Core Compute & Architecture
SLEIGH Translation Engine
SLEIGH lifts machine code from any supported architecture — x86, ARM, MIPS, PowerPC, and a long tail of embedded targets — into a single intermediate representation called P-Code. This is the reason Ghidra reads firmware from processors nobody has written a dedicated tool for: the decompiler works on P-Code, so adding an architecture means writing a processor specification rather than a new decompiler. The cost is a layer of translation between you and the instruction that actually executed, and on unusual or hand-written code the lifted form occasionally misrepresents what the silicon does. When the decompiled C looks impossible, read the disassembly.
Headless Decompilation
The UI and the decompiler are separate processes, which means the analysis engine runs perfectly well with no display at all. analyzeHeadless plus a script is how you process a few thousand samples overnight, extract functions and strings across a whole firmware corpus, or wire Ghidra into a triage pipeline. Most people never touch it and it is the single highest-leverage thing in the tool. Budget the time to learn the scripting API properly; the interactive workflow does not scale past a handful of binaries and no amount of UI skill fixes that.
Under the Hood Architecture
XML Serial Protocol
The two processes talk over a custom XML protocol piped through stdin and stdout. Clean separation, and it explains two things you will meet in practice: the decompiler can die on a pathological function while the UI carries on looking healthy, and on large binaries the serialisation itself becomes the bottleneck rather than the analysis. A function that spins forever in the decompiler pane is usually this, not your machine.
P-Code Micro-Operations
P-Code decomposes each instruction into simple micro-operations over varnodes — abstract storage locations standing in for registers and memory — after which dead-code elimination strips what the program never uses. That simplification is what makes the decompiled output readable, and it is also why the output is an interpretation rather than a transcript. Anti-analysis code exists specifically to exploit that gap, and obfuscated or self-modifying binaries will produce confident, clean, wrong C.
Real-World Attack Surface
Hostile Input, By Definition
The premise of the job is loading files written by someone trying to hurt you, into a large parser, on your workstation. Ghidra has shipped fixes for XXE in project and archive handling and for command-injection paths reachable from attacker-controlled content, and there is no reason to believe the last one has been found. The specific pattern to internalise is that content extracted from the binary — strings, symbol names, generated links — is attacker-controlled data being rendered in your UI. Clicking it is an action on their input, not on Ghidra's.
RMI Deserialization
Ghidra's debug launch has historically exposed a Java RMI/JMX listener with unfiltered deserialisation, which turns a gadget chain into code execution inside the Ghidra JVM for anyone who can reach the port. Deserialisation bugs are the reason "it only listens on the analysis VM" is worth checking rather than assuming: the default bind address is the thing that decides whether this is a local curiosity or a network-reachable RCE, and it is not the thing anyone verifies before starting work.
Mandatory Hardening Baseline
- Air-Gapped Isolation: run it in a dedicated VM with the network adapter off, never on your working host. The friction is real — no clipboard, no shared folder, samples in and notes out by hand — and it is the price of loading malware into a JVM. If that trade feels excessive, look again at what you are opening.
- Treat extracted content as untrusted: do not click auto-generated links or follow annotations built from strings inside the sample. It feels like navigating your own tool. It is following a link the malware author wrote.
Security Tool Comparison
| Component | Ghidra | Burp Suite |
|---|---|---|
| Core Architecture | Java GUI + C++ Decompiler | Monolithic Java JVM |
| Primary Risk | OS Command Injection (UI), RMI | AI Data Leakage, Project RCE |
| State Management | XML Serialization Protocol | SQLite / FlatBuffers |
| Mandatory Hardening | Air-gapped Hypervisor | Disable AI, 16GB+ RAM |
