Reverse Engineering

ghidra

ghidra is the tool that changed reverse engineering when the NSA open-sourced it. It’s a complete suite: a disassembler for dozens of processor architectures and, crucially, a decompiler that turns machine code back into readable C-like pseudo-code side by side with the assembly. That decompiler put professional-grade RE in reach of everyone, and Ghidra is now a default choice for malware analysis, vulnerability research, and firmware work — with collaborative projects, scripting, and a deep analysis engine on top.

Ghidra is a graphical Java application, launched into its own window from Security → Reverse Engineering → ghidra. Installed from the AUR. It also ships ghidra-analyzeHeadless, a command-line runner for batch and scripted analysis.

The headless runner’s help

For automated analysis, ghidra-analyzeHeadless runs Ghidra’s engine without the GUI:

openjdk version "26.0.2.1" 2026-08-18
OpenJDK Runtime Environment (build 26.0.2.1)
OpenJDK 64-Bit Server VM (build 26.0.2.1, mixed mode)
Headless Analyzer Usage: analyzeHeadless
           <project_location> <project_name>[/<folder_path>]
             | ghidra://<server>[:<port>]/<repository_name>[/<folder_path>]
           [[-import [<directory>|<file>]+] | [-process [<project_file>]]]
           [-preScript <ScriptName>]
           [-postScript <ScriptName>]
           [-scriptPath "<path1>[;<path2>...]"]
           [-propertiesPath "<path1>[;<path2>...]"]
           [-scriptlog <path to script log file>]
           [-log <path to log file>]
           [-overwrite]
           [-mirror]
           [-recursive]
           [-readOnly]
           [-deleteProject]
           [-noanalysis]
           [-processor <languageID>]
           [-cspec <compilerSpecID>]
           [-analysisTimeoutPerFile <timeout in seconds>]
           [-keystore <KeystorePath>]
           [-connect [<userID>]]
           [-p]
           [-commit ["<comment>"]]]
           [-okToDelete]
           [-max-cpu <max cpu cores to use>]
           [-librarySearchPaths <path1>[;<path2>...]]
           [-loader <desired loader name>]
           [-loader-<loader argument name> <loader argument value>]

     - All uses of $GHIDRA_HOME or $USER_HOME in script path must be preceded by '\'

Please refer to 'analyzeHeadlessREADME.html' for detailed usage examples and notes.

Using the GUI

1. Create a project and import your target binary — Ghidra detects the format and architecture.
2. Let auto-analysis run when prompted; it disassembles, finds functions, and propagates types.
3. Work in the Code Browser — the disassembly listing on one side, the decompiled pseudo-code on the other. Rename variables and functions as you understand them, and Ghidra propagates your names.
4. Follow the program through the function graph and cross-references to trace how data and control flow.

Headless example

# Analyze a binary in batch and run an export script
ghidra-analyzeHeadless /tmp/project MyProject -import ./target.bin \
  -postScript ExportDecompiled.java