{"slug": "ghidra", "name": "Ghidra", "category": "other", "category_name": "Other software", "description": "NSA-developed software reverse engineering suite with disassembler and decompiler.", "recommenders": 7, "commenters": 17, "warners": 0, "score": 9.141, "rising": 0.36, "first": "2026-01-30", "latest": "2026-10-31", "why": "HN commenters like it for decompiling binaries, firmware and old games into C code, especially when LLM agents drive it through MCP or headless mode.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 7, "neutral": 10, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 3, 0, 0, 0, 1, 0, 2, 0, 1], "listed": true, "loved": ["Works with AI agents", "Binary decompilation"], "caveat": "Decompiler reliability", "short_quote": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras.", "icon": true, "domain": null, "github_repo": null, "official_url": "https://ghidra-sre.org/", "pricing": "open source", "aliases": ["Ghidra"], "verdict": [{"text": "HN commenters like it for decompiling binaries, firmware and old games into C code,", "cites": [{"id": 752574384, "item_id": 47035899, "url": "https://news.ycombinator.com/item?id=47035899", "by": "mdavid626", "date": "2026-02-16", "stance": "recommend", "quote": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras.", "excerpt": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into \"sh\". The security is delusional here - the password is hard coded in the executable. It was something like \"VIVOTEK Inc.\". Ghidra was able to create the C code and I was a", "context": "", "use_case": "reverse engineering firmware", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 805051378, "item_id": 50315711, "url": "https://news.ycombinator.com/item?id=50315711", "by": "paper2d", "date": "2026-10-31", "stance": "recommend", "quote": "it decompiled it via ghidra", "excerpt": "I did something similar with an rare, old 32bit game I really enjoyed in my childhood. I used deepseek and pi harness and it decompiled it via ghidra and recompiled it for wasm in under 40 mins or so and made it run in the browser. I was impressed! For anyone who wants to run the game in your browser, here it is - https://bonkheads-port-by-kapil.pages.dev/", "context": "", "use_case": "decompiling game binary", "switched_from": "", "story": "Cisco gives engineer unlimited AI tokens to rewrite legacy code"}, {"id": 795239169, "item_id": 49702448, "url": "https://news.ycombinator.com/item?id=49702448", "by": "jonahss", "date": "2026-09-14", "stance": "neutral", "quote": "replicating all the functionality from a Ghidra decompilation of the binary", "excerpt": "I had claude faithfully rewrite SimTower so I could play it in the browser: https://kvetch.io/conciliatower I wanted to re-play SimTower but found it too difficult to get running through emulation. Instead, I worked for 6 months with Claude Code on a complete rewrite, replicating all the functionality from a Ghidra decompilation of the binary, an AI-generated summary of the original source code and my memory of the g", "context": "", "use_case": "decompiling the original game", "switched_from": "", "story": "Ask HN: What are you working on? (September 2026)"}]}, {"text": " especially when LLM agents drive it through MCP or headless mode.", "cites": [{"id": 786132337, "item_id": 49133271, "url": "https://news.ycombinator.com/item?id=49133271", "by": "aetherspawn", "date": "2026-08-01", "stance": "recommend", "quote": "or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to", "excerpt": "Yeah try Sonnet 5, it has no guardrails and it can run continuously. Hook it up to IDA, or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to using a text prompt. It\u2019s way faster than doing it by hand. Only issue is Sonnet is kind of a silly model and whilst it\u2019s good at searching for stuff, it lacks a little bit of common sense compared to Opus or Fable, so you\u2019ll have to drive it. You", "context": "reverse engineer", "use_case": "reverse engineering", "switched_from": "", "story": "Twenty-five years ago it was cryptography, today it's model weights"}, {"id": 752579730, "item_id": 47036233, "url": "https://news.ycombinator.com/item?id=47036233", "by": "Mattwmaster58", "date": "2026-02-16", "stance": "recommend", "quote": "I'll second this. I used opencode + opus 4.6 + ghidra", "excerpt": "I'll second this. I used opencode + opus 4.6 + ghidra to reverse engineer a seedkey generation algorithm[1] from v850 assembly. I gave it the binary, the known address for the generation function, and a set of known inputs/outputs, and it was able to crack it. [1] https://github.com/Mattwmaster58/ic204", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 774788865, "item_id": 48424304, "url": "https://news.ycombinator.com/item?id=48424304", "by": "plagasul", "date": "2026-06-06", "stance": "neutral", "quote": "via headless ghidra", "excerpt": "Several. Yesterday a friend with no prior coding experience or knowledge showed me an app he initially built to help him study for public administration job positions. The exams for this positions are public (spain), but the tools are scarce, expensive or he did not like. So he used lovable, then switched to web gemini and claude, then paid claude. He now has +130 very active users on an initial free tier, while he f", "context": "teacher", "use_case": "reverse engineering software", "switched_from": "", "story": "What was your \"Oh Shit\" moment with GenAI?"}]}, {"text": " The most common caveat is that its decompiler output is not always reliable,", "cites": [{"id": 800687569, "item_id": 50042973, "url": "https://news.ycombinator.com/item?id=50042973", "by": "stevefan1999", "date": "2026-10-11", "stance": "neutral", "quote": "At this point static analysis like IDA and Ghidra stopped working.", "excerpt": "Reverse engineering dynamic dispatches like vtable and fat pointers/slices and traits would be hell. Different padding and compiler settings also contribute a lot. One of the few problem is that the decompiler is not always reliable. That forces you to go read the assembly, and it is not apparent to decipher the right kind of feng shui, not even from human before the LLM era. I used to play CTFs and my conclusion is ", "context": "played CTFs", "use_case": "static analysis, reverse engineering", "switched_from": "", "story": "500B tokens later: Letting AI agents decompile a first-person shooter"}, {"id": 800475248, "item_id": 50029703, "url": "https://news.ycombinator.com/item?id=50029703", "by": "InvisibleUp", "date": "2026-10-10", "stance": "neutral", "quote": "there's not much in the way of unaddressed Ghidra jank", "excerpt": "Glancing at the Touhou 4 decomp[1], it's a lot better quality than a lot of AI decomps I've seen. It's matching, the variables are named sensibly, comments are sparse and comprehensible, and there's not much in the way of unaddressed Ghidra jank. And only in a month! My main complaint is that the file structuring seems more optimized for AI use than for mirroring the original intent of the devs. (Compare to this huma", "context": "", "use_case": "decompilation", "switched_from": "", "story": "REA Reverse \u2013 Engineer Anything"}]}, {"text": " and static analysis breaks down on self-modifying or heavily dynamic code.", "cites": [{"id": 800687569, "item_id": 50042973, "url": "https://news.ycombinator.com/item?id=50042973", "by": "stevefan1999", "date": "2026-10-11", "stance": "neutral", "quote": "At this point static analysis like IDA and Ghidra stopped working.", "excerpt": "Reverse engineering dynamic dispatches like vtable and fat pointers/slices and traits would be hell. Different padding and compiler settings also contribute a lot. One of the few problem is that the decompiler is not always reliable. That forces you to go read the assembly, and it is not apparent to decipher the right kind of feng shui, not even from human before the LLM era. I used to play CTFs and my conclusion is ", "context": "played CTFs", "use_case": "static analysis, reverse engineering", "switched_from": "", "story": "500B tokens later: Letting AI agents decompile a first-person shooter"}]}], "praise": [{"label": "Works with AI agents", "summary": "Commenters pair it with LLMs via MCP or headless mode to automate reverse engineering.", "quotes": [{"id": 786132337, "item_id": 49133271, "url": "https://news.ycombinator.com/item?id=49133271", "by": "aetherspawn", "date": "2026-08-01", "stance": "recommend", "quote": "or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to", "excerpt": "Yeah try Sonnet 5, it has no guardrails and it can run continuously. Hook it up to IDA, or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to using a text prompt. It\u2019s way faster than doing it by hand. Only issue is Sonnet is kind of a silly model and whilst it\u2019s good at searching for stuff, it lacks a little bit of common sense compared to Opus or Fable, so you\u2019ll have to drive it. You", "context": "reverse engineer", "use_case": "reverse engineering", "switched_from": "", "story": "Twenty-five years ago it was cryptography, today it's model weights"}, {"id": 752579730, "item_id": 47036233, "url": "https://news.ycombinator.com/item?id=47036233", "by": "Mattwmaster58", "date": "2026-02-16", "stance": "recommend", "quote": "I'll second this. I used opencode + opus 4.6 + ghidra", "excerpt": "I'll second this. I used opencode + opus 4.6 + ghidra to reverse engineer a seedkey generation algorithm[1] from v850 assembly. I gave it the binary, the known address for the generation function, and a set of known inputs/outputs, and it was able to crack it. [1] https://github.com/Mattwmaster58/ic204", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 799576769, "item_id": 49973548, "url": "https://news.ycombinator.com/item?id=49973548", "by": "slopinthebag", "date": "2026-10-06", "stance": "neutral", "quote": "claude code just downloads ghidra and builds this stuff", "excerpt": "seeing what has been happening in the game modding communitiy, with people reverse engineering full rust rewrites of games like modern warfare 2 [1][2], or reverse engineering mashups with cod, minecraft, and skate 3 [3][4][5], the only defence against reverse-engineering literally all software will be to serve it from the cloud, and even that will not be enough. these people aren't even programmers, claude code just", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Photopea creator weighs in on Photosuite project"}]}, {"label": "Binary decompilation", "summary": "It recovers C code and logic from executables and firmware, such as camera key managers and seed-key algorithms.", "quotes": [{"id": 752574384, "item_id": 47035899, "url": "https://news.ycombinator.com/item?id=47035899", "by": "mdavid626", "date": "2026-02-16", "stance": "recommend", "quote": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras.", "excerpt": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into \"sh\". The security is delusional here - the password is hard coded in the executable. It was something like \"VIVOTEK Inc.\". Ghidra was able to create the C code and I was a", "context": "", "use_case": "reverse engineering firmware", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 752579730, "item_id": 47036233, "url": "https://news.ycombinator.com/item?id=47036233", "by": "Mattwmaster58", "date": "2026-02-16", "stance": "recommend", "quote": "I'll second this. I used opencode + opus 4.6 + ghidra", "excerpt": "I'll second this. I used opencode + opus 4.6 + ghidra to reverse engineer a seedkey generation algorithm[1] from v850 assembly. I gave it the binary, the known address for the generation function, and a set of known inputs/outputs, and it was able to crack it. [1] https://github.com/Mattwmaster58/ic204", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 780063233, "item_id": 48753952, "url": "https://news.ycombinator.com/item?id=48753952", "by": "jimrandomh", "date": "2026-07-01", "stance": "neutral", "quote": "a firmware-customization project involving a ghidra MCP", "excerpt": "This is a misinterpretation. Fable 5's acceptable use policy has false positives during some coding tasks, and that's what they were talking about. But I've been using it for web dev tasks since it relaunched today, and it's worked fine without fallback. (On a firmware-customization project involving a ghidra MCP, it triggered and switched to Opus; that was sort of expected.)", "context": "", "use_case": "firmware customization", "switched_from": "", "story": "Fable 5 will default to Opus 4.8 for coding tasks"}]}, {"label": "Game preservation", "summary": "Its decompilations have been used to port or rewrite old games for the browser.", "quotes": [{"id": 805051378, "item_id": 50315711, "url": "https://news.ycombinator.com/item?id=50315711", "by": "paper2d", "date": "2026-10-31", "stance": "recommend", "quote": "it decompiled it via ghidra", "excerpt": "I did something similar with an rare, old 32bit game I really enjoyed in my childhood. I used deepseek and pi harness and it decompiled it via ghidra and recompiled it for wasm in under 40 mins or so and made it run in the browser. I was impressed! For anyone who wants to run the game in your browser, here it is - https://bonkheads-port-by-kapil.pages.dev/", "context": "", "use_case": "decompiling game binary", "switched_from": "", "story": "Cisco gives engineer unlimited AI tokens to rewrite legacy code"}, {"id": 795239169, "item_id": 49702448, "url": "https://news.ycombinator.com/item?id=49702448", "by": "jonahss", "date": "2026-09-14", "stance": "neutral", "quote": "replicating all the functionality from a Ghidra decompilation of the binary", "excerpt": "I had claude faithfully rewrite SimTower so I could play it in the browser: https://kvetch.io/conciliatower I wanted to re-play SimTower but found it too difficult to get running through emulation. Instead, I worked for 6 months with Claude Code on a complete rewrite, replicating all the functionality from a Ghidra decompilation of the binary, an AI-generated summary of the original source code and my memory of the g", "context": "", "use_case": "decompiling the original game", "switched_from": "", "story": "Ask HN: What are you working on? (September 2026)"}, {"id": 749162146, "item_id": 46822634, "url": "https://news.ycombinator.com/item?id=46822634", "by": "freeqaz", "date": "2026-01-30", "stance": "neutral", "quote": "I even implemented vmx128 (custom 360-specific CPU instructions) into Ghidra and m2c", "excerpt": "I've been working on decompiling Dance Central 3 with AI and it's been insane. It's an Xbox 360 game that leverages the Kinect to track your body as your dance. It's a great game, but even with an emulator, it's still dependent on the Kinect hardware which is proprietary and has limited supply. Fortunately, a Debug build of this game was found on a dev unit (somehow), and that build does _not_ have crazy optimization", "context": "", "use_case": "decompilation", "switched_from": "", "story": "PlayStation 2 Recompilation Project Is Absolutely Incredible"}]}, {"label": "Extensible", "summary": "Users add plugins and even custom CPU instructions to it.", "quotes": [{"id": 776479473, "item_id": 48529967, "url": "https://news.ycombinator.com/item?id=48529967", "by": "csnate", "date": "2026-06-14", "stance": "neutral", "quote": "a plugin for Ghidra", "excerpt": "I'm building a plugin for Ghidra called Specter that aims to bring semi-deterministic agent workflows to Ghidra. It adds a terminal like interface to Ghidra's code browser where you can chat or run DSL queries. The project is currently 100% vibe coded with codex\\gpt-5.5, but after running some experiments, I'm working on replacing some of the vibe coded SQL engine with Apache Calcite. https://github.com/coldentry/Spe", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ask HN: What are you working on? (June 2026)"}, {"id": 749162146, "item_id": 46822634, "url": "https://news.ycombinator.com/item?id=46822634", "by": "freeqaz", "date": "2026-01-30", "stance": "neutral", "quote": "I even implemented vmx128 (custom 360-specific CPU instructions) into Ghidra and m2c", "excerpt": "I've been working on decompiling Dance Central 3 with AI and it's been insane. It's an Xbox 360 game that leverages the Kinect to track your body as your dance. It's a great game, but even with an emulator, it's still dependent on the Kinect hardware which is proprietary and has limited supply. Fortunately, a Debug build of this game was found on a dev unit (somehow), and that build does _not_ have crazy optimization", "context": "", "use_case": "decompilation", "switched_from": "", "story": "PlayStation 2 Recompilation Project Is Absolutely Incredible"}]}, {"label": "Rust support", "summary": "One user found recent versions much better at handling Rust binaries.", "quotes": [{"id": 752567296, "item_id": 47035456, "url": "https://news.ycombinator.com/item?id=47035456", "by": "zeon256", "date": "2026-02-16", "stance": "recommend", "quote": "pleasantly surprised how much better it is today wrt rust binaries", "excerpt": "Been awhile since I used this but decided to open the latest version to check my rust binary and was pleasantly surprised how much better it is today wrt rust binaries", "context": "", "use_case": "analyzing Rust binaries", "switched_from": "", "story": "Ghidra by NSA"}]}], "caveats": [{"label": "Decompiler reliability", "summary": "Decompiler output can be wrong, forcing users back to reading assembly.", "quotes": [{"id": 800687569, "item_id": 50042973, "url": "https://news.ycombinator.com/item?id=50042973", "by": "stevefan1999", "date": "2026-10-11", "stance": "neutral", "quote": "At this point static analysis like IDA and Ghidra stopped working.", "excerpt": "Reverse engineering dynamic dispatches like vtable and fat pointers/slices and traits would be hell. Different padding and compiler settings also contribute a lot. One of the few problem is that the decompiler is not always reliable. That forces you to go read the assembly, and it is not apparent to decipher the right kind of feng shui, not even from human before the LLM era. I used to play CTFs and my conclusion is ", "context": "played CTFs", "use_case": "static analysis, reverse engineering", "switched_from": "", "story": "500B tokens later: Letting AI agents decompile a first-person shooter"}, {"id": 800475248, "item_id": 50029703, "url": "https://news.ycombinator.com/item?id=50029703", "by": "InvisibleUp", "date": "2026-10-10", "stance": "neutral", "quote": "there's not much in the way of unaddressed Ghidra jank", "excerpt": "Glancing at the Touhou 4 decomp[1], it's a lot better quality than a lot of AI decomps I've seen. It's matching, the variables are named sensibly, comments are sparse and comprehensible, and there's not much in the way of unaddressed Ghidra jank. And only in a month! My main complaint is that the file structuring seems more optimized for AI use than for mirroring the original intent of the devs. (Compare to this huma", "context": "", "use_case": "decompilation", "switched_from": "", "story": "REA Reverse \u2013 Engineer Anything"}]}, {"label": "Static analysis limits", "summary": "It stops being useful for self-modifying or JIT code, where a stepping debugger is needed.", "quotes": [{"id": 800687569, "item_id": 50042973, "url": "https://news.ycombinator.com/item?id=50042973", "by": "stevefan1999", "date": "2026-10-11", "stance": "neutral", "quote": "At this point static analysis like IDA and Ghidra stopped working.", "excerpt": "Reverse engineering dynamic dispatches like vtable and fat pointers/slices and traits would be hell. Different padding and compiler settings also contribute a lot. One of the few problem is that the decompiler is not always reliable. That forces you to go read the assembly, and it is not apparent to decipher the right kind of feng shui, not even from human before the LLM era. I used to play CTFs and my conclusion is ", "context": "played CTFs", "use_case": "static analysis, reverse engineering", "switched_from": "", "story": "500B tokens later: Letting AI agents decompile a first-person shooter"}]}, {"label": "Not always fitting", "summary": "One user found it was not the right tool for reverse engineering a Dreamcast game.", "quotes": [{"id": 752602480, "item_id": 47037655, "url": "https://news.ycombinator.com/item?id=47037655", "by": "brynnbee", "date": "2026-02-16", "stance": "neutral", "quote": "it wasn't really the right tool for the job", "excerpt": "I personally learn best by doing which is why I love learning with LLMs. They're going to be wrong a lot, and give bad advice, and do things in silly ways. I learn well from the process of working with them, seeing them fail constantly, then learn the tool yourself by researching what it's doing wrong to fix it. I just attempted to use Ghidra to reverse engineer the game Shenmue from Dreamcast. I was previously unfam", "context": "", "use_case": "reverse engineering Dreamcast game", "switched_from": "", "story": "Ghidra by NSA"}]}], "who": [{"by": "stevefan1999", "context": "played CTFs", "url": "https://news.ycombinator.com/item?id=50042973", "date": "2026-10-11"}, {"by": "aetherspawn", "context": "reverse engineer", "url": "https://news.ycombinator.com/item?id=49133271", "date": "2026-08-01"}, {"by": "plagasul", "context": "teacher", "url": "https://news.ycombinator.com/item?id=48424304", "date": "2026-06-06"}], "tags": ["for reverse engineers", "for game decompilation", "for firmware analysis", "for AI agent workflows", "extensible with plugins"], "use_cases": ["reverse engineering", "decompilation", "decompiling game binary", "static analysis, reverse engineering", "decompiling the original game", "reverse engineering binaries"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "claude-opus", "name": "Claude Opus", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "claude-fable", "name": "Claude Fable", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "claude", "name": "Claude", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47011548", "title": "Ghidra by NSA", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=48406174", "title": "What was your \"Oh Shit\" moment with GenAI?", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50304122", "title": "Cisco gives engineer unlimited AI tokens to rewrite legacy code", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50039092", "title": "500B tokens later: Letting AI agents decompile a first-person shooter", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50028275", "title": "REA Reverse \u2013 Engineer Anything", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49972730", "title": "Photopea creator weighs in on Photosuite project", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"neutral": 1}, "2026-02": {"recommend": 3, "neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 3, "recommend": 1}, "2026-07": {"neutral": 1}, "2026-08": {"recommend": 2}, "2026-09": {"neutral": 1}, "2026-10": {"neutral": 3, "recommend": 1}}, "quotes": [{"id": 805051378, "item_id": 50315711, "url": "https://news.ycombinator.com/item?id=50315711", "by": "paper2d", "date": "2026-10-31", "stance": "recommend", "quote": "it decompiled it via ghidra", "excerpt": "I did something similar with an rare, old 32bit game I really enjoyed in my childhood. I used deepseek and pi harness and it decompiled it via ghidra and recompiled it for wasm in under 40 mins or so and made it run in the browser. I was impressed! For anyone who wants to run the game in your browser, here it is - https://bonkheads-port-by-kapil.pages.dev/", "context": "", "use_case": "decompiling game binary", "switched_from": "", "story": "Cisco gives engineer unlimited AI tokens to rewrite legacy code"}, {"id": 800687569, "item_id": 50042973, "url": "https://news.ycombinator.com/item?id=50042973", "by": "stevefan1999", "date": "2026-10-11", "stance": "neutral", "quote": "At this point static analysis like IDA and Ghidra stopped working.", "excerpt": "Reverse engineering dynamic dispatches like vtable and fat pointers/slices and traits would be hell. Different padding and compiler settings also contribute a lot. One of the few problem is that the decompiler is not always reliable. That forces you to go read the assembly, and it is not apparent to decipher the right kind of feng shui, not even from human before the LLM era. I used to play CTFs and my conclusion is ", "context": "played CTFs", "use_case": "static analysis, reverse engineering", "switched_from": "", "story": "500B tokens later: Letting AI agents decompile a first-person shooter"}, {"id": 800475248, "item_id": 50029703, "url": "https://news.ycombinator.com/item?id=50029703", "by": "InvisibleUp", "date": "2026-10-10", "stance": "neutral", "quote": "there's not much in the way of unaddressed Ghidra jank", "excerpt": "Glancing at the Touhou 4 decomp[1], it's a lot better quality than a lot of AI decomps I've seen. It's matching, the variables are named sensibly, comments are sparse and comprehensible, and there's not much in the way of unaddressed Ghidra jank. And only in a month! My main complaint is that the file structuring seems more optimized for AI use than for mirroring the original intent of the devs. (Compare to this huma", "context": "", "use_case": "decompilation", "switched_from": "", "story": "REA Reverse \u2013 Engineer Anything"}, {"id": 799576769, "item_id": 49973548, "url": "https://news.ycombinator.com/item?id=49973548", "by": "slopinthebag", "date": "2026-10-06", "stance": "neutral", "quote": "claude code just downloads ghidra and builds this stuff", "excerpt": "seeing what has been happening in the game modding communitiy, with people reverse engineering full rust rewrites of games like modern warfare 2 [1][2], or reverse engineering mashups with cod, minecraft, and skate 3 [3][4][5], the only defence against reverse-engineering literally all software will be to serve it from the cloud, and even that will not be enough. these people aren't even programmers, claude code just", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Photopea creator weighs in on Photosuite project"}, {"id": 795239169, "item_id": 49702448, "url": "https://news.ycombinator.com/item?id=49702448", "by": "jonahss", "date": "2026-09-14", "stance": "neutral", "quote": "replicating all the functionality from a Ghidra decompilation of the binary", "excerpt": "I had claude faithfully rewrite SimTower so I could play it in the browser: https://kvetch.io/conciliatower I wanted to re-play SimTower but found it too difficult to get running through emulation. Instead, I worked for 6 months with Claude Code on a complete rewrite, replicating all the functionality from a Ghidra decompilation of the binary, an AI-generated summary of the original source code and my memory of the g", "context": "", "use_case": "decompiling the original game", "switched_from": "", "story": "Ask HN: What are you working on? (September 2026)"}, {"id": 787027937, "item_id": 49189246, "url": "https://news.ycombinator.com/item?id=49189246", "by": "overgard", "date": "2026-08-05", "stance": "recommend", "quote": "There are also things like Ghidra that the NSA made.", "excerpt": "I used to use dotPeek all the time back in like 2012. There are also things like Ghidra that the NSA made. I dunno, google them, there are a lot. I'm not saying LLMs aren't useful here, just that it's not a huge deal. Also, why are AI people always making tools to take other people's IP? You are kind of fucking with people's intellectual property without permission it seems like. I'm not saying it's the crime of the ", "context": "", "use_case": "reverse engineering binaries", "switched_from": "", "story": "Sycophantic AI Decreases Prosocial Intentions and Promotes Dependence"}, {"id": 786132337, "item_id": 49133271, "url": "https://news.ycombinator.com/item?id=49133271", "by": "aetherspawn", "date": "2026-08-01", "stance": "recommend", "quote": "or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to", "excerpt": "Yeah try Sonnet 5, it has no guardrails and it can run continuously. Hook it up to IDA, or I use Ghidra, with MCP and it can autonomously search for whatever you tell it to using a text prompt. It\u2019s way faster than doing it by hand. Only issue is Sonnet is kind of a silly model and whilst it\u2019s good at searching for stuff, it lacks a little bit of common sense compared to Opus or Fable, so you\u2019ll have to drive it. You", "context": "reverse engineer", "use_case": "reverse engineering", "switched_from": "", "story": "Twenty-five years ago it was cryptography, today it's model weights"}, {"id": 780063233, "item_id": 48753952, "url": "https://news.ycombinator.com/item?id=48753952", "by": "jimrandomh", "date": "2026-07-01", "stance": "neutral", "quote": "a firmware-customization project involving a ghidra MCP", "excerpt": "This is a misinterpretation. Fable 5's acceptable use policy has false positives during some coding tasks, and that's what they were talking about. But I've been using it for web dev tasks since it relaunched today, and it's worked fine without fallback. (On a firmware-customization project involving a ghidra MCP, it triggered and switched to Opus; that was sort of expected.)", "context": "", "use_case": "firmware customization", "switched_from": "", "story": "Fable 5 will default to Opus 4.8 for coding tasks"}, {"id": 779190400, "item_id": 48699400, "url": "https://news.ycombinator.com/item?id=48699400", "by": "Retr0id", "date": "2026-06-27", "stance": "neutral", "quote": "I took a look at the Ghidra ones (because I use Ghidra)", "excerpt": "I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1.2-rce-ace-calc-poc/docs/classification.md The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (bu", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Anonymous GitHub account mass-dropping undisclosed 0-days"}, {"id": 776479473, "item_id": 48529967, "url": "https://news.ycombinator.com/item?id=48529967", "by": "csnate", "date": "2026-06-14", "stance": "neutral", "quote": "a plugin for Ghidra", "excerpt": "I'm building a plugin for Ghidra called Specter that aims to bring semi-deterministic agent workflows to Ghidra. It adds a terminal like interface to Ghidra's code browser where you can chat or run DSL queries. The project is currently 100% vibe coded with codex\\gpt-5.5, but after running some experiments, I'm working on replacing some of the vibe coded SQL engine with Apache Calcite. https://github.com/coldentry/Spe", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ask HN: What are you working on? (June 2026)"}, {"id": 774922114, "item_id": 48432632, "url": "https://news.ycombinator.com/item?id=48432632", "by": "NoMoreNicksLeft", "date": "2026-06-07", "stance": "recommend", "quote": "that you'd heard Ghidra was a big deal", "excerpt": "I use Claude on the desktop, and only occasionally Claude Code. It's the one that recommended Ghidra. Walked me through the install. Taught me the basics (G to go to an address, etc). Would tell me where to go, and what to paste back to it. It eventually converged on where to find the iv and credentials and so forth (after acting confused for awhile), and then wrote the python script for me that decrypts. I'd like to", "context": "", "use_case": "decompiling to reverse engineer decryption", "switched_from": "", "story": "What was your \"Oh Shit\" moment with GenAI?"}, {"id": 774788865, "item_id": 48424304, "url": "https://news.ycombinator.com/item?id=48424304", "by": "plagasul", "date": "2026-06-06", "stance": "neutral", "quote": "via headless ghidra", "excerpt": "Several. Yesterday a friend with no prior coding experience or knowledge showed me an app he initially built to help him study for public administration job positions. The exams for this positions are public (spain), but the tools are scarce, expensive or he did not like. So he used lovable, then switched to web gemini and claude, then paid claude. He now has +130 very active users on an initial free tier, while he f", "context": "teacher", "use_case": "reverse engineering software", "switched_from": "", "story": "What was your \"Oh Shit\" moment with GenAI?"}, {"id": 752602480, "item_id": 47037655, "url": "https://news.ycombinator.com/item?id=47037655", "by": "brynnbee", "date": "2026-02-16", "stance": "neutral", "quote": "it wasn't really the right tool for the job", "excerpt": "I personally learn best by doing which is why I love learning with LLMs. They're going to be wrong a lot, and give bad advice, and do things in silly ways. I learn well from the process of working with them, seeing them fail constantly, then learn the tool yourself by researching what it's doing wrong to fix it. I just attempted to use Ghidra to reverse engineer the game Shenmue from Dreamcast. I was previously unfam", "context": "", "use_case": "reverse engineering Dreamcast game", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 752579730, "item_id": 47036233, "url": "https://news.ycombinator.com/item?id=47036233", "by": "Mattwmaster58", "date": "2026-02-16", "stance": "recommend", "quote": "I'll second this. I used opencode + opus 4.6 + ghidra", "excerpt": "I'll second this. I used opencode + opus 4.6 + ghidra to reverse engineer a seedkey generation algorithm[1] from v850 assembly. I gave it the binary, the known address for the generation function, and a set of known inputs/outputs, and it was able to crack it. [1] https://github.com/Mattwmaster58/ic204", "context": "", "use_case": "reverse engineering", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 752574384, "item_id": 47035899, "url": "https://news.ycombinator.com/item?id=47035899", "by": "mdavid626", "date": "2026-02-16", "stance": "recommend", "quote": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras.", "excerpt": "Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into \"sh\". The security is delusional here - the password is hard coded in the executable. It was something like \"VIVOTEK Inc.\". Ghidra was able to create the C code and I was a", "context": "", "use_case": "reverse engineering firmware", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 752567296, "item_id": 47035456, "url": "https://news.ycombinator.com/item?id=47035456", "by": "zeon256", "date": "2026-02-16", "stance": "recommend", "quote": "pleasantly surprised how much better it is today wrt rust binaries", "excerpt": "Been awhile since I used this but decided to open the latest version to check my rust binary and was pleasantly surprised how much better it is today wrt rust binaries", "context": "", "use_case": "analyzing Rust binaries", "switched_from": "", "story": "Ghidra by NSA"}, {"id": 749162146, "item_id": 46822634, "url": "https://news.ycombinator.com/item?id=46822634", "by": "freeqaz", "date": "2026-01-30", "stance": "neutral", "quote": "I even implemented vmx128 (custom 360-specific CPU instructions) into Ghidra and m2c", "excerpt": "I've been working on decompiling Dance Central 3 with AI and it's been insane. It's an Xbox 360 game that leverages the Kinect to track your body as your dance. It's a great game, but even with an emulator, it's still dependent on the Kinect hardware which is proprietary and has limited supply. Fortunately, a Debug build of this game was found on a dev unit (somehow), and that build does _not_ have crazy optimization", "context": "", "use_case": "decompilation", "switched_from": "", "story": "PlayStation 2 Recompilation Project Is Absolutely Incredible"}]}