1. Mental Model & Architectural Core
Ghidra is the NSA's open-source Software Reverse Engineering (SRE) framework. It decompiles x86, x64, ARM, MIPS, and 40+ other architectures to near-source-level C pseudocode, supports collaborative analysis, and includes a powerful scripting engine (Java/Python) for automated analysis of malware and binaries.
If a compiled binary is a shredded document, Ghidra is an expert forensic team that reassembles the pieces, infers the original paragraphs, and translates the whole thing back into readable English (C code). It cannot recover the original variable names, but it shows you exactly what the program does.
- Malware reverse engineering: understand C2 communication, persistence mechanisms, evasion techniques
- CTF binary analysis: find hidden flags, understand custom encryption algorithms
- Vulnerability research: locate memory corruption sinks (strcpy, sprintf with user input)
- Software auditing: analyze closed-source binaries for backdoors or vulnerabilities
- CTF reverse engineering: decompile custom XOR encryption function to extract the key
- Malware analysis: find hardcoded C2 IP addresses and encryption keys in malware samples
- Patch binary vulnerabilities: locate the vulnerable function and understand the input path
Ghidra performs multi-pass static analysis: disassembly, control flow graph construction, data type propagation, and decompilation. The decompiler uses a "lifting" approach converting machine code to an intermediate representation (P-code), then simplifying P-code to C-like pseudocode. This produces readable functions even for highly optimized binaries.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| File → Import File | Import binary for analysis (PE, ELF, Mach-O, raw) |
| Auto Analyze (A) | Run all automatic analysis passes (disassembly, xrefs, function detection) |
| Window → Decompiler | Open the C pseudocode decompiler pane |
| Search → Memory (S) | Search for strings, bytes, or patterns in binary memory map |
| Right-click → References → Find All References | Find all callers and callees of a function |
| Window → Function Graph | View control flow graph (CFG) of selected function |
| Script Manager → ghidra_scripts/ | Run automated analysis scripts in Java or Python |
analyzeHeadless /tmp/ghidra_project MyProject -import /tmp/malware.exe -postScript ExtractStrings.py -scriptPath ~/ghidra_scripts/
Use Ghidra's Symbol Tree to find the "main" function quickly, then follow cross-references to find where user input is processed. Look for calls to dangerous functions: strcpy, sprintf, gets, memcpy these are common vulnerability sinks.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Apply code obfuscation and anti-decompilation techniques in production binaries
- Implement anti-debugging detection to slow down dynamic analysis
- Use control flow flattening to complicate decompilation output