gmh5225/enigma-C++ reimplementation of Ghidra's analytical core without JVM dependencies, providing embeddable binary analysis, Pcode/Sleigh foundations, and AI-ready interfaces for reverse engineering.
C++ reimplementation of Ghidra's analytical core (SoftwareModeling + Utility), stripped of Java/JVM dependencies. Built for AI integration, performance, and embeddability. Part of the Enigma Engine project.
A C++ reimplementation of Ghidra's analytical core — no JVM, no Java, full control.
Ghidra is a powerful reverse engineering framework built by the NSA in Java. Enigma is a ground-up rewrite of its analytical core in modern C++, designed to be:
This is not a Java-to-C++ transpiler output. Every file is manually translated and verified, with full test coverage.
Ghidra's Java codebase is mature but difficult to extend in certain directions:
| Problem | Enigma's answer |
|---|
| JVM startup + GC overhead | Native C++, zero runtime |
| Hard to embed in non-Java projects | Static/shared library |
| AI integration requires JNI bridges | Direct C++ API |
| Monolithic plugin system | Modular, replaceable components |
Active development — analytical foundation is stable and tested.
The core type system, address model, memory interfaces, settings framework, and Pcode/Sleigh foundations are implemented and passing tests. The project follows a strict bottom-up translation order: no module is added until all its dependencies are in place and verified.
Build system: CMake + Ninja + CTest — zero warnings, all tests pass.
Enigma mirrors Ghidra's internal package structure, translated into C++ namespaces:
include/ghidra/
├── [Address system] Address, AddressSpace, AddressFactory, AddressRange
├── [Data types] DataType, Structure, Union, Enum, Pointer,
│ Array, TypeDef, FunctionDefinition, ...
├── [Memory] MemBuffer, MemoryBlock, Memory, ByteProvider
├── [Settings] Settings + full SettingsDefinition hierarchy
├── [Pcode / Sleigh] PcodeOp, Varnode, SleighLanguage, SequenceNumber
└── [Utilities] MathUtilities, DataConverter, Msg, TaskMonitor, ...
src/
└── [.cpp implementations for complex classes]
Key design decisions:
interface → C++ abstract class with pure virtual methodsArrayList / HashMap → std::vector / std::unordered_mapnull returns → std::optional<T>Address merged from interface + impl into a single value type (avoids heap allocation)Enigma is a complete replacement for Ghidra — every component that exists in Java will have a C++ equivalent, including the UI, plugin system, disassembler, decompiler, and scripting engine.
Current focus is the analytical core — the foundation everything else builds on. Once it is solid and tested, the remaining layers (GUI, loaders, analysis plugins, scripting) will follow in order.
Nothing is permanently excluded. Everything is a matter of priority.
git clone https://github.com/adam-040/Enigma.git
cd Enigma
cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
cmake --build build
ctest --test-dir build --output-on-failure
.sla / .pspec loading)Enigma — named after the WWII cipher machine, broken through reverse engineering. It felt right.
This project is a translation of Ghidra, which is licensed under the Apache License 2.0.
Enigma is distributed under the same license. See LICENSE for details.