**Website:** https://github.com/NationalSecurityAgency/ghidra **Release Notes:** https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md [Ghidra](https://github.com/NationalSecurityAgency/ghidra) is a free, open source multi-architecture disassembler developed and maintained by the [[NSA]]. It's a powerful (although quirky) tool for working with disassembled code for lots of architectures. # Processor Support This supports all manner of processors. I've worked with [[6502 Assembly|6502]]. Ghidra's processor definitions are implemented in a format called [[Sleigh Processor Specification Files]]. # Plugins ## [GhidraNes](https://github.com/kylewlacy/GhidraNes): Designed for NES disassembly. Pulls out each of the banks into different segments in the Program Tree. This plugin splits games into different ROM banks. An understanding of what banks are loaded and when for a given game is pretty important when figuring out which banks should be disassembled and which should be discarded or treated as data. # Disassembly View ## Special Instructions The disassembly view shows special instructions that can help communicate what some assembly is trying to do. Here are some: ### CONCAT11(x, y) Takes two 1-byte values and generates a 16-bit result (which may be output to a range of bytes. This is equivalent to: ```c# #define CONCAT11(x,y) (((uint16_t)x) << 8) | (uint8_t)y ``` # Tips * Use References ( :LiKeyboard: `R`) to update a reference to another location. This is useful for working with [[NES]] reverse-engineering, switching functions to another bank. For example, you can link a relative offset in a lookup table to an absolute position in another bank. * Build Structs and Enums and liberally apply them to blocks of memory wherever appropriate, to ease readability. * Learn and use different forms of comments: * Pre-comments before a block of code * End-of-line comments to detail assembly code * Post-comments after a block of code (I use this to indicate when a function falls through to another) * Plate comments, which are very noticeable and are used at the top of functions * Repeatable comments, which can be assigned to a label or a function to add that comment on all references to it (useful for documenting common bits, notable values) * Get comfortable with the quirks of the Decompile view, which produces a C-like view of ranges of bytes. This is helpful, but does not always produce correct output. Depending on the parameters, the results, the logic, important things may not even make an appearance in this view. Reading and understanding the assembly is important.