Ghidra

Ghidra is a Software Reverse Engineering (SRE) framework developed by the National Security Agency (NSA) Research Directorate. It is a free and open source software suite released under the Apache 2.0 license that allows users to analyze compiled code, reverse engineer software programs and analyze malware. Ghidra is available for Windows, Linux, and macOS.

Features:

• Multiplatform Support: Ghidra runs on Windows 10 and later, Linux, and macOS.

Ghidra provides a powerful suite of tools for reverse engineering software, allowing users to quickly analyze and understand complex code.

• Scripting: Ghidra offers scripting and extension development in Java and Python, including the PyGhidra mode.

• Decompiler: Ghidra's decompiler turns machine code into readable C-like pseudocode.

• Analyzer: Ghidra's auto-analysis can automatically detect code patterns and provide users with information about the functions within a program.

• Debugger: Ghidra's debugger connects to native debuggers such as GDB, LLDB and WinDbg to trace the execution of a program.

• Version Tracking: Ghidra can compare two versions of a binary and port existing analysis results from one version to the other.

• Extensions: Ghidra can be extended with plugins and extensions, and many third-party extensions are available.

• Shared Projects: Ghidra stores programs and analysis results in projects, which a team can share through a Ghidra Server.

• Graphs: Ghidra's function graph and call graph views allow users to visualize control flow and program structure.

• Processor Support: Ghidra supports a wide variety of processor instruction sets and executable formats such as PE, ELF and Mach-O.

• Automation: Ghidra can be used interactively or in headless mode for automated batch analysis.

• Documentation: Ghidra includes extensive documentation and tutorials, making it easy to learn and use.