{"id":28086,"library":"pyghidra","title":"pyghidra","description":"pyghidra is a Python package that provides a native CPython interface for Ghidra, the NSA's reverse engineering framework. Current version 3.0.2 supports Ghidra 12.x and requires Python >=3.9. It enables scripting Ghidra with standard Python and accessing its API directly within the Ghidra GUI or headlessly.","status":"active","version":"3.0.2","language":"python","source_language":"en","source_url":"https://github.com/NationalSecurityAgency/ghidra","tags":["reverse-engineering","ghidra","disassembly","binary-analysis"],"install":[{"cmd":"pip install pyghidra","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Requires a local Ghidra installation; pyghidra does not bundle it.","package":"ghidra","optional":false}],"imports":[{"note":"Direct import works; no submodule needed.","symbol":"pyghidra","correct":"import pyghidra"},{"note":"start is a top-level function in pyghidra module; direct import works but calling pyghidra.start() is clearer.","wrong":"from pyghidra import start","symbol":"start","correct":"pyghidra.start()"},{"note":"Ghidra API classes must be imported via full Java package path; pyghidra makes them accessible as Python modules.","wrong":"import ghidra.program.model.listing","symbol":"Ghidra API","correct":"from ghidra.program.model.listing import Function as GhidraFunction"}],"quickstart":{"code":"import pyghidra\nimport os\n\ndef analyze_binary():\n    binary_path = os.environ.get('BINARY_PATH', '/bin/ls')\n    with pyghidra.start(binary_path) as ctx:\n        program = ctx.getCurrentProgram()\n        print(f\"Analyzing: {program.getName()}\")\n        funcs = program.getFunctionManager().getFunctions(True)\n        for func in funcs:\n            print(func.getName())\n\nif __name__ == '__main__':\n    analyze_binary()","lang":"python","description":"Start Ghidra headlessly, load a binary, and iterate over its functions."},"warnings":[{"fix":"Ensure GHIDRA_INSTALL_DIR environment variable points to the correct Ghidra version matching pyghidra.","message":"pyghidra requires a compatible Ghidra installation. Version 3.0.2 works with Ghidra 12.x; older versions (e.g., 2.x) are for Ghidra 11.x. Mixing versions causes import errors.","severity":"gotcha","affected_versions":"all"},{"fix":"Replace `pyghidra.open()` with `pyghidra.start()`.","message":"The `pyghidra.open()` function is deprecated in 3.0.0 and removed in later versions. Use `pyghidra.start()` as a context manager.","severity":"deprecated","affected_versions":">=3.0.0"},{"fix":"Use full Java package path: e.g., `from ghidra.program.model.listing import Function`.","message":"Ghidra API classes are accessed with Python-style imports but follow Java package paths. Common mistake: using camelCase instead of PEP8 import style.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"last_verified":"2026-05-09T00:00:00.000Z","next_check":"2026-08-07T00:00:00.000Z","problems":[{"fix":"Install pyghidra with pip install pyghidra or upgrade to latest.","cause":"pyghidra not installed or incompatible version.","error":"ImportError: cannot import name 'start' from 'pyghidra'"},{"fix":"Set GHIDRA_INSTALL_DIR=/path/to/ghidra before running Python.","cause":"Environment variable GHIDRA_INSTALL_DIR not set or pointing to invalid path.","error":"ValueError: Ghidra installation directory not set. Set GHIDRA_INSTALL_DIR environment variable."},{"fix":"Iterate directly: `for func in funcs:` or convert to list with list(funcs).","cause":"Calling list() or indexing on a function iterator incorrectly.","error":"ghidra.program.model.listing.Function is not subscriptable"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}