Thank The NSA For Their Ghidra Software Now Helping Firmware Reverse Engineering

Written by Michael Larabel in Coreboot on 1 September 2019 at 07:28 AM EDT. 23 Comments
Ghidra is the open-source reverse engineering tool published by the US National Security Agency as an alternative to existing decompilers/disassemblers and other reverse engineering utilities. As noted earlier this summer, a Google Summer of Code project has been creating Ghidra plug-ins for helping with firmware reverse engineering.

It's been some time since last hearing anything about that effort to boost firmware reverse engineering, but in their final GSoC report, it was a success. With this new Ghidra plug-in there is support for loading into Ghidra of PCI option ROMs, the Intel firmware descriptor, reading the flash map, Coreboot File-System, UEFI Firmware Volumes, and the UEFI Terse Executable format. There is also a helper script for analyzing UEFI binaries.

Moving forward, the student developer Alex James may tackle a processor module for disassembling the EFI Byte Code, support for more features in his UEFI helper script, and other bits to assist in firmware reverse engineering.

The GSoC 2019 recap for this project can be found via the blog. The new code for Ghidra is currently hosted on Alex's GitHub.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week