NationalSecurityAgency / ghidra

查看原文 / View Original 编辑 / Edit

NationalSecurityAgency / ghidra

Ghidra Software Reverse Engineering Framework

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux.

Ghidra 软件逆向工程框架

Ghidra 是由美国国家安全局（NSA）研究部门创建并维护的一套软件逆向工程（SRE）框架。该框架包含一套功能齐全的高端软件分析工具，使用户能够在包括 Windows、macOS 和 Linux 在内的多种平台上分析编译后的代码。

Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra extension components and/or scripts using Java or Python.

其功能包括反汇编、汇编、反编译、图形化分析和脚本编写，以及数百种其他特性。Ghidra 支持多种处理器指令集和可执行文件格式，并可在用户交互模式和自动化模式下运行。用户还可以使用 Java 或 Python 开发自己的 Ghidra 扩展组件和/或脚本。

In support of NSA’s Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems. If you are a U.S. citizen interested in projects like this, to develop Ghidra and other cybersecurity tools for NSA to help protect our nation and its allies, consider applying for a career with us.

为了支持 NSA 的网络安全使命，Ghidra 的构建旨在解决复杂 SRE 工作中的扩展性和团队协作问题，并提供一个可定制、可扩展的 SRE 研究平台。NSA 已将 Ghidra 的 SRE 能力应用于各种问题，包括分析恶意代码，并为寻求深入了解网络和系统潜在漏洞的 SRE 分析师提供深度见解。如果您是美国公民并对这类项目感兴趣，希望为 NSA 开发 Ghidra 及其他网络安全工具以保护我们的国家及其盟友，欢迎考虑加入我们。

Security Warning

WARNING: There are known security vulnerabilities within certain versions of Ghidra. Before proceeding, please read through Ghidra’s Security Advisories for a better understanding of how you might be impacted.

安全警告

警告：Ghidra 的某些版本中存在已知的安全漏洞。在继续操作之前，请阅读 Ghidra 的安全公告，以更好地了解您可能受到的影响。

Install

To install an official pre-built multi-platform Ghidra release:

  1. Install JDK 25 64-bit
  2. Download a Ghidra release file NOTE: The official multi-platform release file is named ghidra_<version>_<release>_<date>.zip which can be found under the “Assets” drop-down. Downloading either of the files named “Source Code” is not correct for this step.
  3. Extract the Ghidra release file NOTE: Do not extract on top of an existing installation
  4. Launch Ghidra: ./ghidraRun (ghidraRun.bat for Windows) or launch PyGhidra: ./support/pyghidraRun (support\pyghidraRun.bat for Windows)

安装

安装官方预构建的多平台 Ghidra 版本：

  1. 安装 JDK 25 64 位版本
  2. 下载 Ghidra 发布文件 注意：官方多平台发布文件名为 ghidra_<version>_<release>_<date>.zip，可在“Assets”下拉菜单中找到。此步骤下载名为“Source Code”的文件是不正确的。
  3. 解压 Ghidra 发布文件 注意：请勿覆盖现有的安装目录进行解压。
  4. 启动 Ghidra：运行 ./ghidraRun（Windows 下为 ghidraRun.bat），或启动 PyGhidra：运行 ./support/pyghidraRun（Windows 下为 support\pyghidraRun.bat）。

For additional information and troubleshooting tips about installing and running a Ghidra release, please refer to the Getting Started document which can be found at the root of a Ghidra installation directory.

有关安装和运行 Ghidra 版本的更多信息及故障排除提示，请参阅位于 Ghidra 安装目录根目录下的《入门指南》（Getting Started）文档。

Build

To create the latest development build for your platform from this source repository:

  • Install build tools:
    • JDK 25 64-bit
    • Gradle 9.1.0+ (or provided Gradle wrapper if Internet connection is available)
    • Python3 (version 3.9 to 3.14) with bundled pip
    • GCC or Clang, and make (Linux/macOS-only)
    • Microsoft Visual Studio 2017+ or Microsoft C++ Build Tools with the following components installed (Windows-only): MSVC, Windows SDK, C++ ATL

构建

要从源代码仓库为您的平台创建最新的开发版本：

  • 安装构建工具：

    • JDK 25 64 位版本
    • Gradle 9.1.0+（如果网络连接可用，也可使用提供的 Gradle wrapper）
    • Python3（版本 3.9 至 3.14），包含 pip
    • GCC 或 Clang，以及 make（仅限 Linux/macOS）
    • Microsoft Visual Studio 2017+ 或 Microsoft C++ Build Tools，并安装以下组件（仅限 Windows）：MSVC、Windows SDK、C++ ATL

  • Download and extract the source:

    • Download from GitHub
    • unzip ghidra-master
    • cd ghidra-master
    • NOTE: Instead of downloading the compressed source, you may instead want to clone the GitHub repository: git clone https://github.com/NationalSecurityAgency/ghidra.git

  • 下载并解压源代码：

    • 从 GitHub 下载
    • unzip ghidra-master
    • cd ghidra-master
    • 注意：除了下载压缩包，您也可以选择克隆 GitHub 仓库：git clone https://github.com/NationalSecurityAgency/ghidra.git

  • Download additional build dependencies into source repository:

    • NOTE: If an Internet connection is available and you did not install Gradle, the ./gradlew (or gradlew.bat) command may be used in place of the gradle command in the following instructions.
    • gradle -I gradle/support/fetchDependencies.gradle

  • 将额外的构建依赖项下载到源代码仓库中：

    • 注意：如果网络连接可用且您未安装 Gradle，则可以在以下指令中使用 ./gradlew（或 gradlew.bat）命令代替 gradle 命令。
    • gradle -I gradle/support/fetchDependencies.gradle

  • Create development build:

    • gradle buildGhidra
    • The compressed development build will be located at build/dist/. For more detailed information on building Ghidra, please read the Developer’s Guide. For issues building, please check the Known Issues section for possible solutions.

  • 创建开发版本：

    • gradle buildGhidra
    • 压缩后的开发版本将位于 build/dist/ 目录下。有关构建 Ghidra 的更多详细信息，请阅读《开发者指南》（Developer’s Guide）。如果构建过程中遇到问题，请查看“已知问题”（Known Issues）部分以获取可能的解决方案。

Develop User Scripts and Extensions

Ghidra installations support users writing custom scripts and extensions via the GhidraDev plugin for Eclipse. The plugin and its corresponding instructions can be found within a Ghidra release at Extensions/Eclipse/GhidraDev/ or at this link. Alternatively, Visual Studio Code may be used to edit scripts by clicking the Visual Studio Code icon in the Script Manager. Fully-featured Visual Studio Code projects can be created from a Ghidra CodeBrowser window at Tools -> Create VSCode Module project.

开发用户脚本和扩展

Ghidra 安装支持用户通过 Eclipse 的 GhidraDev 插件编写自定义脚本和扩展。该插件及其相关说明可在 Ghidra 发布包的 Extensions/Eclipse/GhidraDev/ 目录下或此链接中找到。此外，也可以通过点击脚本管理器（Script Manager）中的 Visual Studio Code 图标，使用 Visual Studio Code 编辑脚本。功能齐全的 Visual Studio Code 项目可以通过 Ghidra CodeBrowser 窗口中的 Tools -> Create VSCode Module project 创建。

NOTE: Both the GhidraDev plugin for Eclipse and Visual Studio Code integrations only support developing against fully built Ghidra installations which can be downloaded from the Releases page.

注意：Eclipse 的 GhidraDev 插件和 Visual Studio Code 集成均仅支持针对已完整构建的 Ghidra 安装进行开发，这些安装包可从“Releases”页面下载。

Advanced Development

To develop the Ghidra tool itself, it is highly recommended to use Eclipse, which the Ghidra development process has been highly customized for.

  1. Install build and development tools: Follow the above build instructions so the build completes without errors
  2. Install Eclipse IDE for Java Developers
  3. Prepare the development environment: gradle prepdev eclipse buildNatives
  4. Import Ghidra projects into Eclipse:
    • File -> Import...
    • General | Existing Projects into Workspace
    • Select root directory to be your downloaded or cloned ghidra source repository
    • Check “Search for nested projects”
    • Click “Finish”

高级开发

要开发 Ghidra 工具本身，强烈建议使用 Eclipse，Ghidra 的开发流程已针对该 IDE 进行了深度定制。

  1. 安装构建和开发工具：遵循上述构建说明，确保构建无误完成。
  2. 安装 Eclipse IDE for Java Developers。
  3. 准备开发环境：gradle prepdev eclipse buildNatives
  4. 将 Ghidra 项目导入 Eclipse：
    • File -> Import...
    • General | Existing Projects into Workspace
    • 选择您下载或克隆的 Ghidra 源代码仓库作为根目录
    • 勾选“Search for nested projects”
    • 点击“Finish”

When Eclipse finishes building the projects, Ghidra can be launched and debugged with the provided Ghidra Eclipse run configuration. For more detailed information on developing Ghidra, please read the Developer’s Guide.

当 Eclipse 完成项目构建后，即可使用提供的 Ghidra Eclipse 运行配置来启动和调试 Ghidra。有关开发 Ghidra 的更多详细信息，请阅读《开发者指南》。

Contribute

If you would like to contribute bug fixes, improvements, and new features back to Ghidra, please take a look at our Contributor’s Guide to see how you can participate in this open source project.

贡献

如果您希望为 Ghidra 贡献错误修复、改进和新功能，请查看我们的《贡献者指南》（Contributor’s Guide），了解如何参与到这个开源项目中。

← 返回新闻列表 / Back to news list