pyghidra

What it is and what it does

PyGhidra is a Python binding to Ghidra's reverse-engineering API, originally developed by the Department of Defense Cyber Crime Center. It uses JPype to run native CPython 3 code that can directly call Ghidra's Java API, eliminating the need to write GhidraScript in Java or Jython. The library provides high-level convenience functions for common tasks—starting the JVM, opening projects, loading programs, running analysis, and executing GhidraScripts—as well as lower-level access to Ghidra's full object model.

You can use PyGhidra standalone in Python workflows where Ghidra is one component among many, or integrate it with Ghidra's GUI via a built-in REPL and plugin. It supports both headless (command-line) and interactive modes, making it suitable for automation, batch analysis, and integration into larger reverse-engineering or malware-analysis pipelines.

Use it for:

• Automate binary analysis workflows by scripting Ghidra tasks in native Python instead of Java or GhidraScript
• Build batch processing pipelines to analyze multiple binaries and extract structured data (functions, strings, cross-references) programmatically
• Integrate Ghidra analysis into security research or malware-analysis frameworks as a Python library component
• Write custom analysis plugins in Python and run them from the Ghidra GUI via the PyGhidra plugin
• Combine Ghidra's disassembly and decompilation with Python data science or machine-learning tools for program analysis

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

PyGhidra provides native CPython 3 access to the Ghidra reverse-engineering API, enabling programmatic binary analysis and manipulation through Python instead of Java or GhidraScript.

Yes. PyGhidra is actively maintained, has no known vulnerabilities, installs with low friction, and is permissively licensed. Install it if you need to programmatically interact with Ghidra from Python or integrate Ghidra analysis into larger workflows. Prerequisite: Ghidra 12.0+ must be installed separately, and a Java runtime is required.

Install

pyghidra on PyPI

pip install pyghidra

uv add pyghidra

poetry add pyghidra

Installing pyghidra

Before you install

Low friction: pure Python wheel with only two runtime dependencies (Jpype1 and packaging). Actively maintained with recent releases; repository shows strong community engagement (72376 stars). Supports Python 3.9 through 3.14.

License in practice

Apache-2.0 permissive license allows commercial and private use without restriction. No copyleft obligations; you may modify and redistribute under the same license terms.

Quickstart

pip install pyghidra

import pyghidra

launcher = pyghidra.start()
project = pyghidra.open_project('/path/to/project', 'myproject')
with pyghidra.program_context(project, '/path/to/binary') as program:
    pyghidra.analyze(program)

Requires Ghidra 12.0 or later to be installed separately; PyGhidra will locate it via GHIDRA_INSTALL_DIR environment variable or last-used installation. JPype1 requires a Java runtime environment.

Verify before relying

• Whether offline installation from Ghidra's bundled pypkg/dist works reliably across all platforms
• Performance characteristics when analyzing large binaries or running complex GhidraScripts
• Compatibility guarantees with Ghidra versions beyond 12.0

Package facts

Evidence: pyghidra-3.1.0-py3-none-any.whl

Keywords: ghidra

Tags

More Software Development packages