ghidra-headless

analyzeHeadless <project> -import <sample>

Analyze a binary with Ghidra in headless mode (no GUI), importing the sample into a project and generating the decompiled analysis.

Run it when you need automated Ghidra analysis: analyzeHeadless imports the sample into the project and runs the analysis (disassembly, decompilation, references) without opening the GUI — with scripts (-postScript) that extract what you need: the functions, the referenced strings, the pseudocode of the C2 function. It's the automation route: analyzing batches of samples, integrating Ghidra into the lab pipeline, or extracting the decompiled output of a specific sample without an interactive session. In the IR, headless mode is the way to have Ghidra analysis in the automated malware analysis flow.

Don't use it for interactive analysis: the Ghidra GUI (or radare2/rizin in console) is better when the analyst explores the sample step by step. Headless mode requires the project and scripts: without the right postScript, the analysis runs but you don't extract anything useful — the export script (Decompiler, or the community headlessAnalyzer) is part of the flow. And watch out: Ghidra is heavy (Java, memory) and analysis of large samples takes time; headless mode in batches needs to be sized. The decompilation of obfuscated code remains limited: Ghidra's static analysis shares the limitations of static RE.