Search the Community

Ghidra Software Reverse Engineering Framework Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python. In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems. If you are a U.S. citizen interested in projects like this, to develop Ghidra and other cybersecurity tools for NSA to help protect our nation and its allies, consider applying for a career with us. Ghidra 10.1.4 Change History (May 2022) Improvements Debugger:Listing. Refresh button in Debugger's Dynamic Listing and Memory Bytes views now operates without a selection and is more thorough with respect to cache invalidation. (GP-1930) Bugs Analysis. Fixed an exception that occurred when loading programs created in previous versions where the analysis option's type had changed (String to Long). (GP-1738) Analysis. Constant reference propagation now uses pcode injection for segment and all userops. This affects 16-bit code and the HCS12 processor. (GP-1987, Issue #4252) C Parsing. Added C-Parser support for static_assert and _Static_assert keywords. (GP-1958, Issue #4038) C Parsing. Corrected C-Parser to parse sizeof structure members, both sizeof(ptr->member) and sizeof(struct.member). (GP-1964, Issue #4173) Decompiler. Fixed bug causing the Decompiler to not label pointer references to the first parameter on the stack. (GP-2018) GUI. Fixed bug that caused some edited functions to appear twice in the Functions window. (GP-2025) GUI. Fixed potentially slow computer name lookup in the Error Dialog. (GP-2034) Importer:COFF. Fixed importing of non-Microsoft COFF files when any section crosses address 0x80. COFF sections marked as data that won't fit into the default data address space will be loaded in the code address space. (GP-2045) [hide][Hidden Content]]