# nationalsecurityagency/ghidra architecture

> Architecture diagram of the GitHub repository nationalsecurityagency/ghidra, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nationalsecurityagency/ghidra
- Repository: https://github.com/nationalsecurityagency/ghidra

## Overview

Ghidra is an extensible software reverse-engineering framework for interactive and automated analysis. The documented user workflow is to load compiled code, inspect or transform it with analysis tools, and use results such as disassembly, decompilation, graphs, and scripts. Its architecture also includes platform/language and executable-format support, function-identification and similarity-search capabilities, and a debugger with trace navigation. The README establishes these product capabilities; sampled source and the SOURCE INDEX provide only partial evidence for internal connections, so undocumented workflow links are omitted.

Main entry points: [`Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java`](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java) (Plugin Tool), [`Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java`](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java) (Program Model), [`Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java`](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java) (Trace Manager), [`Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java`](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java) (Loader Selection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_core["Analysis Platform"]
  node_app["Application Runtime<br/>[Application.java]"]
  node_tool["Plugin Tool<br/>[PluginTool.java]"]
end

subgraph group_formats["Program Models"]
  node_loader["Loader Selection"]
  node_language["Language Model<br/>[Language.java]"]
  node_program["Program Model<br/>[Program.java]"]
  node_address["Address Model<br/>[AddressSpace.java]"]
  node_functions["Function Model<br/>[Function.java]"]
  node_datatypes["Data Types<br/>[DataType.java]"]
  node_datatype_query["Type Query"]
end

subgraph group_debug["Debugging"]
  node_debug_service["Trace Manager"]
  node_trace["Trace Model<br/>[Trace.java]"]
  node_trace_platform["Trace Platform<br/>[TracePlatform.java]"]
  node_trace_thread["Trace Thread<br/>[TraceThread.java]"]
end

subgraph group_search["Code Search"]
  node_fid["Function ID"]
  node_bsim["Similarity Search"]
  node_database[("BSim Database")]
end

node_analyst(("Analyst"))

node_analyst -.->|"uses"| node_tool
node_tool -.->|"selects format"| node_loader
node_loader -->|"queries language"| node_language
node_tool -.->|"analyzes program"| node_program
node_program -->|"uses language"| node_language
node_program -.->|"uses addresses"| node_address
node_program -.->|"models functions"| node_functions
node_program -.->|"uses types"| node_datatypes
node_tool -.->|"queries types"| node_datatype_query
node_datatype_query -->|"queries"| node_datatypes
node_tool -.->|"navigates traces"| node_debug_service
node_debug_service -->|"manages trace"| node_trace
node_debug_service -->|"activates platform"| node_trace_platform
node_debug_service -->|"resolves thread"| node_trace_thread
node_tool -.->|"identifies functions"| node_fid
node_tool -.->|"searches similarity"| node_bsim
node_bsim -->|"queries database"| node_database

click node_app "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/Generic/src/main/java/ghidra/framework/Application.java"
click node_tool "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java"
click node_loader "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java"
click node_language "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/lang/Language.java"
click node_program "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java"
click node_address "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java"
click node_functions "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java"
click node_datatypes "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataType.java"
click node_datatype_query "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java"
click node_debug_service "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java"
click node_trace "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/Trace.java"
click node_trace_platform "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/guest/TracePlatform.java"
click node_trace_thread "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/thread/TraceThread.java"
click node_fid "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/db/FidQueryService.java"
click node_bsim "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java"
click node_database "https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/FunctionDatabase.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_tool toneBlue
class node_loader,node_language,node_program,node_address,node_functions,node_datatypes,node_datatype_query toneAmber
class node_debug_service,node_trace,node_trace_platform,node_trace_thread toneMint
class node_fid,node_bsim,node_database toneRose
class node_analyst toneIndigo
```

## Components

### Analysis Platform

- [Application Runtime](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/Generic/src/main/java/ghidra/framework/Application.java): `Ghidra/Framework/Generic/src/main/java/ghidra/framework/Application.java`
- [Plugin Tool](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java): `Ghidra/Framework/Project/src/main/java/ghidra/framework/plugintool/PluginTool.java`

### Program Models

- [Loader Selection](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java): `Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java`
- [Language Model](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/lang/Language.java): `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/lang/Language.java`
- [Program Model](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java): `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java`
- [Address Model](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java): `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java`
- [Function Model](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java): `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java`
- [Data Types](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataType.java): `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/data/DataType.java`
- [Type Query](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java): `Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java`

### Debugging

- [Trace Manager](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java): `Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java`
- [Trace Model](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/Trace.java): `Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/Trace.java`
- [Trace Platform](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/guest/TracePlatform.java): `Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/guest/TracePlatform.java`
- [Trace Thread](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/thread/TraceThread.java): `Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/model/thread/TraceThread.java`

### Code Search

- [Function ID](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/db/FidQueryService.java): `Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/db/FidQueryService.java`
- [Similarity Search](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java): `Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java`
- [BSim Database](https://github.com/nationalsecurityagency/ghidra/blob/master/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/FunctionDatabase.java): `Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/FunctionDatabase.java`

### Other components

- **Analyst**

## Connections

- Analyst → Plugin Tool: uses
- Plugin Tool → Loader Selection: selects format
- Loader Selection → Language Model: queries language (evidence: `Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/QueryOpinionService.java`)
- Plugin Tool → Program Model: analyzes program
- Program Model → Language Model: uses language (evidence: `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Program.java`)
- Program Model → Address Model: uses addresses (evidence: `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/address/AddressSpace.java`)
- Program Model → Function Model: models functions (evidence: `Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java`)
- Program Model → Data Types: uses types
- Plugin Tool → Type Query: queries types
- Type Query → Data Types: queries (evidence: `Ghidra/Features/Base/src/main/java/ghidra/app/services/DataTypeQueryService.java`)
- Plugin Tool → Trace Manager: navigates traces
- Trace Manager → Trace Model: manages trace (evidence: `Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java`)
- Trace Manager → Trace Platform: activates platform (evidence: `Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java`)
- Trace Manager → Trace Thread: resolves thread (evidence: `Ghidra/Debug/Debugger-api/src/main/java/ghidra/app/services/DebuggerTraceManagerService.java`)
- Plugin Tool → Function ID: identifies functions
- Plugin Tool → Similarity Search: searches similarity
- Similarity Search → BSim Database: queries database (evidence: `Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/facade/SimilarFunctionQueryService.java`)