NationalSecurityAgency/ghidra

Ghidra is a software reverse engineering (SRE) framework

SecurityJava#software-analysis#disassembler#reverse-engineering

5.0 Breakout Magnitude out of 10. Star growth looks organic. Data as of September 18, 2026.

About the project

A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.

Useful for

Disassemble and decompile a binary to look for vulnerabilities
Write a Python or Java script to automate analysis of malware samples
Extend Ghidra with a custom plugin via GhidraDev for Eclipse or VS Code

README summarized by DeepSeek V4.1 Flash. Details may be inaccurate.

Why it’s trending

175 stars so far today, about 261 expected by the end of the day. The usual pace is 92 per day, so that's 2.8× as much.
Over the last two days the pace is 1.9× that of the previous week and a half.
The spike has held for 2 days in a row — not a one-off blip.
About 41 forks a day — people are taking the code.

Stars per day

Bars are daily stars, the line is the usual pace. Red marks spike days.

Numbers

Total stars: 78,850
Stars in a day: 261
Forks: 8,716
Issues and pull requests: 8,089
Watchers: 1,159
Language: Java
License: Apache-2.0
Latest release: Ghidra_12.1.3_build · August 18, 2026
Created: March 1, 2019
Last push: September 18, 2026

Star trust

Growth looks organic: forks and discussion are in line with active projects, and stars arrive unevenly, the way people give them.

These are heuristics, not a verdict: we judge by the repository’s behavior, not by a list of stargazers.

Spotted in

September 18, 2026GitHub Trending today: #7, +912 stars
September 17, 2026GitHub Trending today: #7, +912 stars
September 16, 2026GitHub Trending today: #8, +1,059 stars
September 15, 2026GitHub Trending today: #8, +755 stars

README badge

Paste it into your README — the badge shows the current magnitude and links to this page.

[![Seismograph](https://gitnova.dev/badge/NationalSecurityAgency/ghidra.svg?lang=en)](https://gitnova.dev/en/r/NationalSecurityAgency/ghidra)

Similar projects

9.7
cloudflare/security-audit-skill
A coding-agent skill that turns the agent into a security auditor, running a multi-phase code audit with independently verified, machine-readable findings.

BreakoutSecurityJavaScript+2,334 stars in a day
6.6
yynxxxxx/gpt_sub_analysis
A guide to analyzing the ChatGPT iOS subscription flow: it describes intercepting the buyProduct request via Reqable and SSL Kill Switch 3 and rewriting the offerName and salableAdamId fields to obtain the Pro 20x…

Early signalSecurity+157 stars in a day
5.9
ctdal/cve-2026-41940-PoC
PoC exploit for CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0) that grants unauthenticated root-level WHM access by injecting CRLF sequences into server-side session files.

Early signalSecurityPython+64 stars in a day
5.3
BennyThink/NFCX
Cross-platform GUI desktop app for NFC card work: reader discovery, MIFARE Classic reads, dumps, key management, and key recovery. For cards you own or are authorized to test.

Early signalSecurityGo+38 stars in a day
4.6
shinthink/blitzstrike
A TypeScript/Bun MCP server packaging a pentest methodology into three tiers: attack-surface reconnaissance, source-to-sink tracing, and live validation of findings before reporting.

Early signalSecurityTypeScript+42 stars in a day
4.6
bl4ckarch/go-responder
A Go port of Responder: poisons LLMNR, NBT-NS and mDNS, runs rogue servers (SMB, HTTP, LDAP, etc.) and captures NTLM hashes and cleartext credentials.

Early signalSecurityGo+35 stars in a day