Retro reversing logo

Ghidra Decompiler & Disassembler - Awesome List

Edit on Github | Updated: 20th November 2024

Ghidra is the most advanced reverse engineering tool on the market, and best of all it is completly free and open source! Most of the content on RetroReversing will be using Ghidra going forward due to it being much more accessable than competitors such as IDA Pro.

Introduction to Ghidra

There is no better way to start out the hobby reverse engineering than learning Ghidra, it is an essentail tool that takes much of the headaches out of reversing.

Introduction to Decompiling C++ with Ghidra

For a good introduction to decompiling with Ghidra check out this post.

Console Plugins

Nintendo Game Boy

Download the Ghidra plugin from Github

Nintendo Game Boy Advance

Download the Ghidra plugin from Github

An excellent guide for decompiling GBA games using Ghidra and mGBA is available on Starcubelabs

Another excellent guide is on wrongbaud

Nintendo DS

Download the Ghidra plugin from Github

Nintendo Entertainment System

Download the Ghidra plugin from Github

It even has multiple builds setup for each Ghidra version via Github Workflows!

Note that there was another older Ghidra plugin called Ghidra-Nes-Rom-Decompiler-Plugin however it failed to build against latest Ghidra (11.1.2).

Super Nintendo

There is only one Ghidra plugin for SNES but it is currently not under active development you can get it from Github

Nintendo 64

Nintendo 64 games can be slightly harder to reverse due to everything being bundles as one large ROM image containing all the code and assets used in the game. Luckily there are a few tools that can help, such as the Reversing Emulator and a N64 Loader for Ghidra.

N64 Decompiling with Ghidra

If you are interested in Decompiling a Nintendo 64 game with Ghidra check out this post.

Gamecube

Download the Ghidra plugin from Github

Note that to build the GameCubeLoader you will need to have gradle version 7 or below installed otherwise you will get an error similar to:

FAILURE: Build failed with an exception.

* Where:
Build file './Ghidra-GameCube-Loader/build.gradle' line: 63

* What went wrong:
A problem occurred evaluating root project 'GameCubeLoader'.
> Adding a Configuration as a dependency is no longer allowed as of Gradle 8.0.

On Mac OSX you can install an older version of Gradle using brew:

brew install gradle@7

Wii

A guide for using Ghidra on Wii games is available on WiiBrew

Sega Master System/Game gear

Download the Ghidra plugin from Github

Sega Mega Drive/Genesis

Download the Ghidra plugin from Github

Sega Saturn

Download the Ghidra plugin from Github

Sega Dreamcast

Download the Ghidra plugin from Github Also for GDI support in Ghidra: Github

Original Xbox

Download the Ghidra plugin from Github

Xbox 360

Download the Ghidra plugin from Github

Playstation 1

Download the Ghidra plugin from Github Also for a guide for using Ghidra for PS1 reversing: tokimeki-memorial

Playstation 2

Download the Ghidra plugin from Github

Playstation 3

There are a few useful script for working with PS3 executables on Github

Playstation Portable

Download the Ghidra plugin from Github


Feature Plugins

While Ghidra has a large number of features built in, there are a number of features missing that are thankfully available due to community plugins, this section will cover some of the most useful for game reversing.

CodeCut

CodeCut allows a user to assign functions to object files in Ghidra, and then interact with the binary at the object file level. Functions are assigned to object files by setting the Namespace field in the Ghidra database. DeepCut attempts to establish initial object file boundaries which the user can then adjust using the CodeCut Table window. https://github.com/jhuapl/codecut


Ghidra decompiler macros

WHen using the decompiler Ghidra spits out code which uses a number of macros which are not immedietly obvious of their function, we provide some of these below with our reccomendation of an easier to read version.

CONCAT11(x, y)

In Ghidra, the CONCAT11(x, y) operation combines two 8-bit values (x and y) into a single 16-bit value. The operation is defined as:

#define CONCAT11(x, y) = (((uint16_t)x) << 8) | ((uint8_t)y)

When cleaning up the deocmpiled code we suggest using the following replacement as it is more explicit about the purpose:

// MergeBytesTo16Bit -  combines high and low bytes into a single 16bit value
#define MergeBytesTo16Bit(highByte, lowByte) = (((uint16_t)highByte) << 8) | ((uint8_t)lowByte)

All Ghidra Posts

Introduction to Decompiling C++ with Ghidra

Read all about Introduction to Decompiling C++ with Ghidra in this s...

N64 Decompiling with Ghidra

Read all about N64 Decompiling with Ghidra in this s...

Reversing Engineering a NES Game With Ghidra

Read all about Reversing Engineering a NES Game With Ghidra in this s...

Want More?

Follow us on Twitter & Bluesky!