# NationalSecurityAgency/ghidra

> A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.

- Magnitude: 4.4 out of 10 — Steady
- Stars: 97,122 total · +352 stars measured 2026-11-02, 00:09–19:55 UTC, ≈ 418 by evening
- Star trust: star growth looks organic
- Category: Security · Language: Java · License: Apache-2.0 · Created: 2019-03-01 · Last push: 2026-11-02
- GitHub: https://github.com/NationalSecurityAgency/ghidra · Page: https://gitnova.dev/en/r/NationalSecurityAgency/ghidra

## Useful for

- Disassemble and decompile a binary to look for vulnerabilities
- Write a Python or Java script to automate analysis of malware samples
- Extend Ghidra with a custom plugin via GhidraDev for Eclipse or VS Code

## Why it’s here

- Star-counter measurements on 2026-11-02 (UTC), 00:09–19:55: 96770 → 97122 stars (+352). This is the change over that interval.
- Estimated end-of-day forecast: about +418 stars, using observed gains and the previous day.
- GitHub Trending this month: #9, +16,858 stars.
- About 62 forks a day — people are taking the code.
- Recent forks include notable developers: @ashiquebiniqbal (221 followers).

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 10,983
- Issues and pull requests: 8,522
- Watchers: 1,203
- Average over the last week: 369 per day
- Usual pace: 564 per day
- Stars in the last hour (measured): 14
- Latest release: Ghidra_12.2_build (2026-10-22)

## Stars per day, last 30 days (oldest → newest, today is partial)

2026-10-04 … 2026-11-02: 191, 247, 315, 331, 298, 496, 592, 953, 1696, 1049, 1298, 1185, 753, 635, 692, 656, 575, 467, 553, 445, 332, 354, 420, 345, 476, 355, 303, 289, 398, 352

## Magnitude by day, last 14 days

10-20 4.5, 10-21 4.2, 10-22 4.1, 10-23 4.3, 10-24 4.1, 10-25 4.1, 10-26 4.1, 10-27 4.3, 10-28 4.2, 10-29 4.4, 10-30 3.9, 10-31 3.8, 11-01 3.7, 11-02 4.4

## Spotted in now

- GitHub Trending this month: #9, +16,858 stars

## Similar by description

1. **nanashili/rea-rust** — 0.0 · Steady · Security · Rust · Not enough measurements today
   A local-only reverse-engineering tool written in Rust: inspect binaries, decompile functions, analyze JavaScript/Electron apps and mobile artifacts via CLI or MCP client. Runs without Node.js or a JVM, using a native Ghidra worker.
   Full card: https://gitnova.dev/en/r/nanashili/rea-rust.md
2. **yuatemycat/SuperGhidra** — 1.3 · Steady · AI agents · Python · +1 star measured 2026-11-02, 00:14–20:06 UTC, ≈ 1 by evening
   A Python toolkit for binary reverse engineering: a warm lock-free Ghidra daemon, MSVC RTTI/MFC class recovery, and rewriting decompiler output into compilable C. Runs standalone or via MCP for agents.
   Full card: https://gitnova.dev/en/r/yuatemycat/SuperGhidra.md
3. **x86rc/unthemidator** — 1.0 · Cooling · Security · C++ · +2 stars measured 2026-11-02, 00:14–20:07 UTC, ≈ 2 by evening
   A universal unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0–v4), with PE rebuild, import restoration and VM version identification.
   Full card: https://gitnova.dev/en/r/x86rc/unthemidator.md
4. **SubmitGame/awesome-decomp-games** — 2.1 · Steady · Games & graphics · Python · +30 stars measured 2026-11-02, 00:13–20:01 UTC, ≈ 36 by evening
   An auto-refreshed rated list of decompiled, recompiled and reverse-engineered games: source ports, engine remakes, browser ports and disassemblies.
   Full card: https://gitnova.dev/en/r/SubmitGame/awesome-decomp-games.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-11-02 20:10 UTC, updated every 30 minutes.