id = "ghidra" name = "Ghidra" homepage = "https://github.com/NationalSecurityAgency/ghidra" description = "Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate." # The Ghidra dragon, the application icon from the project's own source tree. icon = "https://raw.githubusercontent.com/NationalSecurityAgency/ghidra/master/Ghidra/Framework/Gui/src/main/resources/images/GhidraIcon256.png" # GhidraDocs/GettingStarted.md names the launchers: ghidraRun (the GUI), # analyzeHeadless (the headless analyzer) and pyghidraRun. executables = ["ghidraRun", "analyzeHeadless", "pyghidraRun"] [dotfiles] # Ghidra/Framework/Utility/src/main/java/utility/application/ # ApplicationUtilities.java, getDefaultUserSettingsDir(): after # $XDG_CONFIG_HOME, the per-OS branch is # WINDOWS -> %APPDATA%// # LINUX -> $HOME/.config// # MAC_OS_X -> $HOME/Library// # macOS is ~/Library directly, not ~/Library/Application Support, so this is # not [appData]; and it is not [configHome] either, whose macOS half is # ~/.config. Each spelling is written out. # # getLegacyUserSettingsDir() in the same file is the pre-11.1 layout, one # hidden directory used on every platform: ~/.ghidra/.ghidra__PUBLIC. # The move is recorded in ChangeHistory.md under "Ghidra 11.1 Change History # (June 2024)": "Ghidra now supports the XDG Base Directory Specification. # Default locations of the user settings, cache, and temporary directories have # moved" (GP-1164). Both layouts are listed; a consumer skips the absent one. # # is ApplicationIdentifier.toString(), applicationName + "_" + # version + "_" + releaseName — ghidra_11.4_PUBLIC — hence the glob, which also # covers the "_location_" suffix a development build appends. paths = [ "~/.config/ghidra/ghidra_*_PUBLIC/", "~/Library/ghidra/ghidra_*_PUBLIC/", "%APPDATA%/ghidra/ghidra_*_PUBLIC/", "~/.ghidra/.ghidra_*_PUBLIC/", ] # Carved out of every spelling of the settings directory, because a rule that # names one and not its siblings does not run on the other platforms. # # application.log and script.log are written by Application.java; symbols/ is # the downloaded PDB store LibraryLookupTable fills in and can grow without # bound. What stays is the part a user built: `preferences`, the tool chest in # tools/ (ProjectManager.APPLICATION_TOOLS_DIR_NAME), themes/ # (ThemeManager.THEME_DIR), FrontEndTool.xml and the extensions installed from # the GUI — GettingStarted.md: "Extensions installed from the Ghidra front-end # GUI get installed at /Extensions". # # Ghidra's real cache is outside $HOME entirely on Unix (/var/tmp/-ghidra), # so it needs no carve-out here. exclude = [ "~/.config/ghidra/ghidra_*_PUBLIC/application.log", "~/Library/ghidra/ghidra_*_PUBLIC/application.log", "%APPDATA%/ghidra/ghidra_*_PUBLIC/application.log", "~/.ghidra/.ghidra_*_PUBLIC/application.log", "~/.config/ghidra/ghidra_*_PUBLIC/script.log", "~/Library/ghidra/ghidra_*_PUBLIC/script.log", "%APPDATA%/ghidra/ghidra_*_PUBLIC/script.log", "~/.ghidra/.ghidra_*_PUBLIC/script.log", "~/.config/ghidra/ghidra_*_PUBLIC/symbols/", "~/Library/ghidra/ghidra_*_PUBLIC/symbols/", "%APPDATA%/ghidra/ghidra_*_PUBLIC/symbols/", "~/.ghidra/.ghidra_*_PUBLIC/symbols/", ] # Nothing in the settings directory is a credential. serverAllowList.json names # Ghidra Server URLs the user has agreed to connect to, not how to log in to # them; the server password is prompted for. secret = [] # No machine_lines. `preferences` is a Java properties file and the tools are # XML, neither of which `format` can parse (toml, yaml, json only). The # machine-local values a consumer able to read them should drop are the # last-opened project paths and window geometry in FrontEndTool.xml.