Tool
ghidrecomp
Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Latest release at review: v0.5.9, published to PyPI and GitHub on 2026-01-06; the reviewed main commit is that tag. setup.cfg requires Python 3.10+ and pyghidra 2.2.1+ and marks the project as alpha; the CodeQL option is a placeholder that only prints a coming-soon message.
- Needs a separate Ghidra installation and the Java runtime it requires, found through GHIDRA_INSTALL_DIR. The Dockerfile and devcontainer build on the author's ghidra-python image and pin pyghidra 2.2.1 for Ghidra 11; CI runs pytest in that image for the latest Ghidra and for 11.3, 11.3.2 and 11.4.2. SAST scanning needs Semgrep, installed with the sast extra.
- Binaries to decompile are the analyst's own; symbol lookups contact the listed public symbol servers unless --skip-symbols is set. The tests bundle tests/data/afd.sys.10.0.22621.1415, a Microsoft Windows driver build also used in the README examples, an AArch64 ls binary and an ntddk_64.gdt data-type archive; these files keep their publishers' terms.
- The README presents the output as decompilations for research and analysis and makes no recompilation claim; the tests check function counts, call graphs, one signature after GDT application, BSim and SAST output. GPL-3.0 (LICENSE); Ghidra and Semgrep keep their own licenses.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- setup.cfg GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- ghidrecomp/sast.py GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- Dockerfile GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- .github/workflows/pytest-devcontainer-all.yml GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- tests GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- LICENSE GitHub · clearbluejar/ghidrecomp · Revision 7a82556
- https://github.com/clearbluejar/ghidrecomp/releases/tag/v0.5.9
- https://pypi.org/project/ghidrecomp/0.5.9/