Hidden Content

Ever wondered how people inspect the source logic of compiled software without having the original source code?

There's a powerful, completely free reverse-engineering framework called Ghidra.

Originally developed by the US National Security Agency (NSA), Ghidra was publicly released as an open-source project in 2019.

It allows you to analyse executable files, inspect assembly instructions, reconstruct C-like pseudocode, examine functions, and understand how applications work internally.

Unlike traditional debuggers, Ghidra is particularly useful for static analysis, meaning you can examine compiled software without executing it.

WHAT CAN GHIDRA DO?Ghidra includes:
- Executable disassembly

- C-like code decompilation

- Function identification

- Cross-reference analysis

- String searching

- Assembly inspection

- Control-flow graphs

- Memory and data inspection

- Binary comparison capabilities

- Script automation

- Support for numerous CPU architectures

It supports Windows, Linux, and macOS.

OFFICIAL LINKSOfficial Website:

https://ghidra-sre.org/

GitHub Repository:

https://github.com/NationalSecurityAgency/ghidra

Official Download:

https://github.com/NationalSecurityAgenc...a/releases

Getting Started Guide:

https://github.com/NationalSecurityAgenc...Started.md

Official Documentation:

https://github.com/NationalSecurityAgenc...GhidraDocs

Java JDK:

https://adoptium.net/

STEP 1 — DOWNLOAD GHIDRAOpen the official releases page:

https://github.com/NationalSecurityAgenc...a/releases

As of October 2026, the latest listed release is:

Ghidra 12.1.4

Download the prebuilt release ZIP from the release assets.

Do not download the automatically generated GitHub source-code archive if you want a ready-to-run application.

Extract the release ZIP into a folder.

Ghidra doesn't require a traditional Windows installer.

STEP 2 — INSTALL JAVAGhidra requires a supported Java Development Kit.

The current official installation instructions specify:

64-bit JDK 25

You can obtain a suitable JDK from:

https://adoptium.net/

After installing Java, open PowerShell and run:

 

Code:


You should see the installed Java version.

If Ghidra cannot locate Java automatically, follow the official Getting Started guide to configure your JDK location.

STEP 3 — LAUNCH GHIDRAOpen the extracted Ghidra directory.

On Windows, run:

 

Code:


On Linux or macOS, use:

 

Code:


The Ghidra project manager should open.

From here, you can create projects and import binary files for analysis.

STEP 4 — CREATE A PRACTICE EXECUTABLERather than downloading an unknown program, we'll compile a small executable ourselves.

Open Notepad and paste:

 

Code:


Save it as:

 

Code:


This program multiplies a price by a quantity and prints the result.

The expected output is:

 

Code:


Our goal is to recover an understanding of this calculation from the compiled executable.

STEP 5 — COMPILE THE PROGRAMIf you have Visual Studio's C/C++ development tools installed, open the x64 Native Tools Command Prompt.

Official download:

https://visualstudio.microsoft.com/vs/community/

Navigate to the directory containing

Code:


.Compile it using:

 

Code:


The

Code:


flag disables compiler optimisations.This is useful for reverse-engineering exercises because aggressive optimisation can remove or combine functions.

The output should be:

 

Code:


STEP 6 — CREATE A GHIDRA PROJECTLaunch Ghidra.

Choose:

File → New Project

Select:

Non-Shared Project

Choose a folder and enter a project name.

For example:

 

Code:


Click Finish.

You now have a project where you can organise executable files and analysis results.

STEP 7 — IMPORT YOUR EXECUTABLEInside your Ghidra project, choose:

File → Import File

Select:

 

Code:


Ghidra should detect the executable format and processor architecture.

For a normal 64-bit Windows executable, this will typically involve:

 

Code:


Complete the import.

Double-click the imported executable to open it in Ghidra's CodeBrowser.

STEP 8 — RUN AUTOMATIC ANALYSISWhen the CodeBrowser opens, Ghidra normally asks whether you want to analyse the file.

Select:

Yes

Keep the default analysers enabled for this beginner exercise.

Click Analyse.

Ghidra will examine the executable and attempt to identify:
- Functions

- Code references

- Data references

- Strings

- Program entry points

- Calling conventions

- Possible function signatures

Once analysis completes, you can inspect the results.

STEP 9 — UNDERSTAND THE INTERFACEGhidra's CodeBrowser includes several important views.

Listing

Displays disassembled instructions, addresses and data.

Decompiler

Reconstructs C-like pseudocode from machine instructions.

Symbol Tree

Lists recognised functions, labels, imports and other symbols.

Data Type Manager

Helps manage structures, pointers, enums and other data types.

Function Graph

Displays a function's control flow visually.

Together, these views help explain how a compiled executable operates.

STEP 10 — FIND THE CALCULATION FUNCTIONOpen the Symbol Tree.

Expand:

 

Code:


Look for a function resembling:

 

Code:


Depending on the executable and available symbols, Ghidra might preserve that name or assign something resembling:

 

Code:


If the function name isn't available, identify it by examining the application's calling relationships and arithmetic instructions.

Double-click the function to navigate to its code.

STEP 11 — VIEW THE DECOMPILED CODESelect the calculation function.

The Decompiler panel may show pseudocode resembling:

 

Code:


The exact output depends on the compiler, optimisation settings, available symbols and Ghidra's analysis.

You might instead see something resembling:

 

Code:


Notice that the original variable and function names aren't guaranteed to survive compilation.

Ghidra reconstructs an interpretation of the program's behaviour, not the exact original source code.

STEP 12 — EXAMINE THE ASSEMBLYIn the Listing view, the multiplication operation may appear as an instruction such as:

 

Code:


This is an illustrative example, not a guaranteed instruction sequence from your compiler.

The instruction performs signed integer multiplication.

By examining surrounding instructions, you can understand where the input values come from and where the result is returned.

This demonstrates how simple high-level code becomes processor instructions.

BONUS — SEARCH FOR STRINGSMany compiled programs contain readable text.

In your practice executable, you might find:

 

Code:


Inside Ghidra, open:

Window → Defined Strings

Look for that string.

Double-click it to navigate to its location.

You can then inspect references to find code that accesses the string.

This is particularly useful when examining error messages, logging routines, configuration labels and other application behaviour.

BONUS #2 — FOLLOW CROSS-REFERENCESGhidra can show where a function or data item is referenced.

Select a function or string and inspect its references.

For example:

 

Code:


Cross-references are useful for answering questions such as:
- Which functions call this routine?

- Where is this string used?

- Which code reads or writes this variable?

- What happens before a particular function executes?

BONUS #3 — RENAME FUNCTIONSAutomatically generated names can be difficult to understand.

For example:

 

Code:


If you determine that the function performs multiplication, you can rename it:

 

Code:


To rename a symbol, select it and press:

 

Code:


Enter a new name.

This changes the label in your Ghidra project, not the original source code of the executable.

Clear naming makes larger reverse-engineering projects much easier to understand.

BONUS #4 — INSPECT CONTROL FLOWGhidra includes graph visualisation.

Open a function and access its Function Graph view.

For functions containing conditional branches, you may see a structure resembling:

 

Code:


This makes it easier to understand loops, conditions and branching logic.

Your simple multiplication function may have only one basic block.

BONUS #5 — ANALYSE UNKNOWN FILES SAFELYGhidra is frequently used in malware research.

Because static analysis doesn't require executing the imported program, researchers can inspect suspicious executable code without deliberately launching it.

Possible research tasks include:
- Identifying suspicious imports

- Locating embedded network addresses

- Examining file-handling behaviour

- Identifying potential persistence routines

- Analysing encryption functions

- Understanding execution flow

However, Ghidra itself isn't a complete malware sandbox.

Avoid opening untrusted files on a machine containing sensitive information, and keep Ghidra updated because malformed binaries may exploit vulnerabilities in analysis software.

Use an isolated analysis environment for suspicious samples.

BONUS #6 — GHIDRA VS X64DBGThese tools serve different purposes.

Ghidra

Best suited to static binary analysis, decompilation, program structure and cross-reference research.

x64dbg

Best suited to debugging Windows processes, inspecting runtime memory, breakpoints and step-by-step execution.

A typical authorised reverse-engineering workflow can use Ghidra to understand the overall program structure and x64dbg to observe particular functions at runtime.

Both are free.

IMPORTANT — WHAT GHIDRA CANNOT DOGhidra cannot reliably recreate the exact original source code of every executable.

Compilation removes or transforms information.

Depending on the binary, you may lose:
- Original local variable names

- Comments

- Source formatting

- Some type information

- Original function boundaries

- High-level abstractions

Packed or obfuscated software can also be substantially harder to analyse.

Decompiled pseudocode must be checked against the underlying assembly before treating it as an exact representation of program behaviour.

IMPORTANT — AUTHORISED ANALYSISUse Ghidra to examine your own applications, open-source binaries, educational challenge programs, or files you're authorised to research.

Respect applicable licences and laws.

This tutorial is about understanding compiled software, not bypassing commercial licensing or tampering with third-party protections.

IS GHIDRA STILL MAINTAINED IN 2026?Yes.

As of 12 October 2026, the official repository lists Ghidra 12.1.4, released on 21 September 2026.

The project remains open-source, with installation instructions, documentation and release updates maintained on GitHub.

SOURCEShttps://github.com/NationalSecurityAgency/ghidra

https://github.com/NationalSecurityAgenc...a/releases

https://github.com/NationalSecurityAgenc...Started.md

https://github.com/NationalSecurityAgenc...GhidraDocs

Ghidra is one of the most capable free reverse-engineering frameworks available.

It's useful for understanding compiled applications, examining machine code and learning how professional binary analysis works.

 

WANT MORE HIGH QUALITY SHIT FOR FREE?

CLICK HERE > (MY PROFILE)

Haven't made a account yet? register here (REF LINK)