84,300 read from the page; ungh's six-week-old snapshot gives 73,361 and was not used stars · Apache-2.0, read from /blob/master/LICENSE, standard text with THE COPYRIGHT HOLDER PLACEHOLDER UNFILLED — the only copyright line is 'Copyright [yyyy] [name of copyright owner]'. A separate NOTICE file names the National Security Agency, states that portions written by US federal employees in the course of their work are generally public domain, and records that third-party components carry their own compatible licences. A GPL/ directory holds standalone support programs under GPL 3, executed as separate processes for that reason; its README could not be opened and the /licenses/ tree view is robots-disallowed. · Ghidra_12.1.4_build, the release page reading '21 Sep 17:38' with no year and settled as 2026-09-21T17:38:59Z by ungh's releases endpoint, which matches to the minute. No package registry publishes this project, so the usual registry route did not exist. Siblings: 12.1.3 of 2026-08-18, 12.1.2 of 2026-06-05. · Track this in Scout
A reverse-engineering suite that disassembles a compiled program and decompiles it into readable C-like code.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a compiled program — a Windows, macOS or Linux executable, or firmware from a device. It identifies the processor and the file format, breaks the file into instructions, and then produces C-like code that approximates what the original source did. It draws control-flow graphs so you can see the shape of a function. You work through a window-based interface, marking up names and types as you learn them, and the whole project can be shared with other analysts. It also runs with no interface at all, so a batch of files can be processed by a script. Scripts and extensions are written in Java or Python. What it does not do is run the program: this is static analysis, reading the file rather than watching it execute. Its own README also warns that some versions have known security holes and points at the published advisories.
Why it matters
Who it suits. Anyone who has to understand a binary they did not build: malware analysts, firmware engineers, people auditing a vendor's shipped product, and students learning how compiled code works. It also suits anyone who needs a second opinion on what a closed-source dependency is doing. Skip it if you have the source code — reading the source is always easier, and this is a last resort by design.
Verdict. Worth the time if the work genuinely calls for it, and a long detour if it does not; expect weeks rather than evenings before the output stops looking like noise. The decompiler is the reason to choose this over the older command-line tools: it is strong, it is free, and before 2019 nothing of its quality was available without a very large licence fee. radare/radare2 is the command-line alternative and is faster to drive once learned, while angr/angr is the one to reach for when you want a program to reason about the binary rather than a person. Note the licensing shape before building on it: the main tree is Apache-2.0, but several helper programs in the GPL folder are GPL-3 and are run as separate processes for that reason.
- A decompiler of commercial quality, free, covering a very wide range of processors.
- Runs with no interface, so a batch of files can be analysed by a script.
- Extensions and scripts in Java or Python, and a shared project mode for several analysts.
- A long learning curve, and the README names no supported processor list, so you find out by trying.
- Needs Java: version 21 to run, version 25 plus Gradle 9.1.0 or newer to build from source.
- Its own README warns that certain versions carry known security holes, and tells you not to extract a new release over an existing installation.
- radare/radare2
The long-standing command-line framework for the same job, at 25,000 stars, with code on 12 October 2026; harder to learn and faster once learned.
Track this in Scout - angr/angr
A Python platform for analysing binaries programmatically rather than by hand, at 8,970 stars, last code 25 July 2026.
Track this in Scout - rizinorg/rizin
A fork of radare2 aiming at a cleaner interface, at 3,784 stars, last code 17 August 2026.
Track this in Scout
./ghidraRun
