# ghidrecomp

> Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/clearbluejar/ghidrecomp>
- Primary source: <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/README.md>
- Catalog page: <https://awesomerea.org/resources/ghidrecomp/>
- Record JSON: <https://awesomerea.org/resources/ghidrecomp/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ghidrecomp/index.md)

## Requirements & limits

- Latest release at review: v0.5.9, published to PyPI and GitHub on 2026-01-06; the reviewed main commit is that tag. setup.cfg requires Python 3.10+ and pyghidra 2.2.1+ and marks the project as alpha; the CodeQL option is a placeholder that only prints a coming-soon message.
- Needs a separate Ghidra installation and the Java runtime it requires, found through GHIDRA_INSTALL_DIR. The Dockerfile and devcontainer build on the author's ghidra-python image and pin pyghidra 2.2.1 for Ghidra 11; CI runs pytest in that image for the latest Ghidra and for 11.3, 11.3.2 and 11.4.2. SAST scanning needs Semgrep, installed with the sast extra.
- Binaries to decompile are the analyst's own; symbol lookups contact the listed public symbol servers unless --skip-symbols is set. The tests bundle tests/data/afd.sys.10.0.22621.1415, a Microsoft Windows driver build also used in the README examples, an AArch64 ls binary and an ntddk_64.gdt data-type archive; these files keep their publishers' terms.
- The README presents the output as decompilations for research and analysis and makes no recompilation claim; the tests check function counts, call graphs, one signature after GDT application, BSim and SAST output. GPL-3.0 (LICENSE); Ghidra and Semgrep keep their own licenses.

## Primary sources

1. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/README.md>
2. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/setup.cfg>
3. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/ghidrecomp/sast.py>
4. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/Dockerfile>
5. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/.github/workflows/pytest-devcontainer-all.yml>
6. <https://github.com/clearbluejar/ghidrecomp/tree/7a82556b052268a53c734a769bd14eeabc1a4888/tests>
7. <https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/LICENSE>
8. <https://github.com/clearbluejar/ghidrecomp/releases/tag/v0.5.9>
9. <https://pypi.org/project/ghidrecomp/0.5.9/>

## More in Native binaries

- [Vivisect](https://awesomerea.org/resources/vivisect/index.md) · Tool
- [r2pipe](https://awesomerea.org/resources/r2pipe/index.md) · Tool
- [GREASE](https://awesomerea.org/resources/grease/index.md) · Tool
- [PLASMA](https://awesomerea.org/resources/plasma-disassembler/index.md) · Tool
- [mobdevim](https://awesomerea.org/resources/mobdevim/index.md) · Tool
- [XPEViewer](https://awesomerea.org/resources/xpeviewer/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.