{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/doc/building.md",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/util/ghidrathon_configure.py",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/util/requirements.txt",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/ghidra_scripts/ghidrathon_example.py",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/.github/workflows/tests.yml",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/.github/workflows/build.yml",
    "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/LICENSE.txt",
    "https://github.com/mandiant/Ghidrathon/releases/tag/v4.0.0",
    "https://github.com/NationalSecurityAgency/ghidra/blob/1b9e58a915cf867e106495eaa2a4b18eb4971c9d/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md#L1283",
    "https://github.com/NationalSecurityAgency/ghidra/blob/1b9e58a915cf867e106495eaa2a4b18eb4971c9d/Ghidra/Features/PyGhidra/README.md"
  ],
  "category": "native-analysis",
  "description_en": "Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. It adds an interactive Python 3 interpreter window, Python 3 scripts in the Script Manager and Python 3 post-scripts in headless analyzeHeadless runs, with GhidraScript state such as currentProgram() and FlatProgramAPI methods available as Python builtins. Because the configured interpreter or virtual environment is used as is, scripts can import installed packages; the README names capa, Unicorn and angr as motivating examples and shows Unicorn emulating ARM code inside Ghidra.",
  "description_zh": "Mandiant FLARE 团队开发的 Ghidra 扩展，借助 Jep 把用户本机的 CPython 3 解释器嵌入 Ghidra，作为 Ghidra 基于 Jython 的 Python 2.7 脚本支持之外的选择。它提供交互式 Python 3 解释器窗口，可在脚本管理器中编写和运行 Python 3 脚本，也可在无界面的 analyzeHeadless 运行中执行 Python 3 后处理脚本；currentProgram() 等 GhidraScript 状态和 FlatProgramAPI 方法以 Python 内置名称的形式提供。由于直接使用所配置的解释器或虚拟环境，脚本可以导入其中已安装的包；README 以 capa、Unicorn 和 angr 为开发动机举例，并演示在 Ghidra 内用 Unicorn 模拟执行 ARM 代码。",
  "entry_url": "https://awesomerea.org/resources/ghidrathon/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidrathon/",
  "evidence_url": "https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/README.md",
  "group": "tools",
  "id": "ghidrathon",
  "json_url": "https://awesomerea.org/resources/ghidrathon/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ghidrathon/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidrathon/index.md",
  "name": "Ghidrathon",
  "name_zh": "Ghidrathon Ghidra Python 3 脚本扩展",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository is archived on GitHub and read-only. Its last commit on main dates from 2024-05-08, and the latest release, v4.0.0 of 2024-02-13, attaches one extension zip that the release workflow builds against Ghidra 11.0 and bundles with the configure script. The archive states no reason; Ghidra's own change history records that 11.3 (February 2025) integrated PyGhidra, a native CPython 3 interface whose module provides a CPython interpreter plugin and a script provider for CPython 3 GhidraScripts.",
    "The README requires Python 3.8+, exactly Jep 4.2.0, Ghidra 10.3.2+ and Java 17+. Setup installs Jep from util/requirements.txt into the chosen interpreter or virtual environment and runs util/ghidrathon_configure.py against the Ghidra install directory, which writes a ghidrathon.save file there or under GHIDRATHON_SAVE_PATH; the zip is then installed through Ghidra's extension manager, whose version-mismatch prompt the README says may be overridden. Source builds need Gradle 7.3+ and the Jep 4.2.0 JAR downloaded into lib/.",
    "CI built and tested only Ghidra 10.3.2 and 11.0 with Python 3.8 and 3.12 on Ubuntu, Windows and macOS, running the repository's Python tests as headless post-scripts. Jep embeds Python in the JVM through JNI, which the README notes Ghidra's developers advise against, and unlike Ghidra's Java and Jython APIs, scripts read GhidraScript state through calls such as currentProgram().",
    "Apache-2.0 (LICENSE.txt). The repository commits Java and Python sources, an example script, Python tests and three README screenshots, and no binaries; the CI tests analyze a demangler executable taken from the downloaded Ghidra distribution."
  ],
  "requirements_zh": [
    "该仓库已在 GitHub 归档，处于只读状态。main 分支最后一次提交为 2024-05-08；最新版本 v4.0.0 发布于 2024-02-13，附带一个扩展 zip，由发布工作流针对 Ghidra 11.0 构建，并打包了配置脚本。归档未说明原因；据 Ghidra 自身的变更记录，11.3（2025 年 2 月）集成了 PyGhidra 这一原生 CPython 3 接口，其模块提供 CPython 解释器插件，以及用于 CPython 3 GhidraScript 的脚本提供程序。",
    "README 要求 Python 3.8+、恰好 Jep 4.2.0、Ghidra 10.3.2+ 和 Java 17+。安装时先按 util/requirements.txt 把 Jep 装进选定的解释器或虚拟环境，再针对 Ghidra 安装目录运行 util/ghidrathon_configure.py，它会在该目录或 GHIDRATHON_SAVE_PATH 下写入 ghidrathon.save 文件；随后通过 Ghidra 的扩展管理器安装 zip，README 说明遇到版本不匹配提示时可选择仍然安装。从源码构建需要 Gradle 7.3+，并需把 Jep 4.2.0 JAR 下载到 lib/。",
    "CI 仅在 Ubuntu、Windows 和 macOS 上，以 Python 3.8 和 3.12 针对 Ghidra 10.3.2 与 11.0 构建测试，并以无界面后处理脚本方式运行仓库中的 Python 测试。Jep 通过 JNI 把 Python 嵌入 JVM，README 指出 Ghidra 开发者不建议在 Ghidra 中使用 JNI；与 Ghidra 的 Java 和 Jython API 不同，脚本需通过 currentProgram() 这类函数调用读取 GhidraScript 状态。",
    "Apache-2.0（LICENSE.txt）。仓库提交的是 Java 与 Python 源码、一个示例脚本、Python 测试和三张 README 截图，不含二进制文件；CI 测试分析的是从下载的 Ghidra 发行包中取得的 demangler 可执行文件。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/Ghidrathon",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}