AwesomeREA.org

Tool

ghidrecomp

Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v0.5.9, published to PyPI and GitHub on 2026-01-06; the reviewed main commit is that tag. setup.cfg requires Python 3.10+ and pyghidra 2.2.1+ and marks the project as alpha; the CodeQL option is a placeholder that only prints a coming-soon message.
  • Needs a separate Ghidra installation and the Java runtime it requires, found through GHIDRA_INSTALL_DIR. The Dockerfile and devcontainer build on the author's ghidra-python image and pin pyghidra 2.2.1 for Ghidra 11; CI runs pytest in that image for the latest Ghidra and for 11.3, 11.3.2 and 11.4.2. SAST scanning needs Semgrep, installed with the sast extra.
  • Binaries to decompile are the analyst's own; symbol lookups contact the listed public symbol servers unless --skip-symbols is set. The tests bundle tests/data/afd.sys.10.0.22621.1415, a Microsoft Windows driver build also used in the README examples, an AArch64 ls binary and an ntddk_64.gdt data-type archive; these files keep their publishers' terms.
  • The README presents the output as decompilations for research and analysis and makes no recompilation claim; the tests check function counts, call graphs, one signature after GDT application, BSim and SAST output, not the accuracy of decompiled code in general. GPL-3.0 (LICENSE); Ghidra and Semgrep keep their own licenses. Nothing was decompiled for this review, and the sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  2. setup.cfg GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  3. ghidrecomp/sast.py GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  4. Dockerfile GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  5. .github/workflows/pytest-devcontainer-all.yml GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  6. tests GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  7. LICENSE GitHub · clearbluejar/ghidrecomp · Revision 7a82556
  8. https://github.com/clearbluejar/ghidrecomp/releases/tag/v0.5.9
  9. https://pypi.org/project/ghidrecomp/0.5.9/

More in Native binaries

All 158 entries in Native binaries