Ghidra is a free, open-source software reverse-engineering (SRE) framework developed by the US National Security Agency and released publicly in 2019. It disassembles and, crucially, decompiles compiled binaries into readable C-like pseudocode across many processor architectures. Malware analysts and vulnerability researchers use it to understand how a binary works without source code: mapping functions, analysing data flow, and identifying vulnerabilities or malicious behaviour. Its free decompiler made professional-grade reverse engineering widely accessible.
Last updated: 6 August 2026
Ghidra lets an analyst take an unknown executable and reconstruct its logic. You load a binary, let Ghidra auto-analyse it, and navigate functions in both disassembly and decompiled C, renaming variables and adding comments as understanding grows. A malware analyst uses it to trace what a sample does on execution; a researcher hunts for a memory-corruption bug in a closed-source program. It supports many architectures, loading multiple binaries into one project, scripting in Java/Python, and collaborative analysis via a shared server, all without licence fees.
Linux · Windows · macOS
Open source (Apache 2.0)
File > Import FileLoad a binary into a Ghidra project to begin analysis.
Auto Analyze (on import)Let Ghidra disassemble, identify functions and build cross-references automatically.
Decompiler windowRead the C-like pseudocode for the currently selected function.
Symbol Tree / FunctionsBrowse and jump between discovered functions, imports and exports.
L (rename) / ; (comment)Rename variables and annotate code to record your understanding.
Search > For StringsList embedded strings to find URLs, messages and indicators quickly.
Window > Script ManagerRun or write Java/Python scripts to automate repetitive analysis.
Reverse engineering can be restricted by copyright law and by software licence or EULA terms, which vary by jurisdiction and often prohibit it. Analyse only binaries you are legally permitted to, such as your own software, malware samples, or programs where analysis is allowed for interoperability or security research under applicable law. Never redistribute proprietary code you recover.
Decompiled output is a reconstruction, not the original source: it can be inaccurate, especially with optimisation, obfuscation, packing or anti-analysis tricks, and needs human interpretation. Ghidra is static analysis, so it does not run the binary; pair it with a debugger for dynamic behaviour. Large binaries make analysis slow and labour-intensive.
| Tool | Pick it when |
|---|---|
| IDA Pro | You want the commercial standard with the most accurate decompiler and huge plugin ecosystem. |
| Binary Ninja | You want a modern, affordable commercial tool with a strong API. |
| radare2 / Cutter | You prefer a free command-line framework (Cutter is its GUI, which can use Ghidra's decompiler). |
| x64dbg | You need live dynamic debugging of Windows binaries rather than static analysis. |
| dnSpy / ILSpy | The target is .NET managed code, which decompiles almost to source. |
Advanced module — malware analysis and reverse engineering (mentored)
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000