# Yagi

> Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. The README lists x86, x86-64, ARM, AArch64, PowerPC, MIPS, SPARC, AVR8, 6502, Z80 and eBPF as supported, while other Ghidra processors such as Dalvik, JVM, RISC-V and 68000 are not yet enabled.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-04
- Original resource: <https://github.com/airbus-cert/Yagi>
- Primary source: <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/README.md>
- Catalog page: <https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/>
- Record JSON: <https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/yagi-ghidra-decompiler-for-ida/index.md)

## Requirements & limits

- Inactive since its latest release, v1.5.0 (2022-08-04), which adds eBPF and IDA 7.7 support and ships Windows MSI installers for IDA 7.6, IDA 7.7 and IDA Freeware; the last Linux installers (.sh and .tar.gz for IDA 7.5, 7.6 and Freeware) are in v1.4.0 (2021-12-20). No builds for IDA 8 or later are published. The default branch is main; an older master branch stops in 2021.
- Source builds need a recursive clone, whose submodules are Airbus CERT's Ghidra fork on its fix-memory-access-violation branch (pinned at the Ghidra 10.1 release commit), eBPF-for-Ghidra and cylance/eBPF_processor. They also need CMake 3.11+, a C++ compiler (Visual Studio on Windows), flex and bison for the SLEIGH grammar, WiX for the Windows installer, and the Hex-Rays IDA SDK matching the user's IDA version, which the repository does not include.
- The workflows build on a self-hosted Windows runner against a locally installed IDA 7.6 SDK. Their googletest unit tests decompile machine-code byte arrays written into the test sources for x86 (16-, 32- and 64-bit), ARM, MIPS, PowerPC, SPARC, 6502 and Z80, using mocked IDA loader, symbol and type interfaces. README TODOs include enum types, AArch64 function-end rules and changing constant types.
- Apache-2.0; Ghidra's decompiler keeps its own Apache-2.0 terms, and IDA and its SDK are Hex-Rays products under their own licenses.

## Primary sources

1. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/README.md>
2. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/CHANGELOG.md>
3. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/.gitmodules>
4. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/CMakeLists.txt>
5. <https://github.com/airbus-cert/Yagi/tree/6fc4787bf3dcb8480be5bf990662b30bf9130d53/tests>
6. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/.github/workflows/unittests.yml>
7. <https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/LICENSE>
8. <https://github.com/airbus-cert/Yagi/releases/tag/v1.5.0>
9. <https://github.com/airbus-cert/Yagi/releases/tag/v1.4.0>

## More in Native binaries

- [frida-scripts (0xdea)](https://awesomerea.org/resources/raptor-frida-scripts/index.md) · Tool
- [System Informer](https://awesomerea.org/resources/system-informer/index.md) · Tool
- [CyberChef](https://awesomerea.org/resources/cyberchef/index.md) · Tool
- [YARA](https://awesomerea.org/resources/yara/index.md) · Tool
- [Cheat Engine](https://awesomerea.org/resources/cheat-engine/index.md) · Tool
- [Noriben](https://awesomerea.org/resources/noriben/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.