security enabled verified low v1.0.0

ghidra

NSA's reverse engineering framework with disassembly, decompilation, debugging, and scriptable analysis.

📋 Live Preview 
ghidra
ghidra

Sandbox: execFile · Timeout: 3600s

Capabilities

reverse.disassembly
reverse.decompilation
reverse.debugging
reverse.analysis
reverse.scripting

Parameters

Name Type Required Default Description Aliases
import string No - Import a binary file into a new project -import
process string No - Process a specific program in an existing project -process
analysisTimeoutPerFile integer No - Timeout in seconds for analysis per file -analysisTimeoutPerFile
recursive boolean No - Recursively import files in directories -recursive
readOnly boolean No - Open project in read-only mode -readOnly
preScript string No - Script to run before analysis -preScript
postScript string No - Script to run after analysis -postScript
scriptPath string No - Path to script directories -scriptPath
propertiesPath string No - Path to project properties file -propertiesPath
maxMemory string No - Maximum memory for the JVM (e.g. 4G) -maxMemory
ghidraRun string No - Path to the ghidraRun script (launcher) ghidraRun
ghidraHeadless string No - Path to the headless analyzer script ghidraHeadless

Contract

Inputs

file.binary

Binary file for analysis

Outputs

analysis.decompiled

Decompiled source code

analysis.disassembly

Disassembled instruction listing

Side effects: filesystem_writeprocess_spawn

Workflow Edges

Produces

analysis.decompiledanalysis.disassembly

Consumes

file.binary

Resource Profile

ResourceValue
CPUhigh
Memory4096 MB
Networklow
Disk I/Ohigh

Examples

Launch Ghidra GUI

ghidra

Headless import and analyze a binary

ghidraHeadless /tmp/project TestProject -import /bin/ls -analysisTimeoutPerFile 300

Headless analysis with pre and post scripts

ghidraHeadless /tmp/project TestProject -process /bin/ls -preScript PreScript.java -postScript PostScript.java -scriptPath /scripts

Recursive import with read-only mode

ghidraHeadless /tmp/project TestProject -recursive -readOnly -import /firmware/dir

Run with custom memory limit

ghidra -maxMemory 8G

Documentation

Ghidra — NSA Reverse Engineering Framework

Ghidra is a full-featured reverse engineering platform developed by the NSA. It provides disassembly, decompilation, debugging, and scriptable program analysis capabilities with support for multiple processor architectures and file formats.

Key Features

  • Decompiler: Converts assembly to pseudo-C for easier analysis
  • Multi-architecture: x86, ARM, MIPS, PowerPC, RISC-V, and many more
  • Scriptable: Python and Java scripting APIs for automation
  • Collaborative: Multi-user project support for team analysis
  • Headless mode: Automated batch analysis without GUI

Modes

Mode Command Description
GUI ghidra Launch the graphical interface
Headless ghidraHeadless <project> <name> -import <file> Batch analysis without GUI
Scripting ghidraHeadless ... -preScript <script> Automated script execution

Common Headless Workflow

# Create project and import binary
ghidraHeadless /tmp/proj MyProject -import target.bin

# Analyze with custom scripts
ghidraHeadless /tmp/proj MyProject -process target.bin -preScript analyze.py

Related Tools

radare2cuttergdbida