# Ghidra Snippets

> A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. It starts from the Flat Program, Flat Decompiler and Flat Debugger APIs, then shows where a task needs Ghidra's fuller API; most snippets include an example of their output.

- Type: Learning resource
- Targets: Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/HackOvert/GhidraSnippets>
- Primary source: <https://github.com/HackOvert/GhidraSnippets/blob/9bcd718e8958387ff5695194b83a52df4e0a3de7/README.md>
- Catalog page: <https://awesomerea.org/resources/ghidra-snippets/>
- Record JSON: <https://awesomerea.org/resources/ghidra-snippets/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ghidra-snippets/index.md)

## Requirements & limits

- Everything is in one README, with no script files or releases. The last change, on 2023-07-19, fixed a typo; the one before, on 2022-11-09, added Flat API notes for Ghidra 10.2. Version remarks range from Ghidra 9.1 and 9.2.2 to 10.2, so names and behavior in current Ghidra releases may differ; the README points to Ghidra's built-in API help and to the ghidra.re online docs, which it says may not be up to date.
- The examples run in Ghidra's Python scripting environment, which the README calls the Jython console, against a program the user has loaded. Plotting a function AST also needs GraphViz's dot plus networkx and pydot importable from Jython, and the README notes that Python modules with native code do not work there. Compatibility with PyGhidra or Python 3 is not stated.
- Released under CC0 1.0. The README calls the snippets a verbose mashup with more than one way to do each task and invites pull requests.

## Primary sources

1. <https://github.com/HackOvert/GhidraSnippets/blob/9bcd718e8958387ff5695194b83a52df4e0a3de7/README.md>
2. <https://github.com/HackOvert/GhidraSnippets/blob/9bcd718e8958387ff5695194b83a52df4e0a3de7/LICENSE>
3. <https://github.com/HackOvert/GhidraSnippets/commit/643bbee5d287c79cb92d93112f89346ce3023a1f>

## More in References and learning

- [Frida Boot: a beginner binary instrumentation workshop](https://awesomerea.org/resources/frida-boot-workshop/index.md) · Learning resource
- [Embedded Hacking (mytechnotalent)](https://awesomerea.org/resources/mytechnotalent-embedded-hacking/index.md) · Learning resource
- [Reverse-Engineering a Bluetooth-Enabled Radar Detector](https://awesomerea.org/resources/cobra-irad-bluetooth-protocol-walkthrough/index.md) · Learning resource
- [Link Pi ENCx encoders (unofficial documentation)](https://awesomerea.org/resources/linkpi-encx-unofficial-docs/index.md) · Learning resource
- [Supplementary AST-Based Deobfuscation Materials](https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/index.md) · Learning resource
- [MCP Reversing Dataset (mrexodia)](https://awesomerea.org/resources/mcp-reversing-dataset/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.