# Vendored: Ghidra decompiler (SLEIGH + decompiler core)

Upstream: https://github.com/NationalSecurityAgency/ghidra
- Tag: `Ghidra_12.1_build` (Ghidra 12.1, released 2026-05-13)
- Pinned commit: `7e89d94e3478f0b1931c34882a0f606fdb06961f`
- License: Apache-2.0 (see `LICENSE`).

## What is vendored

- `cpp/` — verbatim copy of `Ghidra/Features/Decompiler/src/decompile/cpp/` at the pinned
  commit. We compile the **`libdecomp`** subset (full SSA decompiler): the `CORE`, `DECCORE`,
  and `SLEIGH` object sets from the upstream `Makefile`. Unneeded files in the dir (e.g.
  `bfd_arch.cc`, `analyzesigs.cc`, `ghidra_process.cc`, `consolemain.cc`, `*_test*.cc`,
  `rulecompile.cc`) are left in place but not compiled by fold's build.
- `specs/AARCH64/` — verbatim copy of `Ghidra/Processors/AARCH64/data/languages/` (the
  `.slaspec`/`.sinc`/`.ldefs`/`.pspec`/`.cspec` sources).
- `specs/x86/` — verbatim copy of `Ghidra/Processors/x86/data/languages/` (the `old/`
  legacy subdir is dropped). Provides `x86:LE:64:default` (x86-64) and `x86:LE:32:default`
  (32-bit). Additional arches (ARM, MIPS) are added under `specs/<arch>/` the same way.

## No bison/flex needed

All generated parser/lexer outputs required by the `libdecomp` set are committed upstream and
copied here: `slghparse.cc`/`.hh`, `slghscan.cc`, `xml.cc`, `pcodeparse.cc`, `grammar.cc`.
`ruleparse.cc` is NOT committed, but it is only used by `rulecompile.cc`, which is **not** part
of the decompiler library — so fold's build needs neither bison nor flex.

## .sla policy (checked-in runtime copies + build validation)

Fold keeps checked-in `.sla` files next to each vendored language spec under
`specs/<arch>/`. Runtime lookup intentionally points `FOLD_GHIDRA_SPECS_DIR` at
that source-tree spec directory because the Ghidra loader needs the compiled
`.sla` together with sibling `.ldefs` / `.pspec` / `.cspec` files.

Meson also builds `ghidra_sleigh` and regenerates `.sla` files into the build
tree as a validation target. Those generated build-tree copies prove the pinned
`.slaspec` sources still compile, but they are not the dev-build runtime lookup
location until an install/datadir rule copies the full spec directory. If this
policy changes, update both this file and the `FOLD_GHIDRA_SPECS_DIR` definition
in the top-level `meson.build` in the same commit.

## External docs

- P-Code reference: https://ghidra.re/ghidra_docs/languages/html/pcoderef.html
- SLEIGH language manual: https://ghidra.re/ghidra_docs/languages/html/sleigh.html

## Updating

Re-run a sparse blobless checkout at the new tag, copy `cpp/` and `specs/<arch>/`, update the
pin above, and re-run fold's build. The embedding API surface used by fold is in
`src/binary/ghidra_lifter.cpp` (LoadImage / SleighArchitecture / Funcdata). See
`docs/internal/ghidra-pcode-integration-research.md`.