What it does
Ghidra is a software reverse-engineering framework with disassembly, decompilation, graphing and scripting capabilities across many binary formats.
Ghidra is useful when understanding a suspicious program requires inspecting compiled code. Its official README describes interactive and automated analysis, with extensions and scripts for repeated work. Use a copy of the sample and a controlled analysis environment. Follow the release's installation instructions rather than confusing source archives with built packages. The README explicitly directs users to security advisories for affected versions, making framework updates part of maintaining the investigation workstation.
Strengths
- Extensible compiled-code analysis framework
Best for
- Researchers performing authorized malware reverse engineering
Sources
- Ghidra Software Reverse Engineering Framework (Oct 26, 2026)