Ghidra: The NSA's Free Reverse Engineering Suite (GitHub, Scanned)

Ghidra is a software reverse engineering framework: you load a compiled program and it disassembles the machine code, decompiles it into readable C-like pseudocode, draws call graphs and lets you rename, annotate and script your way to understanding what the binary does. It handles a long list of processors and executable formats, runs on Windows, macOS and Linux, has a debugger, supports multi-user projects on a shared server and can be scripted in Java or Python through PyGhidra.

It was built inside the National Security Agency's Research Directorate for its own analysts and released as open source in 2019, which made a tool of IDA Pro's class free overnight. Seven years on it has about 96,000 stars, 478 contributors and a steady release train, with Ghidra 12.2 out in October 2026. Malware analysts, CTF players, firmware hackers and game modders use it daily, and community MCP servers now let coding agents drive it.

It is Apache-2.0 licensed with no paid edition. The one thing to know before downloading is the README's own warning: some versions have had security vulnerabilities, so read the advisories page and run the current release.

• Repository: github.com/NationalSecurityAgency/ghidra
• Licence: Apache-2.0 (Apache License 2.0)
• Language: Java. Stars: 96.5K. Forks: 10.9K. Last push: Oct 30, 2026.
• Scan: safe, Nov 1, 2026, commit 4718f50

Who it is for

Security researchers and malware analysts, CTF players, anyone pulling apart firmware or an old game, and students who want to see what a compiler really produced.

Getting started

1. Install a 64-bit JDK 25 first (Temurin builds are free)

https://adoptium.net/temurin/releases

2. Download the release zip (not the source archive) and extract it

https://github.com/NationalSecurityAgency/ghidra/releases

3. Launch it from the extracted folder (ghidraRun.bat on Windows)

./ghidraRun

4. Or launch the Python-first PyGhidra variant

./support/pyghidraRun

Do not extract a new release on top of an old one. The GettingStarted document in the install folder covers memory settings and the first project. Analysing malware belongs in a virtual machine, whatever tool you use.

Safety scan

We cloned NationalSecurityAgency/ghidra at commit 4718f50 on Nov 1, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• Six secret hits in 20,630 files and 3.6 million lines, every one the private-key rule matching the text -----BEGIN in source that handles keys: SSHKeyManager.java parses them, PKIUtilsTest.java holds test fixtures and the BSim launcher writes a key file for its database service. None is a usable key.
• One pattern hit, the persistence rule on a systemctl enable call in the BSim control launcher. BSim is Ghidra's optional function-similarity database, and that code registers it as a service only when an administrator asks it to.
• 32 binaries, all under GPL/DMG: the hfsx and hfsx_dmglib jars and llio DLLs for Windows that let Ghidra open Apple disk images, which are built from the GPL sources in the same folder. The release zips you download are built by the project's own workflow from this tree.
• No lockfiles, so OSV had nothing to query: Gradle fetches the Java dependencies at build time and the release bundles them. Three workflows, none using pull_request_target, with one of twelve action uses from a third party and unpinned. Security policy and contributing guide present; no Dependabot or CodeQL.
• OpenSSF Scorecard 3.4 on 2026-10-26: Maintained and Dangerous-Workflow score 10, Code-Review scores 0 because NSA commits land without GitHub pull request reviews. The 16,000 references to www.apache.org are licence headers; the android.googlesource.com links are source citations.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Java 3.3M, C++ 160.8K, HTML 68K, C 49.5K, Python 48.3K, C/C++ header 14.8K.

Questions

Is Ghidra free?

Yes, completely. It is Apache-2.0 open source maintained by the NSA, with no paid tier, no account and no telemetry. The only requirement is a Java Development Kit, which is also free.

Ghidra or IDA Pro?

IDA Pro is the commercial standard with a faster debugger and more polish, and its full version costs thousands. Ghidra's decompiler works for every processor it supports at no cost, which is why many analysts keep both and students start here.

Is it safe to install software from the NSA?

The source has been public since 2019 and the releases are built from it in the open. Our scan found nothing hidden: no network calls home, no unexplained binaries. Treat it like any reverse engineering tool and keep malware samples in a VM.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.