NSA Researchers Talk Development, Release of Ghidra SRE Tool

NSA researchers took the Black Hat stage to share details of how they developed and released the software reverse-engineering framework.

The National Security Agency released its classified Ghidra software reverse-engineering (SRE) tool as open source to the cybersecurity community on April 4. NSA researchers Brian Knighton and Chris Delikat shared how Ghidra was built and the process of releasing it at Black Hat 2019.
Ghidra is a framework developed by the NSAs Research Directorate for the agencys cybersecurity mission. Its designed to analyze malicious code to give security pros a better understanding of potential vulnerabilities in their networks and systems. To do this, it comes with software analysis tools to research code on Windows, macOS, and Linux, and capabilities including disassembly, assembly, decompilation, graphing, and scripting, among others.
Ghidra has been on going project in research for many years now, said Delikat, researcher and cyber team lead for the NSA, in their Black Hat briefing. The tool has been in development for roughly 20 years, he added, and its meant to be a foundation to support future research. The NSA publicly released Ghidra in March at RSA ahead of its open source debut in April.
Why use SRE? Organizations may find a binary on their network and want to analyze it for vulnerabilities so they can defend themselves, Delikat continued. If theres a binary on your network you didnt put there, youll want to figure out what its doing and where it came from. Back in 2000, when development began, there werent any tools to do these things, he noted. Now, as software grows and the possibility of vulnerabilities increases, the agency wanted to give organizations a framework to explore potential malware on progressively larger networks.
The was to bring three key features — scaling, teaming, and extendability — into a single body of work, said Knighton, Ghidra developer and IoT vulnerability researcher at the NSA.
Delikat and Knighton elaborated on some of the details and design decisions involved with building Ghidra. Its a project-based framework, meaning instead of bringing in a single binary to investigate, researchers can create a project and include all the binaries they want to analyze. A Project Window provides a view where a binary can be annotated and marked up.
A file system browser, introduced after Ghidra was created, lets researchers drill down into firmware bundles, Delikat continued. Its script manager can be used to automate tasks and find functions. Researchers can write scripts in Java or Python, which was added after Ghidra was open sourced. If someone else wanted to add Ruby, he noted, theyd be able to do that.
Developers chose Java for the tool because of its popularity in the early 2000s, said Knighton. They tried C++ but the language didnt give a platform-independent GUI from the start. If they were building today, theyd still use Java, he said, but would likely do things differently.
Government policies pushed Ghidra over the finish line. Delikat pointed to
Executive Order
13691, Promoting Private Sector Cybersecurity Information Sharing, which was issued on February 13, 2015, and recognizes that organizations engaged in sharing information related to security risks and incidents have an invaluable role in national cybersecurity. The EO encourages the development of organizations to share data, establishes mechanisms to improve their capabilities, and aims to make it easier for them to voluntarily partner with the government.
Using the same tool across different groups is really going to improve the ability to share, Delikat said. Open sourcing Ghidra was a slow process: The NSA did a prepublication review in which two people reviewed each line of code. Think about any internal software project youve got in-house for a decade or more, he added. Now all of a sudden, you want to make it open source so everyone can download it. … This was a moonshot for us.
The next version of Ghidra, 9.1, will be coming out soon and bring additional processor modules, support for data type bit fields, and support for SysCalls and a Sleigh editor. In the future, they hope to bring Android OAT/ART support, a debugger, and external engagement.
Part of what were trying to leverage by getting the tool into the open source community is the creativity, said Knighton.
Related Content:
The Flaw in Vulnerability Management: Its Time to Get Real
5 Things to Know About Cyber Insurance
The State of IT Operations and Cybersecurity Operations
7 Biggest Cloud Security Blind Spots
Stronger Defenses Force Cybercriminals to Rethink Strategy
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
5 Things to Know About Cyber Insurance.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
NSA Researchers Talk Development, Release of Ghidra SRE Tool