Skip to main content

​
Decompiler Overview

The Ghidra decompiler translates assembly code into high-level C-like pseudocode for easier analysis.
Implemented by the DecompilePlugin, the decompiler provides a high-level interpretation of assembly functions with interactive editing capabilities.

​
Opening the Decompiler

1

Enable Decompiler Window

Access the decompiler view:
  • Window > Decompiler
  • Default: docked on right side
  • Can float or dock to any location
2

Navigate to Function

The decompiler automatically displays:
  • Current function at cursor location
  • Updates when you navigate in listing
  • Synchronized with Code Browser
3

Wait for Decompilation

Decompilation is performed on-demand:
  • Brief delay for complex functions
  • Progress indicator shown
  • Results cached for performance

​
Decompiler Interface

​
Main Components

Primary decompiled code display:
  • C-like pseudocode representation
  • Syntax highlighting
  • Line numbers
  • Collapsible code blocks
  • Token-based navigation

​
Synchronization with Listing

1

Bidirectional Sync

Decompiler and listing stay synchronized:
  • Click in decompiler → highlights assembly
  • Click in assembly → highlights decompiled code
  • Both views track same location
2

Token Highlighting

Clicking tokens highlights:
  • All uses of the variable/function
  • Related assembly instructions
  • Data flow dependencies
3

Cross-Reference Navigation

Follow references from decompiler:
  • Enter on function calls
  • Enter on global variables
  • Navigation history maintained

​
Editing in the Decompiler

​
Renaming Variables

1

Select Variable

Click on variable name in decompiled code
2

Rename Action

  • Press L for rename
  • Right-click > Rename Variable
  • Enter new meaningful name
3

Apply Changes

New name appears:
  • Throughout decompiled function
  • In assembly as comments
  • In function signature if parameter

​
Retyping Variables

1

Select Variable

Click on variable to retype
2

Change Type

  • Press Ctrl + L for retype
  • Right-click > Retype Variable
  • Choose from Data Type Manager
3

Propagation

Type changes affect:
  • Variable declaration
  • Cast expressions
  • Decompiler output clarity
  • Structure member access

​
Function Signature Editing

1

Edit Signature

Modify function signature:
  • Right-click function name > Edit Function Signature
  • Or press Ctrl + Shift + G in listing
2

Modify Components

Change signature elements:
  • Return type
  • Parameter types and names
  • Calling convention
  • Varargs specification
3

Commit Changes

Changes trigger:
  • Automatic re-decompilation
  • Updated call sites
  • Improved type propagation
Use the ApplyFunctionSignatureCmd programmatically to set function signatures from scripts.

​
Decompiler Features

​
Hover Tooltips

Multiple hover services provide information:
Implemented by DataTypeDecompilerHoverPlugin:
  • Shows full type definition
  • Structure layouts
  • Typedef resolution

​
Control Flow Visualization

The decompiler shows control structures:
  • If/Else: Conditional logic
  • Loops: While, for, do-while patterns
  • Switch: Case statement detection
  • Goto: Remaining unconditional jumps
The decompiler attempts to structure all assembly into high-level constructs, but complex or obfuscated code may still contain goto statements.

​
Decompiler Options

​
Configuration Settings

1

Access Options

Open decompiler options:
  • Edit > Tool Options > Decompiler
  • Configure analysis and display
2

Analysis Options

Control decompilation behavior:
  • Maximum instruction count
  • Maximum payload bytes
  • Simplification style
  • Eliminate unreachable code
3

Display Options

Customize appearance:
  • Color scheme
  • Font settings
  • Line spacing
  • Brace style (Allman, K&R, etc.)

​
Language-Specific Settings

Decompiler uses processor specifications:
  • Calling conventions
  • Register usage
  • Stack frame layout
  • Special instructions
For best results, ensure the correct processor specification and compiler specification are selected for your binary.

​
Working with Complex Code

​
Structures and Arrays

1

Structure Access

Decompiler shows structure members:
  • struct->member notation
  • Offset calculations converted to members
  • Nested structure access
2

Array Indexing

Arrays displayed with brackets:
  • array[index] notation
  • Multi-dimensional arrays
  • Pointer arithmetic simplified
3

Type Propagation

Defining types improves output:
  • Set parameter types
  • Define global data types
  • Create custom structures
  • Decompiler propagates through code

​
Pointer Analysis

Decompiler handles pointers:
  • Dereference operators (*ptr)
  • Address-of operators (&var)
  • Pointer arithmetic
  • Multi-level indirection

​
Function Pointers

Indirect calls are shown as:
  • Function pointer variables
  • Casts to function types
  • Indirect call notation
  • Virtual function tables

​
Advanced Usage

​
Creating Disconnected Decompilers

1

Open Secondary Decompiler

Create additional decompiler views:
  • Window > Decompiler (creates new instance)
  • Independent navigation
  • Compare different functions
2

Compare Views

Use multiple decompilers to:
  • Compare similar functions
  • Track related code paths
  • Analyze caller and callee together

​
Debugging Decompiler Output

If decompilation quality is poor:
1

Check Function Boundaries

Ensure function is properly defined:
  • Correct entry point
  • All code included
  • Return statements identified
2

Fix Data Flow

Improve analysis:
  • Define parameter types
  • Set return type
  • Mark no-return functions
  • Fix incorrect references
3

Adjust Settings

Try different options:
  • Increase instruction limit
  • Disable certain optimizations
  • Change simplification level

​
Exporting Decompiled Code

1

Copy to Clipboard

Copy decompiled code:
  • Select code in decompiler
  • Ctrl + C to copy
  • Paste into external editor
2

Export Function

Export single function:
  • Right-click > Export to C
  • Choose file location
  • Includes function signature and body
3

Bulk Export

Export multiple functions:
  • Use Exporter from File menu
  • Select C/C++ format
  • Exports all or selected functions
For the best decompilation results, run full auto-analysis, define function signatures from library information, and create accurate structure definitions.

Build docs developers (and LLMs) love

Get started for freeTalk to us