Ghidra extensions — authorized lab overview

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

Ghidra (NationalSecurityAgency/ghidra, Apache-2.0) ships an Extension Manager so labs can add loaders, analyzers and UI modules without forking the core. Install extensions only from sources you trust, and run them only on programs you are authorized to examine.

On this page

Snapshot

FieldValue
HostGhidra (cite 12.2 framing; re-check releases)
Install UIFile → Install Extensions…
Related automationGhidra scripts, headless
PeersGhidrAssist, Ghidra vs IDA

Allowed framing

  • Installing a lab-maintained loader/analyzer ZIP for course firmware samples.
  • Teaching students to read extension.properties / license files before clicking Install.
  • Separating script Manager experiments from persistent extensions in CI images you control.

Scope we will not cover

  • No crack/keygen / license-bypass extensions.
  • No exploit / ROP / shellcode cookbooks packaged as “analyzers.”
  • No claiming every GitHub Ghidra extension builds on every Ghidra minor — pin versions.
  • No anti-debug or DRM defeat recipes.

Beginner path (authorized only)

  1. Install official Ghidra from NSA GitHub Releases; confirm Help → About.
  2. Open File → Install Extensions…; install one auditable extension ZIP your syllabus names.
  3. Restart Ghidra; verify the contribution appears (analyzer list, loader, or menu).
  4. Run it on a tiny program you compiled; keep Evidence notes outside the tool.
  5. For one-off tasks, prefer a GhidraScript before adding permanent extensions.
Which to pick
  • Use Ghidra extensions to package lasting lab capabilities under Apache-2.0 Ghidra.
  • Prefer scripts for throwaway authorized automations.
  • Refuse crack and exploit extension framing.

For legal, authorized and educational use only.

FAQ

What is a Ghidra extension?

A packaged add-on (often a ZIP with an extension.properties and module layout) that contributes analyzers, loaders, UI or libraries. Distinct from a one-off GhidraScript — see ghidra-scripts overview.

How do I install one?

In the GUI, File → Install Extensions… (Extension Manager) is the usual path; pick a ZIP from a source your lab trusts, then restart when prompted. Headless/CI installs follow your org's frozen extension directory policy.

Extension vs script?

Scripts are quick automations on an open program. Extensions are installable modules that can register analyzers, loaders and persistent contributions across sessions.

Which Ghidra version is cited?

Framing aligns with Ghidra 12.2 (tag Ghidra_12.2_build; checked 2026-10-24). Re-test extensions after major upgrades — APIs and Extension Manager UX can change.

Does this teach crack or exploit extensions?

No. Authorized automation and education only — BinBench will not supply crack/keygen extensions, DRM bypasses or exploit PoCs.

Sources