UGT: Use the Geek ThingUGT: Use the Geek Thing

Browse projects/Developer tools/Inspect a compiled program/Ghidra

Ghidranationalsecurityagency

Look inside a compiled program

Get a function inventory and decompiled C-like code from a program file.

Licences & source

Inspect a compiled program when you need to understand its functions or recover how a feature works. Ghidra analyses the file locally without executing it and saves the decompiled functions alongside their names, addresses and any failures.

This is Ghidra’s headless analysis workflow. The full headless command remains available for custom analysis and scripts. For the interactive desktop interface, use Ghidra’s native application. Decompiled code is an approximation, not the original source.

You bring

  • a compiled executable or library recognised by Ghidra, such as an ELF or PE fileprogram

You get

  • the C-like code recovered for each successfully decompiled functionfunctions.c
  • function names, addresses, signatures, input hash and decompilation failuresfunctions.json
  • Ghidra's analysis log, including warningsanalysis.log
  • Ghidra's full headless command, for your own projects, analysis options and scripts

Make it yours

UGT guides you through these settings.

  • maximum analysis and export time in seconds; defaults to 900

    Choose 30–3600. Large programs can need more time and memory. A timeout fails the run.

Good to know

  • This is a CPU headless setup with a 3 GB container memory limit. Large or heavily obfuscated binaries may need a different setup.
  • The automatic workflow requires a recognised executable format. Raw firmware needing a processor, base address or special loader should use the provided headless command with explicit options.
More setup notes
  • Some functions cannot be decompiled. Read failures in functions.json and warnings in analysis.log; a partial result does not establish complete program coverage. The desktop GUI is not included.

Your files & access

Processing has no network access. The recipe can use only the files you give it. UGT downloads the software during setup.

Licences & source

Ghidra Apache-2.0, with third-party distribution licences retained; OpenJDK GPL-2.0 with Classpath Exception. UGT's export script, driver and synthetic sample are Apache-2.0.

What UGT sets up for you
How was it tested?

Run on clean x86-64 (Intel/AMD) and ARM64 machines on 10 Nov 2026. Its check passed on a known sample and rejected deliberately broken results.

This checks the job this page describes, not every feature of the original project.

Recipe files & version

The 6 recipe files

Recipe revision ce0d1118c95f, from 8ca9077040cc.

Developer tools

Run tools and services for the software you build.

All 3