Ghidra is a software reverse-engineering framework used to inspect compiled programs when source code is unavailable. It provides disassembly, decompilation, control-flow graphing, and scripting, helping analysts turn raw machine code into readable function logic and data structures.
In cyber security, Ghidra matters because it speeds up malware triage, vulnerability research, firmware analysis, and patch comparison. Defenders use it to trace how a binary parses input, makes network calls, or enforces access checks, while attackers can use the same capabilities to study protections, understand competitors’ code, or adapt malicious payloads. Its scripting and automation features are especially useful for repetitive tasks such as renaming functions, extracting strings, and analyzing many samples at scale. Because reverse engineering often guides detection and remediation, Ghidra is a core tool in both offensive research and defensive analysis.