Ghidra reverse engineering

When it applies

You need decompiler-grade analysis of an in-scope binary (scope.txt / client-owned / your own sample — tradecraft-scope-roe) and there's no IDA license, or you need to process many samples in batch or CI. Also the right call when a conclusion from reverse-eng-ida or reverse-eng-radare2 deserves an independent cross-check with a different decompiler.

Why it works

Ghidra's P-code lifter gives one decompiler across dozens of architectures (x86/ARM/MIPS/PPC and obscure firmware targets IDA may not load well), and headless mode turns the whole import → analyze → decompile pipeline into a scriptable batch step — so bulk triage costs the same as single-file analysis.