Core Compute & Architecture
SLEIGH Translation Engine
A universal machine-code translation engine mapping disparate architecture instructions (x86, ARM, MIPS) into a standardized intermediate representation known as P-Code.
Headless Decompilation
The architecture is bifurcated into a Java UI and a headless C++ decompiler. This enables massive arrays of binaries to be processed and characterized automatically via Python/Java scripts without rendering a GUI.
Under the Hood Architecture
XML Serial Protocol
The Java GUI and C++ decompiler operate as entirely separate processes. They communicate strictly via a custom XML serialization protocol piped over stdin and stdout to construct the AST.
P-Code Micro-Operations
Breaks complex assembly down into fundamental micro-ops acting on "varnodes" (abstracted registers and RAM) before applying aggressive dead-code elimination.
Real-World Attack Surface
CVE-2026-4946 (Command Injection)
Malicious Mach-O binaries can embed `@execute` annotations. When the analyst clicks the auto-generated UI link, Java blindly spawns an interpreter, executing the payload and causing full workstation RCE.
RMI Deserialization
GHSA-fgg5-g275-7742 identified a critical RCE vulnerability via unfiltered Java RMI deserialization on exposed JMX ports. Network attackers could pass gadget chains to execute within the Ghidra JVM.
Mandatory Hardening Baseline
- Air-Gapped Isolation: Ghidra must *never* be executed on a primary host OS. It must be strictly isolated within dedicated, hypervisor VMs with entirely disabled network adapters.
- Avoid UI Annotations: Analysts must explicitly avoid interaction with auto-generated links or complex string annotations extracted from malicious binaries.
Security Tool Comparison
| Component | Ghidra | Burp Suite |
|---|---|---|
| Core Architecture | Java GUI + C++ Decompiler | Monolithic Java JVM |
| Primary Risk | OS Command Injection (UI), RMI | AI Data Leakage, Project RCE |
| State Management | XML Serialization Protocol | SQLite / FlatBuffers |
| Mandatory Hardening | Air-gapped Hypervisor | Disable AI, 16GB+ RAM |
