UGT: Use the Geek ThingUGT: Use the Geek Thing

Browse projects/Ghidra

Ghidranationalsecurityagency

Run Ghidra on your computer

Get a function inventory and decompiled C-like code from a program file.

Look inside a compiled program

Inspect a compiled program when you need to understand its functions or recover how a feature works. Ghidra analyses the file locally without executing it and saves the decompiled functions alongside their names, addresses and any failures.

This is Ghidra’s headless analysis workflow. The full headless command remains available for custom analysis and scripts. For the interactive desktop interface, use Ghidra’s native application. Decompiled code is an approximation, not the original source.

You bring

  • a compiled executable or library recognised by Ghidra, such as an ELF or PE fileprogram

You get

  • the C-like code recovered for each successfully decompiled functionfunctions.c
  • function names, addresses, signatures, input hash and decompilation failuresfunctions.json
  • Ghidra's analysis log, including warningsanalysis.log
  • Ghidra's full headless command, for your own projects, analysis options and scripts

Licences & source

Ghidra Apache-2.0, with third-party distribution licences retained; OpenJDK GPL-2.0 with Classpath Exception. UGT's export script, driver and synthetic sample are Apache-2.0.

Setup & verification

Run on clean x86-64 (Intel/AMD) and ARM64 machines on 10 Nov 2026. Its check passed on a known sample and rejected deliberately broken results.

This checks the job this page describes, not every feature of the original project.

Known issues

  • This is a CPU headless setup with a 3 GB container memory limit. Large or heavily obfuscated binaries may need a different setup.
  • The automatic workflow requires a recognised executable format. Raw firmware needing a processor, base address or special loader should use the provided headless command with explicit options.
  • Some functions cannot be decompiled. Read failures in functions.json and warnings in analysis.log; a partial result does not establish complete program coverage. The desktop GUI is not included.
Recipe details