Analysing binary software has usually been done by disassembling, deciding which bytes are code or not, telling the disassembler what is code, ascii, pointers, tables, and then repeating iteratively. It is painstaking work.

The American National Security Agency needed to do this to examine code for malware, and they developed the Ghidra program to make this easier to do. Load the binary, have an initial disassembly, and then you can go through it marking sections to be disassembled as code, or various types of data.

Installation

To install Ghidra, you must install the required Java Development Kit (JDK), download the official zip file, and extract it to your system. Ghidra does not use a traditional executable installer; the extracted directory contains the entire application.

1. Install the Prerequisites

   Ghidra relies heavily on Java. The latest versions of Ghidra officially require JDK 21 (64-bit).

   Windows: Download and run the JDK 21 installer from Adoptium Temurin or Oracle.

   Linux (Debian/Ubuntu/Kali): Open your terminal and run:

   sudo apt update && sudo apt install openjdk-21-jdk

   macOS: Install via Homebrew using brew install openjdk@21 or download the installer package from Adoptium.

2. Download Ghidra

   Navigate to the official Ghidra GitHub Releases page.

   Under the Assets drop-down of the latest public release, click the zip file to download it (e.g., ghidra_11.x.x_PUBLIC_xxxxxxxx.zip).

   Note: Do not download the "Source code" files, as they require manually building the software.

3. Extract the Files

   Choose a permanent folder location on your machine where you want Ghidra to live.

   Windows: Right-click the downloaded .zip file and select Extract All.

   Move the folder somewhere stable, like C:\Tools\Ghidra.

   Linux / macOS: Extract it to your preferred directory (such as /opt/ or your home directory) using the terminal:

   sudo unzip ghidra_11.x.x_PUBLIC_xxxxxxxx.zip -d /opt/

4. Launch Ghidra

   Open the extracted folder to run the application:

   Windows: Double-click ghidraRun.bat.

   Linux / macOS: Open a terminal in that directory and execute ./ghidraRun.

Adding Z8000

To add support for the Zilog Z8000 processor to Ghidra, you must manually install a third-party processor module, as Ghidra only supports the standard 8-bit Z80 out of the box.Because the Z8000 is an entirely different 16-bit architecture rather than a simple extension, you need a dedicated module containing the necessary .sla, .pspec, and .cspec definition files.

Step 1: Obtain a Z8000 Processor Module

You will need to download a SLEIGH-based language module for the Z8000.

• Community extensions (such as those shared on developer repositories like GitHub) typically bundle these files.
• Make sure your downloaded module matches your architecture needs, whether you are analyzing the non-segmented Z8002 or the segmented Z8001 variant.

https://github.com/jpelletier/Z8000/tree/main

Step 2: Install via the Ghidra GUI

The easiest way to add an extension module is through the application interface:

1. Launch Ghidra and stay on the main active project window.
2. Click on File in the top menu bar, then select Install Extensions.
3. Click the + (Add extension) icon in the upper-right corner of the Extensions window.
4. Browse to and select the downloaded .zip file containing the Z8000 processor module.
5. Click Apply or OK.
6. Restart Ghidra to allow the software to compile the new SLEIGH language files.

Step 3: Alternative Manual Installation

NB Linux did not let me do this, because I did not have the required permissions. This is correct behaviour. Windows may let you do this.

If you downloaded raw language definition files instead of a zipped extension, you can place them directly into Ghidra's directory structure:

1. Close Ghidra completely.
2. Navigate to your Ghidra installation directory.
3. Go to the processors folder: Ghidra/Processors/
4. Create a new folder named exactly Z8000.
5. Inside that folder, recreate the data subfolder path:
   Z8000/data/languages/
6. Move all your Z8000 definition files
   (e.g. z8000.slaspec, z8000.ldefs, z8000.cspec, z8000.pspec<br>)
   into that final languages folder.
7. Relaunch Ghidra.

Step 4: Verify and Use

1. Open a project and click File -> Import File to load your Z8000 binary.
2. In the Language selection dialogue box, filter or scroll down to look for Zilog.
3. You should now see Z8000 listed alongside the default Z80. Select it, choose your compiler variant, and proceed with the import.

Well, the zip file seemed simpler, so I tried it. The file selection browser would not show any zip files. It hides any that do not have this exact format:

textmy-z8000-extension.zip
└── Z8000Processor/
    ├── extension.properties   <-- MANDATORY METADATA FILE
    ├── Module.manifest
    └── data/
        └── languages/
            ├── z8000.slaspec
            ├── z8000.ldefs
            └── ...

Note: If the ghidraVersion listed in that file does not exactly match your active Ghidra version, the GUI installer will often throw an error or hide the extension.

 The extension properties file was missing. So I created one, and created a zip file with the exact directory structure.

Ghidra installed this, and after restarting it managed to disassemble some code.