The private runtime root of one Ghidra session
One directory named rea-ghidra- plus a random suffix, created by GhidraClient start() and deleted after close_binary. It holds six Ghidra directories, the hashed copy of the target named target-01b5d08b08fb.bin, the session.json descriptor with seven keys, the bridge.sock Unix socket, ownership.json, and the ghidra.log and script.log files.
SESSION ROOT · ONE DIRECTORY PER START()
rea-ghidra-<random>
created by GhidraClient start(), deleted after close_binary
project/ home/ tmp/ cache/ config/ data/
rea-project imported with -readOnly -deleteProject · private HOME, tmpdir, caches
target-01b5d08b08fb.bin
copy of ledger-arm64-O1, hashed while copied · the Ghidra document
session.json
transport, endpoint_path, token, run_id, target_sha256, provider_version, profile_digest
bridge.sock
Unix socket bound by the bridge, mode rw-------, one client accepted
ownership.json
process ownership record for verified cancellation
ghidra.log · script.log
the -log and -scriptlog files of analyzeHeadless