{
  "added_at": "2026-11-04",
  "additional_evidence_urls": [
    "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/CHANGELOG.md",
    "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/.gitmodules",
    "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/CMakeLists.txt",
    "https://github.com/airbus-cert/Yagi/tree/6fc4787bf3dcb8480be5bf990662b30bf9130d53/tests",
    "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/.github/workflows/unittests.yml",
    "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/LICENSE",
    "https://github.com/airbus-cert/Yagi/releases/tag/v1.5.0",
    "https://github.com/airbus-cert/Yagi/releases/tag/v1.4.0"
  ],
  "category": "native-analysis",
  "description_en": "Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. The README lists x86, x86-64, ARM, AArch64, PowerPC, MIPS, SPARC, AVR8, 6502, Z80 and eBPF as supported, while other Ghidra processors such as Dalvik, JVM, RISC-V and 68000 are not yet enabled.",
  "description_zh": "Airbus CERT 开发的插件，把 Ghidra 的原生反编译器嵌入 IDA Pro 和 IDA Free：在函数上按 F3 即可在 IDA 中查看 Ghidra 生成的 C 代码，在其中所做的修改（包括函数原型等全局符号，以及栈变量和寄存器变量的名称与类型）会保存到 IDA 数据库。README 列出已支持 x86、x86-64、ARM、AArch64、PowerPC、MIPS、SPARC、AVR8、6502、Z80 和 eBPF，而 Dalvik、JVM、RISC-V、68000 等其他 Ghidra 处理器尚未启用。",
  "entry_url": "https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/yagi-ghidra-decompiler-for-ida/",
  "evidence_url": "https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/README.md",
  "group": "tools",
  "id": "yagi-ghidra-decompiler-for-ida",
  "json_url": "https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/yagi-ghidra-decompiler-for-ida/index.md",
  "name": "Yagi",
  "name_zh": "Yagi：IDA 中的 Ghidra 反编译器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Inactive since its latest release, v1.5.0 (2022-08-04), which adds eBPF and IDA 7.7 support and ships Windows MSI installers for IDA 7.6, IDA 7.7 and IDA Freeware; the last Linux installers (.sh and .tar.gz for IDA 7.5, 7.6 and Freeware) are in v1.4.0 (2021-12-20). No builds for IDA 8 or later are published. The default branch is main; an older master branch stops in 2021.",
    "Source builds need a recursive clone, whose submodules are Airbus CERT's Ghidra fork on its fix-memory-access-violation branch (pinned at the Ghidra 10.1 release commit), eBPF-for-Ghidra and cylance/eBPF_processor. They also need CMake 3.11+, a C++ compiler (Visual Studio on Windows), flex and bison for the SLEIGH grammar, WiX for the Windows installer, and the Hex-Rays IDA SDK matching the user's IDA version, which the repository does not include.",
    "The workflows build on a self-hosted Windows runner against a locally installed IDA 7.6 SDK. Their googletest unit tests decompile machine-code byte arrays written into the test sources for x86 (16-, 32- and 64-bit), ARM, MIPS, PowerPC, SPARC, 6502 and Z80, using mocked IDA loader, symbol and type interfaces. README TODOs include enum types, AArch64 function-end rules and changing constant types.",
    "Apache-2.0; Ghidra's decompiler keeps its own Apache-2.0 terms, and IDA and its SDK are Hex-Rays products under their own licenses."
  ],
  "requirements_zh": [
    "自最新版本 v1.5.0（2022-08-04）后即无更新；该版本新增 eBPF 和 IDA 7.7 支持，提供适用于 IDA 7.6、IDA 7.7 和 IDA Freeware 的 Windows MSI 安装包；最后的 Linux 安装包（适用于 IDA 7.5、7.6 和 Freeware 的 .sh 与 .tar.gz）见 v1.4.0（2021-12-20）。没有发布适用于 IDA 8 及以后版本的构建。默认分支为 main；较旧的 master 分支停在 2021 年。",
    "从源码构建需要递归克隆，子模块包括 Airbus CERT 维护的 Ghidra 分支（fix-memory-access-violation 分支，固定在 Ghidra 10.1 发布提交）、eBPF-for-Ghidra 和 cylance/eBPF_processor。另外需要 CMake 3.11+、C++ 编译器（Windows 上为 Visual Studio）、用于解析 SLEIGH 语法的 flex 和 bison、用于生成 Windows 安装包的 WiX，以及与使用者 IDA 版本对应的 Hex-Rays IDA SDK；仓库不包含该 SDK。",
    "工作流在自托管的 Windows 运行器上，基于本地安装的 IDA 7.6 SDK 构建。其 googletest 单元测试通过模拟的 IDA 加载器、符号和类型接口，反编译直接写在测试源码中的机器码字节数组，覆盖 x86（16、32、64 位）、ARM、MIPS、PowerPC、SPARC、6502 和 Z80。README 的待办事项包括枚举类型、AArch64 函数结尾规则以及修改常量类型。",
    "Apache-2.0 许可；Ghidra 反编译器沿用其自身的 Apache-2.0 条款，IDA 及其 SDK 是 Hex-Rays 的产品，各有许可条款。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/airbus-cert/Yagi",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}