Ghidra

Ghidra is a reverse-engineering suite released by the United States National Security Agency. It takes a compiled binary, works out its structure, disassembles the machine code, and runs a decompiler that produces C-like pseudocode next to the assembly. Renaming a variable or retyping a structure in one view updates the other.

Work is organised as a project holding one or more imported programs. Automatic analysis passes locate functions, cross-references, strings and jump tables; from there a listing view, a function graph, a symbol tree, a data-type manager and a byte viewer let you work through the binary and record what you learn. Processors are described in an extensible specification language, which is why coverage reaches well beyond x86 and ARM into embedded and older architectures.

Ghidra is written in Java and runs wherever a suitable Java runtime is available. Scripts can be written in Java or Python, larger extensions plug into the framework, and a separate server component lets several analysts share one project. It assumes a reader already comfortable with assembly.