# Ghidra: decompile a binary without a GUI



Decompile a binary without a GUI.



## 1. Run the example



[Download the Ghidra example](https://www.security.run/docs/examples/ghidra.zip). Extract it, install `httpx`, set your API URL and token, then run `python client.py`. The client uploads the included inputs, submits the command, and saves the result under `results/RUN_ID`.



## 2. Check the result



Read decompiled.jsonl for C output generated by the supplied Ghidra script.



Read the native exit code and cleanup status printed by the client. [Read results and save reports](https://www.security.run/docs/visibility.html) explains the returned files.



## 3. Use your own inputs



Edit `example.json` to change the command arguments, requested outputs or deadline. Replace the files under `inputs/` with your own data, keeping the staged paths aligned with the command. The client creates the artifact IDs for you; illustrative IDs shown here must not be copied into a live request.



### Files used by this example



- `sample.exe`

- `scripts/NativeDecompile.java`



The example uses supplied files or the disposable execution environment. Nothing from the environment carries into a later run unless you request and reuse its output.



Qualified version: `12.2`. Commands: `analyzeHeadless`, `python`, `pyghidra`, `sleigh`, `bsim`.



- Headless Java/Python APIs with compiled Linux ARM64 natives. The default Java heap is 512 MiB within the 1 GiB executor; large projects may exceed this resource class.



Inspect `GET /v1/tools/ghidra` for the current installed version and readiness. The published snapshot has 1 functional case(s), plus timeout and cancellation checks. These examples demonstrate the native path; other flags and inputs are supported within the tool’s runtime limits.

## Command submitted by the example

```json
{
  "tool": "ghidra",
  "timeout_seconds": 90,
  "invocation": {
    "args": [
      "projects",
      "fixture",
      "-import",
      "sample.exe",
      "-overwrite",
      "-scriptPath",
      "/tmp/work/scripts",
      "-postScript",
      "NativeDecompile.java",
      "/tmp/work/decompiled.jsonl",
      "-deleteProject",
      "-max-cpu",
      "1",
      "-analysisTimeoutPerFile",
      "40"
    ],
    "outputs": [
      "decompiled.jsonl"
    ],
    "success_exit_codes": [
      0
    ],
    "directories": [
      "projects"
    ],
    "executable": "analyzeHeadless",
    "files": [
      {
        "path": "sample.exe",
        "artifact_id": "artifact_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "executable": false
      },
      {
        "path": "scripts/NativeDecompile.java",
        "artifact_id": "artifact_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "executable": false
      }
    ]
  }
}
```