[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3pgmr8rrrijo0":3},{"code":4,"message":5,"data":6,"timestamp":59},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":46,"summary_md":47,"topic":48,"github_topics":51,"license":55,"homepage":56,"updated_at":57,"history":58},"NationalSecurityAgency\u002Fghidra",1,"Ghidra is a software reverse engineering (SRE) framework","Java",93850,10540,14248,2794,[16,22,28,34,40],{"id":17,"title":18,"points":19,"comments":20,"posted_at":21},47011548,"Ghidra by NSA",433,220,"2026-02-14",{"id":23,"title":24,"points":25,"comments":26,"posted_at":27},35324380,"NSA Ghidra software reverse engineering framework",214,103,"2023-03-27",{"id":29,"title":30,"points":31,"comments":32,"posted_at":33},36390357,"Debugger Ghidra Class",199,27,"2023-06-19",{"id":35,"title":36,"points":37,"comments":38,"posted_at":39},38740793,"Ghidra 11.0 Released",81,11,"2023-12-23",{"id":41,"title":42,"points":43,"comments":44,"posted_at":45},19572994,"Ghidra source code officially released",67,7,"2019-04-04","An NSA-built reverse engineering framework for disassembling and decompiling binaries when you need to understand code you cannot see.","## The problem\n\nSomeone hands you a binary — a firmware blob, a suspicious executable, a stripped library from a vendor that will not share source. You need to know what it does. Commercial reverse engineering suites are expensive and license-locked, while disassemblers alone leave you reading assembly by hand. Ghidra attacks this with a full SRE workbench: disassembly, decompilation to C-like code, graphing, scripting, and support for many processor instruction sets and executable formats, all in one installable package.\n\n## What's different\n\nCompared with IDA Pro, the long-standing commercial incumbent, Ghidra's advantage is cost and openness: it is free, Apache-2.0, and its decompiler, scripting layer and extension API are available to modify instead of being a black box. Compared with radare2, which is fiercely scriptable and terminal-centric but has a steeper learning curve and less integrated decompilation, Ghidra offers a GUI-heavy, team-oriented workflow — the README explicitly cites scaling and teaming on complex SRE efforts as the reason NSA built it. Also notable is the dual interactive\u002Fautomated mode, which lets you script headless analysis instead of clicking through every binary, plus first-class Java and Python extension points. The decompiler output is good enough for everyday triage but is not a guarantee of readable source.\n\n## Who it's for\n\nSecurity researchers, malware analysts, vulnerability hunters, and embedded engineers who need to inspect firmware or third-party binaries and cannot justify an IDA license. Teams doing repeated analysis across many samples benefit from the headless scripting. Look elsewhere if you only need a quick hex\u002Fstrings inspection (lighter tools suffice), if your work is purely dynamic instrumentation, or if you need vendor support and guaranteed turnaround — NSA does not sell support, and the community answers questions.\n\n## Cost of adoption\n\nYou need JDK 25 64-bit, and the README warns that known security vulnerabilities exist in certain versions — check the advisories before deploying. Building from source adds Gradle 9.1.0+, Python 3.9–3.15, and GCC\u002FClang or Visual Studio build tools; most users should just download a release zip and run `.\u002FghidraRun`. The learning curve is real: the UI is dense, and decompiler output requires assembly literacy to trust. The Eclipse-oriented development workflow feels dated, and release cadence is regular but the project is government-maintained, so expect process over rapid iteration.\n\n## Verdict\n\nGhidra is not a new project — the repo dates to 2019 and has accumulated roughly 94k stars and 10.5k forks, which is an unusually large footprint for a reverse engineering tool. The recent signal is a monthly surge of about 14k stars, ranking #10 across all languages, and a 433-point Hacker News thread; that pattern looks like renewed mainstream attention rather than a brand-new project spiking on novelty. The Apache-2.0 license removes the usual commercial barrier, so the real cost is time to learn the UI and decompiler. If reverse engineering is a recurring part of your job, this is close to a default choice; if it is occasional, budget for the ramp-up.",{"slug":49,"name":50},"security","Security & Privacy",[52,53,54],"disassembler","reverse-engineering","software-analysis","Apache-2.0",null,"2026-10-24T14:36:01Z",[],1792864284]