Ghidra Reverse Engineering Tool: Install, Features and a First Analysis

Key takeaways

• Ghidra is free and open source and runs on Windows, macOS and Linux with a suitable Java JDK.
• Its decompiler turns machine code into readable C-like pseudocode, which is the feature beginners notice first.
• Features differ per version. Read the release notes for the exact version you install.
• Analyse malware only in an isolated lab, and only samples you are allowed to handle.

What is Ghidra?

Ghidra is a reverse engineering suite. You give it a compiled program, such as an executable, a library or firmware image, and it shows you the assembly, a decompiled C-like view, the strings, the functions and how they call each other. People use it to analyse malware, to audit software when source code is not available, to study vulnerabilities and to learn how compilers work.

The NSA released it as open source in 2019, and development continues on GitHub at NationalSecurityAgency/ghidra. It is licensed under Apache 2.0, so it costs nothing to use.

About version numbers

This page used to be a release announcement for one version. Release news ages quickly, and Ghidra has shipped newer versions since. Instead of repeating details that go out of date, this guide shows you how to check any version yourself: open the project's releases page on GitHub, read the release notes for that version, and read the README for system requirements. Treat anything that tells you a feature "is in" a specific version without linking those notes with caution.

What do you get?

• Disassembler for many processor architectures.
• Decompiler that produces C-like pseudocode.
• Function graph and call tree views.
• Scripting in Java and Python, plus a headless mode for automation.
• Collaboration features so a team can work in one project.
• Debugger support in recent versions. Check the notes for your version for current capability.

How to install

1. Install a 64-bit JDK of the version the Ghidra README asks for. Recent releases require a current long-term-support JDK, and the exact number changes, so read the file that comes with the release.
2. Download the release zip from the official GitHub releases page and extract it. There is no installer.
3. Run ghidraRun on Linux and macOS, or ghidraRun.bat on Windows.
4. Verify the download if the release gives a checksum.

If the launcher fails, the usual cause is the wrong Java version, so check that first.

A safe first exercise

Do not begin with real malware. Compile your own tiny program so you know the answer.

// hello.c
#include <stdio.h>
int check(int x) { return x * 3 + 7; }
int main(void) {
 int v = 5;
 printf("Result: %d\n", check(v));
 return 0;
}

gcc -O0 -g0 hello.c -o hello

Then in Ghidra:

1. Create a new project and import hello. Accept the detected format.
2. Open it in the Code Browser and let auto-analysis run.
3. In the Symbol Tree, find main and check.
4. Open the Decompiler window. Compare its output with your source.
5. Rename variables as you understand them. Press the label shortcut or use the right-click menu.

You should see check decompile to something close to your arithmetic. That moment, seeing your own logic come back out of the binary, is what makes the tool click. Try again with -O2 and see how the output changes.

Reading the decompiler without being fooled

The decompiler makes a best guess. Variable names are invented, types may be wrong and compiler optimisations reshape the code. Always confirm important conclusions in the assembly listing next to it.

Safety and legal notes

• Run unknown binaries only inside an isolated virtual machine with snapshots and no shared folders. Analysing a file in Ghidra does not execute it, but opening and debugging samples carries risk.
• Reverse engineering software you do not own may breach its licence or local law. Use your own programs, open lab samples and authorised work.
• Malware samples belong in an isolated malware analysis lab, not on your daily laptop.

Where Ghidra fits among tools

Ghidra is a static analysis tool first. For live debugging on Windows, tools such as Immunity Debugger are often used alongside it. AI is also starting to assist reverse engineering; read AI in reverse engineering for that angle.

Next steps

Reverse engineering sits on top of solid operating system and C knowledge. If you want a guided route into exploit and malware analysis, look at the OffSec OSED exploit development course or start with the Cyber Security course.

Related reading

• How Ethical Hackers Use Netcat for Network Debugging: Features, Commands and Defence
• Which Code Editor Is Best for Python, Java, C++, JavaScript, PHP & More in 2026?