nationalsecurityagency/ghidra
Ghidra is a software reverse engineering (SRE) framework
How ghidra is put together
Ghidra is the NSA's open-source reverse-engineering platform, built as a large multi-module Java desktop application orchestrated by Gradle. The repository is organized into top-level trees: 'GPL' (GPL-licensed companion tools such as the DMG disk-image handler, GNU demangler native executables, and GNU disassembler extension), 'Ghidra' (core features, Debug/Debugger framework and agents, runtime launch scripts, extensions, configurations), and 'GhidraBuild' (shared build files). Data flow centers on importing binary programs into Ghidra projects, analyzing them via plugins/scripts (e.g., AppleSingleDouble analysis commands, SLEIGH language queries), and debugging live targets through agent modules that bridge to gdb, lldb, dbgeng, drgn, x64dbg, and JPDA. Native C components (demanglers, gdis built from binutils) are compiled per-platform via Gradle native plugin models.
Languages
Frameworks
Infrastructure
Major components
GPL/DMG
Standalone DMG (Apple disk image) handling application executed from Ghidra, built against bundled hfsx/hfsx_dmglib/csframework jars.
GPL/DemanglerGnu
Native C executables demangler_gnu_v2_41 and demangler_gnu_v2_24 built for ten target platforms to demangle GNU symbols.
GPL/GnuDisassembler
Distributable GPL extension building the gdis executable from binutils 2.41 sources.
Ghidra/Debug (Debugger framework)
Debugger core, trace modeling, taint analysis, ISF/DAP support, and per-target agents (gdb, lldb, dbgeng, drgn, x64dbg, jpda) plus rmi-trace scripting.
Ghidra/Features/Base
Core feature module hosting example and utility GhidraScripts such as binary format analysis commands and SLEIGH language API demos.
Ghidra/RuntimeScripts
Runtime launch infrastructure: ghidraRun/ghidraRun.bat, support scripts, and server scripts assembled into distributions.
Ghidra/Extensions
Optional extension modules (BSimElasticPlugin, Jython, MachineLearning, SymbolicSummaryZ3, SleighDevTools, etc.) packaged via extension.properties.
GhidraBuild/BuildFiles + Ghidra/Configurations
Shared Gradle build scaffolding, SLEIGH dev/dist build templates, and public release configuration module.
A quiet week with a single merge of test fixes into the main branch.
4 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week with a single merge of test fixes into the main branch.
Week of 2026-08-17
A busy week that added a new data type comparison tool, natural sorting for project files, and several bug fixes plus a patch release.
Week of 2026-08-10
A high-volume week focused on processor correctness fixes, security hardening of image parsing, and search improvements.
Week of 2026-08-03
Work centered on parser robustness, import progress messages, register sorting, and internal cleanup.
Over the past month, the Ghidra team shipped a steady stream of user-facing improvements alongside routine maintenance, including a new data type comparison tool, better cross-reference counts, and natural sorting for project files. Processor support got attention too, with fixes for x86 instructions and flags, MIPS variants, AArch64 switch handling, and Hexagon compiler specs. The team also upgraded dependencies like log4j and PostgreSQL drivers, cleaned out long-deprecated code, and hardened file parsing against malformed images.
Week by week
2026-08-24A quiet week with a single merge of test fixes into the main branch.latest1 change
Chore
Test fixes merged
The team merged a branch of test corrections from the previous week to keep the automated test suite healthy.
2026-08-17A busy week that added a new data type comparison tool, natural sorting for project files, and several bug fixes plus a patch release.6 changes
Feature
Compare two data types side by side
A new action lets users directly compare two data types to spot differences between them.
Feature
Natural sort for project files
The Front End now sorts project files the way people expect (so 'file2' comes before 'file10') instead of strict alphabetical order.
Fix
Unsigned comparisons in constant folding
Fixed the analysis engine so equality range checks use unsigned math, preventing wrong results on certain values (community contribution).
Fix
Logging safeguards during testing
Default log file values were added so tests no longer accidentally create bad log files.
Fix
PyGhidra config parsing fix
Fixed extension.properties parsing so values containing an equals sign are read correctly.
Chore
Patch release 12.1.4 prepared
The version number was bumped to prepare a new patch release, along with log4j-related fixes and build automation work.
2026-08-10A high-volume week focused on processor correctness fixes, security hardening of image parsing, and search improvements.6 changes
Feature
Full cross-reference counts shown
The xrefs field now displays the complete count of references to an address rather than a truncated number.
Fix
Search finds clipped text and plate comments
Text searching was fixed so it can find text that is visually clipped on screen and properly searches plate comments.
Fix
x86 instruction fixes
Corrected masking for several PEXT and PINS instructions and fixed the overflow flag calculation for shift/rotate instructions.
Fix
AArch64 and MIPS processor corrections
Switch detection code was fixed for AArch64 instructions with internal p-code, and MIPS 16e variant definitions were corrected.
Fix
Safer PNG and image parsing
Image loading now enforces reasonable width/height and chunk sizes to prevent problems from malformed files (community contributions).
Chore
log4j upgraded to 2.26.1
The logging library was upgraded to pick up the latest upstream release.
2026-08-03Work centered on parser robustness, import progress messages, register sorting, and internal cleanup.6 changes
Fix
Register picker sorted correctly
Fixed the ordering of registers in the register picker and Register Provider so they appear sensibly (community-reported issue).
Fix
GhidraScript ask() methods fixed
Resolved a bug that prevented script prompt dialogs from working as expected.
Feature
Better progress messages during import
Import operations now show clearer status messages so users know what the tool is doing.
Fix
Loader parsing improvements
Both the SOM loader and Motorola hex loader handle tricky input formats more reliably.
Fix
Change set version handling corrected
Fixed how the program tracks its change history so version information is reported accurately.
Fix
Safe image dimensions enforced
Added checks ensuring image width and height values are valid before processing.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required