Ghidra

v11.1.2National Security Agency

Loads binaries, disassembles, decompiles to a C-like pseudocode and lets an analyst pivot on symbols and cross-references. The range ships headless analysis over the authored binary artifacts (pseudocode and functions are authored, not synthesised).

Category: Digital forensics & reverse engineering
Package: ghidra
Runs on: Linux · Windows
Commands: ghidra, ghidraRun, analyzeHeadless

Loads authored binary artifacts and prints their authored decompilation. No CPU emulation runs.

Install it

The scripts below install the real National Security Agency package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-ghidra.sh

Ghidra is delivered as Release archive, so it cannot be installed unattended. Follow the steps on the package page instead.

Windows installer (PowerShell)

Install-ghidra.ps1

Ghidra has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Release archive

Fetch the release and check its signature
Compare the published checksum before unpacking anything.
Unpack it under /opt
```
sudo unzip ghidra.zip -d /opt/
```

Put the launcher on PATH

sudo ln -s /opt/ghidra/ghidra /usr/local/bin/ghidra

Check it worked

Confirm it landed on PATH
```
which ghidra
```
Check the version
```
ghidra --version
```
The range reports 11.1.2.

Remove it

Take it off again
```
sudo apt remove --purge ghidra
```

On Windows

Release archive

Unblock the download first
```
Unblock-File .\ghidra.zip
```
Windows marks anything from the internet; unblock it or the extract fails.

Unpack it under C:\Tools

Expand-Archive .\ghidra.zip -DestinationPath C:\Tools\ghidra

Put it on PATH
```
setx PATH "$env:PATH;C:\Tools\ghidra"
```

Check it worked

Confirm it resolves
```
where ghidra
```
Check the version
```
ghidra --version
```
The range reports 11.1.2.

Remove it

Take it off again

Remove-Item -Recurse -Force C:\Tools\ghidra

Inside the range

Tick it on the launch screen
Under Ghidra's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y ghidra
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Ghidra

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.