Automic VaultAutomic Vault

brew

Install ghidra with Homebrew, apk, chocolatey, MacPorts, Nix, pacman, scoop

Multi-platform software reverse engineering framework. Version 12.1.2 via Homebrew; verified 2026-06-05.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install ghidra

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install ghidra

MacPorts ports tree · devel/ghidra/Portfile · source: api.github.com

Windows

Chocolateyverified · 92%
choco install ghidra

Chocolatey community package catalog · ghidra · source: community.chocolatey.org

Scoopverified · 92%
scoop install extras/ghidra

Scoop official bucket manifest trees · bucket/ghidra.json · source: api.github.com

overview

Package summary

Multi-platform software reverse engineering framework

Commands and aliases

  • ghidraRun
  • pyghidraRun

history

Project history and usage

Ghidra is NSA's open-source software reverse engineering framework, combining disassembly, decompilation, graphing, scripting, collaboration, and extension development across many processor architectures and executable formats.

Project history

NSA publicly released Ghidra at the 2019 RSA Conference after years of research and development aimed at difficult software reverse engineering mission problems. The project README says it was built to solve scaling and teaming problems on complex analysis efforts and to provide a customizable research platform.

Adoption history

NSA described the public reaction as overwhelming after release, with hundreds of thousands of downloads and millions of website views in the first days. Four years later, NSA reported more than one million public downloads, use in college curricula, books and videos, operational use by technology and cybersecurity companies, and community contributions through GitHub.

How it is used

Practitioners use Ghidra interactively for reverse engineering compiled code and in automated modes for batch analysis. Common workflows include importing binaries, disassembling and decompiling functions, using the Sleigh processor specification language and P-code model, writing Java or Python scripts, and building extensions.

Why package nerds care

Ghidra became significant to security packagers because a high-end reverse engineering suite moved from a government internal tool to a redistributable Apache-licensed project. The official release packaging is a multi-platform zip rather than a traditional installer, which made package-manager formulas and wrappers valuable for users who prefer reproducible installs.

Timeline

  • 2019: NSA released Ghidra to the public at RSA Conference.
  • 2019: The public GitHub repository and Ghidra 9.0.1 release appeared.
  • 2023: NSA reported more than one million public downloads across the first four years.

Related projects

  • The Ghidra source tree includes PyGhidra, GhidraDev, Sleigh, a headless analyzer, a server component, and extension APIs for Java and Python users.

Sources

security posture

Risk level: red

escape, surveillance, or offensive capability signal.

Risk classifier

red risk · medium confidence · escape-surveillance-offensive

Why

  • escape, surveillance, or offensive capability signal

Signals

  • text:reverse engineering

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Installs with 1 runtime dependencies.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
ghidraRuncliglobal executable
pyghidraRuncliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version12.1.2
manager updated2026-06-05
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/NationalSecurityAgency/ghidra

install metadata

Package metadata

Package keybrew:ghidra
Version12.1.2
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/ghidra
Homepagehttps://github.com/NationalSecurityAgency/ghidra
Repositoryhttps://github.com/NationalSecurityAgency/ghidra
Upstream docshttps://ghidra-sre.org/
LicenseApache-2.0
Source archivehttps://github.com/NationalSecurityAgency/ghidra/archive/refs/tags/Ghidra_12.1.2_build.tar.gz
Last updated2026-06-05T21:47:28Z
Pulseupdated
Dependenciesopenjdk@21
Build dependenciesgradle, python@3.14
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Nameghidra
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

ghidra

nix profile install nixpkgs#ghidra
  • normalized package name match
  • Matched by: Ghidra
nixpkgs package indexes · raw.githubusercontent.com · nixpkgs package indexes: ghidra from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix
apk95%

ghidra 12.0.4-r0

A Cross Platform and Open Source Electronics Design Automation Suite

https://ghidra-sre.org/

sudo apk add ghidra
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: ghidra
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ghidra
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: ghidra from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

ghidra-doc 12.0.4-r0

A Cross Platform and Open Source Electronics Design Automation Suite (documentation)

https://ghidra-sre.org/

sudo apk add ghidra-doc
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: ghidra
  • normalized package name match
  • Matched by: Ghidra
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: ghidra-doc from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

ghidra-tutorials 12.0.4-r0

Ghidra tutorial files

https://ghidra-sre.org/

sudo apk add ghidra-tutorials
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: ghidra
  • 1 dependencies
  • normalized package name match
  • Matched by: Ghidra
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: ghidra-tutorials from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
pacman95%

ghidra 12.1.2-1

Software reverse engineering framework

https://ghidra-sre.org/

sudo pacman -S ghidra
  • License: Apache-2.0
  • Architecture: x86_64
  • 7 dependencies
  • 1 optional deps
  • normalized package name match
  • Matched by: Ghidra
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: ghidra from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
MacPorts95%

ghidra

sudo port install ghidra
  • normalized package name match
  • Matched by: Ghidra
MacPorts ports tree · api.github.com · MacPorts ports tree: devel/ghidra/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Chocolatey95%

ghidra

choco install ghidra
  • normalized package name match
  • Matched by: Ghidra
Chocolatey community package catalog · community.chocolatey.org · Chocolatey community package catalog: ghidra from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','gawk'
Scoop95%

extras/ghidra

scoop install extras/ghidra
  • normalized package name match
  • Matched by: Ghidra
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/ghidra.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • openjdk@21Runtime dependency declared by Homebrew.
  • gradleBuild dependency declared by Homebrew.
  • python@3.14Build dependency declared by Homebrew.

Same workflow

  • retdecShares av.db curated category or tags: cli, decompiler, reverse-engineering, security.
  • rizinShares av.db curated category or tags: cli, disassembler, reverse-engineering, security.
  • jadxShares av.db curated category or tags: cli, decompiler, reverse-engineering, security.
  • radare2Shares av.db curated category or tags: cli, disassembler, reverse-engineering, security.
  • urhShares av.db curated category or tags: cli, reverse-engineering, security.
  • ipswShares av.db curated category or tags: cli, reverse-engineering, security.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment