Ghidra

Ghidra ( ) is a free and open source reverse engineering tool developed by the National Security Agency (NSA) of the United States. The binaries were released at the RSA Conference in March 2019; the source code was published one month later on GitHub.

The software is written in Java using the Swing framework for the GUI. The decompiler component is written in C++, and is therefore usable in a stand-alone form.e. g. as Plugin for Radare2 or Rizin. Scripts to perform automated analysis with Ghidra can be written in Java or Python; current versions support Python through PyGhidra, while Jython is available as an optional extension. Plugins adding new features to Ghidra itself can be developed using a Java-based extension framework.

Many security researchers consider Ghidra to be a viable open source alternative to the proprietary IDA Pro.

History

Ghidra's existence was originally revealed to the public via Vault 7 in March 2017, but the software itself remained unavailable until its official declassification and release two years later. Some comments in its source code indicate that it existed as early as 1999.

+High-level changelogVersionYearMajor features1.02003Proof of concept2.02004Database, docking windows3.02006SLEIGH, decompiler, version control4.02007Scripting, version tracking5.02010File system browser6.02014First unclassified version9.02019First public release9.22020Graph visualization, new PDB parser10.02021Debugger11.02023Rust and Go binaries support, BSim11.12024Swift and DWARF 5 support, Mach-O improvements

In June 2019, coreboot began to use Ghidra for its reverse engineering efforts on firmware-specific problems following the open source release of the Ghidra software suite.

Ghidra can be used as a debugger since Ghidra 10.0. Ghidra's debugger supports debugging user-mode Windows programs via WinDbg, Linux programs via GDB and macOS programs via LLDB.

Supported architectures

Over twenty CPU architectures or binary formats are supported.

Ghidra

Bron en licentie