How nationalsecurityagency/ghidra works
Ghidra is an extensible software reverse-engineering framework for interactive and automated analysis. The documented user workflow is to load compiled code, inspect or transform it with analysis tools, and use results such as disassembly, decompilation, graphs, and scripts. Its architecture also includes platform/language and executable-format support, function-identification and similarity-search capabilities, and a debugger with trace navigation. The README establishes these product capabilities; sampled source and the SOURCE INDEX provide only partial evidence for internal connections, so undocumented workflow links are omitted.
Main entry points: PluginTool.java Plugin Tool · Program.java Program Model · DebuggerTraceManagerService.java Trace Manager · QueryOpinionService.java Loader Selection
Components 17
Analysis Platform
- Application Runtime
Ghidra/Framework/Generic/src/main/java/ghidra/framework/Application.java - Plugin Tool
Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java
Program Models
- Loader Selection
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java - Language Model
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/lang/Language.java - Program Model
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java - Address Model
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java - Function Model
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java - Data Types
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataType.java - Type Query
Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java
Debugging
- Trace Manager
Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java - Trace Model
Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/Trace.java - Trace Platform
Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/guest/TracePlatform.java - Trace Thread
Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/thread/TraceThread.java
Code Search
- Function ID
Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/db/FidQueryService.java - Similarity Search
Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java - BSim Database
Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/FunctionDatabase.java
Other components
- Analyst
Connections 17
- Analyst → Plugin Tool: uses
- Plugin Tool → Loader Selection: selects format
- Loader Selection → Language Model: queries language
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java - Plugin Tool → Program Model: analyzes program
- Program Model → Language Model: uses language
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java - Program Model → Address Model: uses addresses
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java - Program Model → Function Model: models functions
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java - Program Model → Data Types: uses types
- Plugin Tool → Type Query: queries types
- Type Query → Data Types: queries
Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java - Plugin Tool → Trace Manager: navigates traces
- Trace Manager → Trace Model: manages trace
Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java - Trace Manager → Trace Platform: activates platform
Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java - Trace Manager → Trace Thread: resolves thread
Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java - Plugin Tool → Function ID: identifies functions
- Plugin Tool → Similarity Search: searches similarity
- Similarity Search → BSim Database: queries database
Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java