AwesomeREA.org

Tool

Ghidrathon

Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. It adds an interactive Python 3 interpreter window, Python 3 scripts in the Script Manager and Python 3 post-scripts in headless analyzeHeadless runs, with GhidraScript state such as currentProgram() and FlatProgramAPI methods available as Python builtins. Because the configured interpreter or virtual environment is used as is, scripts can import installed packages; the README names capa, Unicorn and angr as motivating examples and shows Unicorn emulating ARM code inside Ghidra.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The repository is archived on GitHub and read-only. Its last commit on main dates from 2024-05-08, and the latest release, v4.0.0 of 2024-02-13, attaches one extension zip that the release workflow builds against Ghidra 11.0 and bundles with the configure script. The archive states no reason; Ghidra's own change history records that 11.3 (February 2025) integrated PyGhidra, a native CPython 3 interface whose module provides a CPython interpreter plugin and a script provider for CPython 3 GhidraScripts. This record treats Ghidrathon as a historical tool.
  • The README requires Python 3.8+, exactly Jep 4.2.0, Ghidra 10.3.2+ and Java 17+. Setup installs Jep from util/requirements.txt into the chosen interpreter or virtual environment and runs util/ghidrathon_configure.py against the Ghidra install directory, which writes a ghidrathon.save file there or under GHIDRATHON_SAVE_PATH; the zip is then installed through Ghidra's extension manager, whose version-mismatch prompt the README says may be overridden. Source builds need Gradle 7.3+ and the Jep 4.2.0 JAR downloaded into lib/.
  • CI built and tested only Ghidra 10.3.2 and 11.0 with Python 3.8 and 3.12 on Ubuntu, Windows and macOS, running the repository's Python tests as headless post-scripts; later Ghidra releases are not covered by the reviewed sources. Jep embeds Python in the JVM through JNI, which the README notes Ghidra's developers advise against, and unlike Ghidra's Java and Jython APIs, scripts read GhidraScript state through calls such as currentProgram().
  • Apache-2.0 (LICENSE.txt). The repository commits Java and Python sources, an example script, Python tests and three README screenshots, and no binaries; the CI tests analyze a demangler executable taken from the downloaded Ghidra distribution. The reviewed sources state no AI or REA use, and nothing was installed or run for this record.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mandiant/Ghidrathon · Revision 56866ad
  2. doc/building.md GitHub · mandiant/Ghidrathon · Revision 56866ad
  3. util/ghidrathon_configure.py GitHub · mandiant/Ghidrathon · Revision 56866ad
  4. util/requirements.txt GitHub · mandiant/Ghidrathon · Revision 56866ad
  5. ghidra_scripts/ghidrathon_example.py GitHub · mandiant/Ghidrathon · Revision 56866ad
  6. .github/workflows/tests.yml GitHub · mandiant/Ghidrathon · Revision 56866ad
  7. .github/workflows/build.yml GitHub · mandiant/Ghidrathon · Revision 56866ad
  8. LICENSE.txt GitHub · mandiant/Ghidrathon · Revision 56866ad
  9. https://github.com/mandiant/Ghidrathon/releases/tag/v4.0.0
  10. Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md#L1283 GitHub · NationalSecurityAgency/ghidra · Revision 1b9e58a
  11. Ghidra/Features/PyGhidra/README.md GitHub · NationalSecurityAgency/ghidra · Revision 1b9e58a

More in Native binaries

All 158 entries in Native binaries