Ghidra

ghidra

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.

Detected by ghidraRun, analyzeHeadless, pyghidraRun | macOS, Linux, Windows |github.com

Sync it ghidra.toml

Sync rules

What travels, what stays, what never leaves

Ghidra in your home directory Every rule on this page, by file

· application.log Exclude

· script.log Exclude

· symbols/ Exclude

· application.log Exclude

· script.log Exclude

· symbols/ Exclude

· application.log Exclude

· script.log Exclude

· symbols/ Exclude

· application.log Exclude

· script.log Exclude

· symbols/ Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/ghidra.tomlThe file this page is generated from

id = "ghidra"

name = "Ghidra"

homepage = "https://github.com/NationalSecurityAgency/ghidra"

description = "Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate."

# The Ghidra dragon, the application icon from the project's own source tree.

icon = "https://raw.githubusercontent.com/NationalSecurityAgency/ghidra/master/Ghidra/Framework/Gui/src/main/resources/images/GhidraIcon256.png"

# GhidraDocs/GettingStarted.md names the launchers: ghidraRun (the GUI),

# analyzeHeadless (the headless analyzer) and pyghidraRun.

detect = ["ghidraRun", "analyzeHeadless", "pyghidraRun"]

# Ghidra/Framework/Utility/src/main/java/utility/application/

# ApplicationUtilities.java, getDefaultUserSettingsDir(): after

# $XDG_CONFIG_HOME, the per-OS branch is

# WINDOWS -> %APPDATA%/<appName>/<versionedName>

# LINUX -> $HOME/.config/<appName>/<versionedName>

# MAC_OS_X -> $HOME/Library/<appName>/<versionedName>

# macOS is ~/Library directly, not ~/Library/Application Support, so this is

# not [appData]; and it is not [configHome] either, whose macOS half is

# ~/.config. Each spelling is written out.

# getLegacyUserSettingsDir() in the same file is the pre-11.1 layout, one

# hidden directory used on every platform: ~/.ghidra/.ghidra_<version>_PUBLIC.

# The move is recorded in ChangeHistory.md under "Ghidra 11.1 Change History

# (June 2024)": "Ghidra now supports the XDG Base Directory Specification.

# Default locations of the user settings, cache, and temporary directories have

# moved" (GP-1164). Both layouts are listed; a consumer skips the absent one.

# <versionedName> is ApplicationIdentifier.toString(), applicationName + "_" +

# version + "_" + releaseName — ghidra_11.4_PUBLIC — hence the glob, which also

# covers the "_location_<dir>" suffix a development build appends.

paths = [

"~/.config/ghidra/ghidra_*_PUBLIC/",

"~/Library/ghidra/ghidra_*_PUBLIC/",

"%APPDATA%/ghidra/ghidra_*_PUBLIC/",

"~/.ghidra/.ghidra_*_PUBLIC/",

]

# Carved out of every spelling of the settings directory, because a rule that

# names one and not its siblings does not run on the other platforms.

# application.log and script.log are written by Application.java; symbols/ is

# the downloaded PDB store LibraryLookupTable fills in and can grow without

# bound. What stays is the part a user built: `preferences`, the tool chest in

# tools/ (ProjectManager.APPLICATION_TOOLS_DIR_NAME), themes/

# (ThemeManager.THEME_DIR), FrontEndTool.xml and the extensions installed from

# the GUI — GettingStarted.md: "Extensions installed from the Ghidra front-end

# GUI get installed at <UserSettings>/Extensions".

# Ghidra's real cache is outside $HOME entirely on Unix (/var/tmp/<user>-ghidra),

# so it needs no carve-out here.

exclude = [

"~/.config/ghidra/ghidra_*_PUBLIC/application.log",

"~/Library/ghidra/ghidra_*_PUBLIC/application.log",

"%APPDATA%/ghidra/ghidra_*_PUBLIC/application.log",

"~/.ghidra/.ghidra_*_PUBLIC/application.log",

"~/.config/ghidra/ghidra_*_PUBLIC/script.log",

"~/Library/ghidra/ghidra_*_PUBLIC/script.log",

"%APPDATA%/ghidra/ghidra_*_PUBLIC/script.log",

"~/.ghidra/.ghidra_*_PUBLIC/script.log",

"~/.config/ghidra/ghidra_*_PUBLIC/symbols/",

"~/Library/ghidra/ghidra_*_PUBLIC/symbols/",

"%APPDATA%/ghidra/ghidra_*_PUBLIC/symbols/",

"~/.ghidra/.ghidra_*_PUBLIC/symbols/",

]

# Nothing in the settings directory is a credential. serverAllowList.json names

# Ghidra Server URLs the user has agreed to connect to, not how to log in to

# them; the server password is prompted for.

secret = []

# No machine_lines. `preferences` is a Java properties file and the tools are

# XML, neither of which `format` can parse (toml, yaml, json only). The

# machine-local values a consumer able to read them should drop are the

# last-opened project paths and window geometry in FrontEndTool.xml.

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/ghidra. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page.