{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/setup.cfg",
    "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/ghidrecomp/sast.py",
    "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/Dockerfile",
    "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/.github/workflows/pytest-devcontainer-all.yml",
    "https://github.com/clearbluejar/ghidrecomp/tree/7a82556b052268a53c734a769bd14eeabc1a4888/tests",
    "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/LICENSE",
    "https://github.com/clearbluejar/ghidrecomp/releases/tag/v0.5.9",
    "https://pypi.org/project/ghidrecomp/0.5.9/"
  ],
  "category": "native-analysis",
  "description_en": "Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.",
  "description_zh": "通过 pyghidra 驱动 Ghidra 的 Python 命令行反编译工具：把二进制中的所有函数分别反编译为独立的 C 文件，或借助 Ghidra 的 C++ 导出器生成一个 C 文件和头文件，并保留 Ghidra 项目以便后续运行复用分析结果。可按正则筛选函数，从本地文件或 Microsoft、Chromium、Mozilla、Intel、NVIDIA、AMD 符号服务器应用 PDB 符号，加载额外的 GDT 数据类型库，输出 Mermaid 调用图 Markdown，生成 BSim 函数签名，并用 Semgrep 规则扫描反编译代码、输出 SARIF 报告。",
  "entry_url": "https://awesomerea.org/resources/ghidrecomp/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidrecomp/",
  "evidence_url": "https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/README.md",
  "group": "tools",
  "id": "ghidrecomp",
  "json_url": "https://awesomerea.org/resources/ghidrecomp/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ghidrecomp/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidrecomp/index.md",
  "name": "ghidrecomp",
  "name_zh": "ghidrecomp 命令行 Ghidra 批量反编译工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.5.9, published to PyPI and GitHub on 2026-01-06; the reviewed main commit is that tag. setup.cfg requires Python 3.10+ and pyghidra 2.2.1+ and marks the project as alpha; the CodeQL option is a placeholder that only prints a coming-soon message.",
    "Needs a separate Ghidra installation and the Java runtime it requires, found through GHIDRA_INSTALL_DIR. The Dockerfile and devcontainer build on the author's ghidra-python image and pin pyghidra 2.2.1 for Ghidra 11; CI runs pytest in that image for the latest Ghidra and for 11.3, 11.3.2 and 11.4.2. SAST scanning needs Semgrep, installed with the sast extra.",
    "Binaries to decompile are the analyst's own; symbol lookups contact the listed public symbol servers unless --skip-symbols is set. The tests bundle tests/data/afd.sys.10.0.22621.1415, a Microsoft Windows driver build also used in the README examples, an AArch64 ls binary and an ntddk_64.gdt data-type archive; these files keep their publishers' terms.",
    "The README presents the output as decompilations for research and analysis and makes no recompilation claim; the tests check function counts, call graphs, one signature after GDT application, BSim and SAST output. GPL-3.0 (LICENSE); Ghidra and Semgrep keep their own licenses."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v0.5.9，于 2026-01-06 发布到 PyPI 和 GitHub；所审阅的 main 分支提交即该标签。setup.cfg 要求 Python 3.10+ 和 pyghidra 2.2.1+，并将项目标为 alpha 阶段；CodeQL 选项只是占位，运行时仅提示即将推出。",
    "需要另行安装 Ghidra 及其所需的 Java 运行环境，并通过 GHIDRA_INSTALL_DIR 指定位置。Dockerfile 和 devcontainer 基于作者的 ghidra-python 镜像，并在 Ghidra 11 下固定 pyghidra 2.2.1；CI 在该镜像中针对最新版 Ghidra 以及 11.3、11.3.2 和 11.4.2 运行 pytest。SAST 扫描需要 Semgrep，可通过 sast 可选依赖安装。",
    "待反编译的二进制须由分析者自备；除非设置 --skip-symbols，符号查询会访问所列的公共符号服务器。测试数据附带 tests/data/afd.sys.10.0.22621.1415（一个 Microsoft Windows 驱动版本，README 示例也使用它）、一个 AArch64 ls 二进制和 ntddk_64.gdt 数据类型库；这些文件遵循各自发布者的条款。",
    "README 将输出定位为用于研究和分析的反编译结果，未声称可重新编译；测试检查的是函数数量、调用图、应用 GDT 后的一个函数签名、BSim 和 SAST 输出。采用 GPL-3.0（LICENSE）；Ghidra 和 Semgrep 各自保留其许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/clearbluejar/ghidrecomp",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}