← All reportsPublic report

nationalsecurityagency/ghidra

Ghidra is a software reverse engineering (SRE) framework

73k stars Java View on GitHubprofiled 11d ago
Try GitZoid
204PRs this week
27Contributors
0Deps scanned
0Issues found
01 · Repo overview

How ghidra is put together

Ghidra is the NSA's open-source reverse-engineering platform, built as a large multi-module Java desktop application orchestrated by Gradle. The repository is organized into top-level trees: 'GPL' (GPL-licensed companion tools such as the DMG disk-image handler, GNU demangler native executables, and GNU disassembler extension), 'Ghidra' (core features, Debug/Debugger framework and agents, runtime launch scripts, extensions, configurations), and 'GhidraBuild' (shared build files). Data flow centers on importing binary programs into Ghidra projects, analyzing them via plugins/scripts (e.g., AppleSingleDouble analysis commands, SLEIGH language queries), and debugging live targets through agent modules that bridge to gdb, lldb, dbgeng, drgn, x64dbg, and JPDA. Native C components (demanglers, gdis built from binutils) are compiled per-platform via Gradle native plugin models.

Languages

JavaCGradle (Groovy DSL)SleighShell

Frameworks

Gradle multi-project buildEclipse IDE integration (eclipse plugin)Swing-based Ghidra tooling API (implied by GhidraScript/services usage)

Infrastructure

Cross-platform native builds (win/linux/mac/freebsd/openbsd x86_64 & arm_64)Extension packaging/distribution via assembleDistributionLaunchers: ghidraRun / ghidraRun.bat

Major components

GPL/DMG

Standalone DMG (Apple disk image) handling application executed from Ghidra, built against bundled hfsx/hfsx_dmglib/csframework jars.

GPL/DemanglerGnu

Native C executables demangler_gnu_v2_41 and demangler_gnu_v2_24 built for ten target platforms to demangle GNU symbols.

GPL/GnuDisassembler

Distributable GPL extension building the gdis executable from binutils 2.41 sources.

Ghidra/Debug (Debugger framework)

Debugger core, trace modeling, taint analysis, ISF/DAP support, and per-target agents (gdb, lldb, dbgeng, drgn, x64dbg, jpda) plus rmi-trace scripting.

Ghidra/Features/Base

Core feature module hosting example and utility GhidraScripts such as binary format analysis commands and SLEIGH language API demos.

Ghidra/RuntimeScripts

Runtime launch infrastructure: ghidraRun/ghidraRun.bat, support scripts, and server scripts assembled into distributions.

Ghidra/Extensions

Optional extension modules (BSimElasticPlugin, Jython, MachineLearning, SymbolicSummaryZ3, SleighDevTools, etc.) packaged via extension.properties.

GhidraBuild/BuildFiles + Ghidra/Configurations

Shared Gradle build scaffolding, SLEIGH dev/dist build templates, and public release configuration module.

Over the past month, the Ghidra team shipped a steady stream of user-facing improvements alongside routine maintenance, including a new data type comparison tool, better cross-reference counts, and natural sorting for project files. Processor support got attention too, with fixes for x86 instructions and flags, MIPS variants, AArch64 switch handling, and Hexagon compiler specs. The team also upgraded dependencies like log4j and PostgreSQL drivers, cleaned out long-deprecated code, and hardened file parsing against malformed images.

Week by week

2026-08-24A quiet week with a single merge of test fixes into the main branch.latest1 change

Chore

Test fixes merged

The team merged a branch of test corrections from the previous week to keep the automated test suite healthy.

2026-08-17A busy week that added a new data type comparison tool, natural sorting for project files, and several bug fixes plus a patch release.6 changes

Feature

Compare two data types side by side

A new action lets users directly compare two data types to spot differences between them.

Feature

Natural sort for project files

The Front End now sorts project files the way people expect (so 'file2' comes before 'file10') instead of strict alphabetical order.

Fix

Unsigned comparisons in constant folding

Fixed the analysis engine so equality range checks use unsigned math, preventing wrong results on certain values (community contribution).

Fix

Logging safeguards during testing

Default log file values were added so tests no longer accidentally create bad log files.

Fix

PyGhidra config parsing fix

Fixed extension.properties parsing so values containing an equals sign are read correctly.

Chore

Patch release 12.1.4 prepared

The version number was bumped to prepare a new patch release, along with log4j-related fixes and build automation work.

2026-08-10A high-volume week focused on processor correctness fixes, security hardening of image parsing, and search improvements.6 changes

Feature

Full cross-reference counts shown

The xrefs field now displays the complete count of references to an address rather than a truncated number.

Fix

Search finds clipped text and plate comments

Text searching was fixed so it can find text that is visually clipped on screen and properly searches plate comments.

Fix

x86 instruction fixes

Corrected masking for several PEXT and PINS instructions and fixed the overflow flag calculation for shift/rotate instructions.

Fix

AArch64 and MIPS processor corrections

Switch detection code was fixed for AArch64 instructions with internal p-code, and MIPS 16e variant definitions were corrected.

Fix

Safer PNG and image parsing

Image loading now enforces reasonable width/height and chunk sizes to prevent problems from malformed files (community contributions).

Chore

log4j upgraded to 2.26.1

The logging library was upgraded to pick up the latest upstream release.

2026-08-03Work centered on parser robustness, import progress messages, register sorting, and internal cleanup.6 changes

Fix

Register picker sorted correctly

Fixed the ordering of registers in the register picker and Register Provider so they appear sensibly (community-reported issue).

Fix

GhidraScript ask() methods fixed

Resolved a bug that prevented script prompt dialogs from working as expected.

Feature

Better progress messages during import

Import operations now show clearer status messages so users know what the tool is doing.

Fix

Loader parsing improvements

Both the SOM loader and Motorola hex loader handle tricky input formats more reliably.

Fix

Change set version handling corrected

Fixed how the program tracks its change history so version information is reported accurately.

Fix

Safe image dimensions enforced

Added checks ensuring image width and height values are valid before processing.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required