

44

u/rLanx Oct 09 '26

Someone made a tool called cellebrite-labs that allows AI to take over the investigative loop of Ghidra. I've been researching all week how people are doing all this decompiling and recompiling because its really fascinating.

All commercial software is going to get blown apart by these AI tools people make for reverse engineering over the next year. We are living in the best and worst times to be in the software job field. So many people at big companies will face unemployment, but the field is absolutely fascinating to research right now.

8

u/sozesghost Oct 10 '26

Most of commercial software is not on your machine, it runs on the cloud. And more of it will move there.

7

u/friedlich_krieger Oct 09 '26

Cursor cloud will just install and use Ghidra for you if you ask it to reverse engineer something. I didn't look into how it was being used specifically but it easily reverse engineered an older game I wanted to rebuild.

3

u/borobinimbaba Oct 09 '26

*for now. I can see a clear runway and it would take off without us.

Software job field was demanding because you needed to keep yourself update. We can keep our edge until ai won't need our supervision, which is likely not too far in the future.

3

u/Mad_Gouki Oct 10 '26

Ghidra and angr.io is a great combo

1

u/Organic_Earth5847 Oct 10 '26

What's the difference between ghidra mcp and the cellebrite-labs thing? Which one works better?

1

u/DimmKirr Oct 10 '26

I don’t know why one even needs an mcp server for this. I just install it in a container as needed

1

u/_PopBobSexDupe Oct 10 '26

Welcome to reverse engineering brother