Search the Community

Ghidra Software Reverse Engineering Framework Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python. In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems. If you are a U.S. citizen interested in projects like this, to develop Ghidra and other cybersecurity tools for NSA to help protect our nation and its allies, consider applying for a career with us. Ghidra 10.1.1 Change History (December 2021) Improvements Analysis. Fixed headless analysis exception related to running UI code from the GNU Demangler analyzer. (GP-1613, Issue #3765) Basic Infrastructure. Upgrade logging dependency to use log4j 2.17.0 (GP-1621) Debugger:Memory. Added New Memory Bytes View to Window->Debugger menu. (GP-1465) Debugger:Memory. Fixed issue with Debugger Memory view scrolling. (GP-1591) GUI. Removed restriction that prevented renaming tree nodes while the tree is filtered. (GP-1507) GUI. Fixed issue where renaming a symbol in the symbol tree could result in the symbol appearing more than once (under different organizational nodes) (GP-1587) Help. Fixed NullPointerException when using the help system with animation disasbled. (GP-1612, Issue #3767) Bugs Basic Infrastructure. Fixed the "ERROR StatusLogger Reconfiguration failed" message that appeared in the log when Ghidra was launched with support/ghidraDebug script. (GP-1607) Debugger. Fixed null pointer exception in Debugger when opening a program from a shared project. (GP-1490) Debugger. Fixed issue with context menus on the trace selector tabs in Debugger Threads window. (GP-1494) Debugger. Fix for font resizing (GP-1597, Issue #3752) Debugger. Fixes null-pointer exceptions in lldb (GP-1600, Issue #3645) Debugger:Listing. Fixed default configuration problem when cloning the Debugger Listing window. (GP-1479) Importer. Fix issue importing NE binaries that have a segment number greater than 127. (GP-1576, Issue #3715) [hide][Hidden Content]]