The Ghidra Book, 2nd Edition The Definitive Guide (Kara Nance, Chris Eagle) (z-library.sk, 1lib.sk, z-lib.sk)
,
Cybersecurity
A guide to using the Ghidra software reverse engineering tool suite. --- DANCE WITH THE DRAGON --- The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency’s most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world’s most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere—and The Ghidra Book, 2nd edition, is the one and only guide you need to master it. --- In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra’s components, features, and unique capacity for group collaboration. --- You’ll learn how to: Navigate a disassembly Use Ghidra’s built-in decompiler to expedite analysis Analyze obfuscated binaries Extend Ghidra to recognize new data types Build new Ghidra analyzers and loaders Add support for new processors and instruction sets Script Ghidra tasks to automate workflows Set up and use a collaborative reverse engineering environment --- Designed for beginner and advanced users alike, The Ghidra Book, 2nd edition, will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro. --- New to this edition: This updated edition reflects the continued evolution of the open source project and brings readers up to speed with expanded real-world examples, new tools like PyGhidra and BSim, enhanced debugger capabilities, and seamless IDE integration. Clear, practical examples are woven into every chapter, helping you leverage Ghidra’s growing ecosystem and modern development environments to their fullest potential.
2
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
K A R A N A N C E A N D C H R I S E A G L E T H E G H I D R A B O O K T H E D E F I N I T I V E G U I D E ® 2 N D E D I T I O N
Page
2
(This page has no text content)
Page
3
PRAISE FOR THE GHIDRA BOOK “Chris Eagle and Kara Nance have—once more—delivered a very readable and hands-on book on reverse engineering using a publicly available tool. This second edition . . . will continue to make the black art of reverse engineering more accessible.” — sven dietrich, book review editor, ieee cipher “The Ghidra Book’s second edition is a must read for any (aspiring) reverse engineer to learn more about the analyst’s mindset, as well as Ghidra! ” — Max “Libra” Kersten, Malware Analyst “From an introduction to disassembly and working with the basics of Ghidra to scripting in Ghidra to extend its capabilities, this book covers it all.” — tyler reguly, tripwire book club “Rather than simply being a Ghidra user guide, the authors did an exceptional job of laying out many of the fundamental concepts involved in software reverse engineering.” — craig young, principal security researcher, tripwire “I encourage anyone that has an interest in reverse engineering or who just wants to investigate cool open-sourced tools to give The Ghidra Book a read.” — matthew jerzewski, security researcher, tripwire
Page
4
(This page has no text content)
Page
5
THE GHIDRA BOOK 2nd Edit ion TheDefinitiveGuide by Kara Nance and Chris Eagle ® San Francisco
Page
6
THE GHIDRA BOOK, 2ND EDITION. Copyright © 2026 by Kara Nance and Chris Eagle. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. First printing 30 29 28 27 26 1 2 3 4 5 ISBN-13: 978-1-7185-0468-4 (print) ISBN-13: 978-1-7185-0469-1 (ebook) ™ Published by No Starch Press®, Inc. 245 8th Street, San Francisco, CA 94103 phone: +1.415.863.9900 www.nostarch.com; info@nostarch.com Publisher: William Pollock Managing Editor: Jill Franklin Production Manager: Sabrina Plomitallo-González Production Editor: Miles Bond Developmental Editor: Frances Saux Cover Illustrator: Gina Redman Interior Design: Octopod Studios Technical Reviewer: Brian Hay Copyeditor: George Hale Proofreader: Scout Festa Library of Congress Control Number for the first edition: 2020938508 For customer service inquiries, please contact info@nostarch.com. For information on distribution, bulk sales, corporate sales, or translations: sales@nostarch.com. For permission to translate this work: rights@nostarch.com. To report counterfeit copies or piracy: counterfeit@nostarch.com. The authorized representative in the EU for product safety and compliance is EU Compliance Partner, Pärnu mnt. 139b-14, 11317 Tallinn, Estonia, hello@eucompliancepartner.com, +3375690241. No Starch Press and the No Starch Press iron logo are registered trademarks of No Starch Press, Inc. Other product and company namesmentioned hereinmay be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the authors nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. [E]
Page
7
To Hazel and all young minds passionate about investigating and understanding technology, and the men and women who support and encourage them. Dream big and never stop exploring!
Page
8
(This page has no text content)
Page
9
About the Authors Kara Nance is a private security consultant. She has been a professor of computer science for many years. She serves on the Honeynet Project Board of Directors and has given numerous talks at security conferences around the world. She enjoys building Ghidra extensions and regularly provides Ghidra training. Chris Eagle has been reverse engineering software for 45 years. He is the author of The IDA Pro Book (No Starch Press, 2011) and is a highly sought- after provider of reverse engineering training. He has published numerous reverse engineering tools and given talks at conferences such as Blackhat, DEF CON, and ShmooCon. About the Technical Reviewer Brian Hay is a reverse engineer, professor, and software developer. He has spoken and taught at many conferences and is currently a senior researcher for a boutique security research company. He specializes in designing and developing virtualized environments for training and testing exciting tools like Ghidra.
Page
10
(This page has no text content)
Page
11
BRIEF CONTENTS Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxv PART I: GETTING STARTED Chapter 1: Introduction to Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Chapter 2: Reversing and Disassembly Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Chapter 3: Meet Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 PART II: BASIC GHIDRA USAGE Chapter 4: Beginning Your Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Chapter 5: Exploring Ghidra’s Data Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Chapter 6: Making Sense of a Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Chapter 7: Refining a Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Chapter 8: Working with Data Types and Data Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Chapter 9: Understanding Cross-References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Chapter 10: Using Graph Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 PART III: CUSTOMIZING AND EXTENDING GHIDRA Chapter 11: Using Ghidra Collaboratively . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Chapter 12: Customizing Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Chapter 13: Extending Ghidra’s Worldview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 Chapter 14: Basic Scripting with Ghidra and PyGhidra. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Chapter 15: Integrated Scripting with Eclipse and GhidraDev . . . . . . . . . . . . . . . . . . . . . . . . . . . 337 Chapter 16: Running Ghidra in Headless Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 PART IV: A DEEPER DIVE Chapter 17: Loaders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Chapter 18: Processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
Page
12
Chapter 19: The Decompiler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Chapter 20: Compiler Variations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 PART V: REAL-WORLD APPLICATIONS Chapter 21: Obfuscation and Emulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 Chapter 22: Patching Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515 Chapter 23: BSim and Other Comparison Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539 Appendix: Ghidra for IDA Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 571 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 x Brief Contents
Page
13
CONTENTS IN DETA IL ACKNOWLEDGMENTS xxiii INTRODUCTION xxv Who Should Read This Book? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxv What’s New in This Edition? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvi What’s in This Book? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvi PART I GETTING STARTED 1 INTRODUCTION TO DISASSEMBLY 3 Disassembly Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 The What of Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 The Why of Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Malware Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Vulnerability Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Software Interoperability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Compiler Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Debugging Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 The How of Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 A Basic Disassembly Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Linear Sweep Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Recursive Descent Disassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2 REVERSING AND DISASSEMBLY TOOLS 15 Classification Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 PE-bear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Detect-It-Easy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Summary Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 nm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 ldd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 objdump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Page
14
otool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 dumpbin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 c++filt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Deep Inspection Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Disassemblers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 3 MEET GHIDRA 31 Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Support Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Downloading Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Installing Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Exploring the Directory Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Starting Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 PART II BASIC GHIDRA USAGE 4 BEGINNING YOUR ANALYSIS 41 Launching Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Creating a New Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Loading Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Using the Raw Binary Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Analyzing Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Auto Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Desktop Behavior During Initial Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Saving and Exiting Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Ghidra Desktop Tips and Tricks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5 EXPLORING GHIDRA’S DATA DISPLAYS 57 CodeBrowser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 CodeBrowser Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 The Listing Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Additional Disassembly Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 xii Contents in Detail
Page
15
The Function Graph Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 The Program Trees Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 The Symbol Tree Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 The Data Type Manager Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 The Console Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 The Decompiler Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Other Ghidra Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 The Bytes Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 The Defined Data Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 The Defined Strings Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 The Symbol Table and Symbol References Windows . . . . . . . . . . . . . . . . . . . . . . . . 85 The Memory Map Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 The Function Call Graph Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 The Function Call Trees Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 6 MAKING SENSE OF A DISASSEMBLY 91 Disassembly Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Names and Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Navigation in Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 The Go To Dialog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Navigation History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Stack Frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Function Call Mechanics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Calling Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Application Binary Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Local Variable Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Ghidra’s Stack Frame Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Setting Up the Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Representing Stack Frame Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Searching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Searching Program Text . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Searching Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 7 REFINING A DISASSEMBLY 119 Manipulating Names and Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Renaming Parameters and Local Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Renaming Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Adding a New Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Editing Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Removing a Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Navigating Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Contents in Detail xiii
Page
16
Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 End-of-Line Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Pre and Post Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Plate Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Repeatable Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Parameter and Local Variable Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Annotations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Basic Code Transformations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Changing Code Display Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Formatting Instruction Operands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Manipulating Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Converting Data to Code (and Vice Versa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Basic Data Transformations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Specifying Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Working with Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Defining Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 8 WORKING WITH DATA TYPES AND DATA STRUCTURES 147 Making Sense of Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Recognizing Data Structure Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Array Member Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Structure Member Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Creating Structures with Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Creating a New Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Editing Structure Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Applying Structure Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 C++ Reversing Primer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 The this Pointer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Virtual Functions and Vftables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 The Object Life Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Name Mangling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Runtime Type Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Inheritance Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 9 UNDERSTANDING CROSS-REFERENCES 185 Referencing Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Cross-References (Back References) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 References in Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Reference Management Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 XRefs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 References To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 xiv Contents in Detail
Page
17
Symbol References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 Advanced Reference Manipulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 10 USING GRAPH VIEWS 199 Basic Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 Function Graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 Using Graph Toolbars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Splitting Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 Interacting with Function Graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 Function Call Graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 The Graph Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Graph Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 The Graph Menu in Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 PART III CUSTOMIZING AND EXTENDING GHIDRA 11 USING GHIDRA COLLABORATIVELY 221 Starting Ghidra Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Server Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 Creating a Shared Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Project Window Menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Edit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Project Repositories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 Version Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 An Example Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 12 CUSTOMIZING GHIDRA 245 Customizing the CodeBrowser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Rearranging Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Editing Tool Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Editing the Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Accessing Special Tool Editing Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Saving the CodeBrowser Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 Contents in Detail xv
Page
18
Customizing the Project Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 Creating New Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Example 1: Building a Debugger Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Example 2: Performing Dynamic Analysis with the Debugger Tool . . . . . . . . . . . 265 Saving Workspaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 13 EXTENDING GHIDRA’S WORLDVIEW 279 Importing Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Analyzers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Word Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284 Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 Loading Additional Data Type Archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 Creating New Data Type Archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Function IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 The Function ID Plugin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 Example: Identifying UPX Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Example: Profiling a Static Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 14 BASIC SCRIPTING WITH GHIDRA AND PYGHIDRA 303 The Script Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 The Script Manager Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 The Script Manager Toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Script Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Scripting in Java . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Editing a Script: Regex Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 Scripting in Python . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 Scripting with PyGhidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 Example: Using PyGhidra to Add Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 An Introduction to the Ghidra API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 The Address Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 The Symbol Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 The Reference Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 The GhidraScript Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 The Program Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 The Function Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328 The Instruction Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 xvi Contents in Detail
Page
19
Ghidra Scripting Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 Example 1: Enumerating Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 Example 2: Enumerating Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 Example 3: Enumerating Cross-References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 Example 4: Finding Function Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 Example 5: Emulating Assembly Language Behavior . . . . . . . . . . . . . . . . . . . . . . . . 333 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 15 INTEGRATED SCRIPTING WITH ECLIPSE AND GHIDRADEV 337 Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 Integrating Ghidra and Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 Starting Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 Editing Scripts with Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340 The GhidraDev Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340 The GhidraDev New Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 The Package Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 Example: Building a Ghidra Analyzer Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352 Step 1: Defining the Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Step 2: Creating the Eclipse Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Step 3: Building the Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Step 4: Testing the Analyzer in Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 Step 5: Adding the Analyzer to Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 Step 6: Testing the Analyzer in Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 16 RUNNING GHIDRA IN HEADLESS MODE 365 Getting Started with the Headless Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 Step 1: Launching Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 Steps 2, 3, and 4: Creating a New Ghidra Project and Importing a File . . . . . . 367 Steps 5 and 6: Auto Analyzing the File, Saving, and Exiting . . . . . . . . . . . . . . . . 368 Options and Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 General Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 Server Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376 Script Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 Writing Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Example 1: Headless ROP Gadget Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Example 2: Automated Function ID Database Creation . . . . . . . . . . . . . . . . . . . . . 383 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 Contents in Detail xvii
Page
20
PART IV A DEEPER DIVE 17 LOADERS 387 Unknown File Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 Using the Data Type Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389 Creating Segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 Finalizing the Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396 Identifying Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 Example 1: Simple Shellcode Loader Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 Step 0: Taking a Step Back . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401 Step 1: Defining the Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 Step 2: Creating the Eclipse Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 Step 3: Building the Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 Step 4: Adding the Loader to Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Step 5: Testing the Loader in Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Example 2: Simple Shellcode Source Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412 Step 1: Modifying the Response to the Importer Poll . . . . . . . . . . . . . . . . . . . . . . . . 413 Step 2: Finding the Shellcode in the Source Code . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Step 3: Converting Shellcode to Byte Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 Step 4: Loading the Converted Byte Array . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 Steps 5: Testing the Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 Example 3: Simple ELF Shellcode Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 Step 1: Performing Housekeeping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 Step 2: Researching the ELF Header Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 Step 3: Finding Supported Load Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 Step 4: Loading File Content into Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420 Step 5: Formatting Data Bytes and Adding an Entry Point . . . . . . . . . . . . . . . . . . . 421 Step 6: Understanding Language Definition Files . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Step 7: Creating the Opinion Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423 Step 8: Observing the Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 18 PROCESSORS 427 Understanding Ghidra Processor Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 Eclipse Processor Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 The SLEIGH Language . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430 Processor Manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431 Modifying Processor Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 Example 1: Adding an Instruction to a Processor Module . . . . . . . . . . . . . . . . . . . 435 xviii Contents in Detail
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A hands-on field manual for learning software reverse engineering with Ghidra, from first disassembly to custom loaders, scripting, and collaborative malware analysis. Best suited to security analysts, malware researchers, and curious programmers who want both the analyst's mindset and practical tool mastery.
【Book Arc】
- **Opening (~0%–15%)**: Frames why reverse engineering matters (malware analysis, vulnerability research, interoperability, compiler validation) and explains disassembly theory, including linear sweep versus recursive descent, before introducing Ghidra's licensing, installation, and directory layout.
- **Early (~15%–30%)**: Moves from general RE tooling—file classifiers, symbol/summary utilities, strings, and disassemblers—into Ghidra itself: creating projects, loading files (including raw binaries), running auto-analysis, and getting comfortable with the desktop.
- **Middle (~30%–55%)**: Teaches reading and refining a disassembly: navigation, names and labels, stack frames, calling conventions, ABIs, cross-references, graph views, data types and structures, comments, and code transformations.
- **Late (~55%–80%)**: Shifts to customization and extension: collaborative Ghidra use, UI customization, extending Ghidra's worldview, basic scripting with Ghidra and PyGhidra, Eclipse/GhidraDev integration, and headless operation.
- **Ending (~80%–100%)**: A deeper dive into loaders, processors, the decompiler, and compiler variations, followed by real-world applications—obfuscation and emulation, binary patching, BSim and comparison tools—plus an appendix for IDA users.
【Book Arc】
- **Opening (~0%–15%)**: Establishes the conceptual foundation—what disassembly is, why analysts do it, and how disassemblers work—then gets Ghidra installed and running.
- **Early (~15%–30%)**: Builds tool fluency: classifying and inspecting binaries with standard utilities, then loading and auto-analyzing files in Ghidra.
- **Middle (~30%–55%)**: Develops the core analyst skill of making sense of a disassembly through navigation, stack-frame understanding, cross-references, data typing, and annotation.
- **Late (~55%–80%)**: Turns Ghidra from a viewer into a platform through collaboration, customization, scripting, IDE integration, and headless automation.
- **Ending (~80%–100%)**: Covers advanced internals (loaders, processors, decompiler, compiler variations) and applies everything to obfuscation, patching, and binary comparison.
【Key Takeaways】
- **Reverse engineering is a mindset, not just a tool skill** (Opening): The book grounds Ghidra use in disassembly theory and real motivations like malware and vulnerability analysis, so readers understand what they are looking at rather than only which buttons to press.
- **Disassembly strategy matters** (Opening): Linear sweep and recursive descent approaches have different trade-offs; knowing them helps explain why Ghidra's output looks the way it does and when manual correction is needed.
- **Ghidra's workflow starts with project and loader choices** (Early): Creating projects, loading files, and running auto-analysis—including the raw binary loader—are the gateways to productive analysis.
- **Reading a disassembly requires stack and calling-convention literacy** (Middle): Stack frames, calling conventions, ABIs, and local variable layout are treated as essential knowledge for interpreting function behavior correctly.
- **Annotation is analysis** (Middle): Renaming labels and variables, adding comments, converting data to code, and applying data types are presented as core techniques for refining understanding, not cosmetic extras.
- **Ghidra is extensible by design** (Late): Customizing the UI, extending its worldview, and writing scripts with Ghidra and PyGhidra let analysts automate repetitive work and adapt the tool to new targets.
- **Collaboration and automation are first-class features** (Late): Shared reverse-engineering environments, Eclipse/GhidraDev integration, and headless mode support team workflows and batch processing.
- **Advanced targets demand deeper Ghidra knowledge** (Ending): Loaders, processors, the decompiler, and compiler variations are covered for analysts facing unusual binaries, while obfuscation, patching, and BSim comparison tools address real-world scenarios.
【Reading Tips】
- **Deep-read Parts I–II if you are new to RE**: The disassembly theory and basic Ghidra usage chapters build the foundation everything else depends on; skipping them makes later chapters harder.
- **Skim the tool survey if you already know standard RE utilities**: The classification and summary tool chapters are useful reference but can be revisited as needed.
- **Treat scripting and extension chapters as hands-on labs**: PyGhidra, GhidraDev, headless mode, loaders, and processors are best learned by building something small rather than reading passively.
- **Use the IDA appendix as a bridge**: If you come from IDA Pro, start there to map familiar concepts onto Ghidra terminology.
- **Keep the book nearby during real analysis**: The middle chapters on navigation, cross-references, and data types work well as a checklist when you are stuck in a disassembly.
【Coverage Limits】
This guide is based on stratified excerpts that include the front matter, table of contents, and chapter structure, but not the full chapter text; specific examples, code listings, and detailed walkthroughs are therefore not summarized here.
Passage locations
Excerpt 1
odern development environments to their fullest potential. K A R A N A N C E A N D C H R I S E A G L E T H E G H I D R A B O O K T H E D E F I N I T I V E G...
View in text
Page 11
Ghidra’s Data Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Chapter 6: Making Sense of a Disassembly . . ....
View in text
Page 14
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Downloading Ghidra . . . . . . . . . . . . . . . . . . . . . . . . . . ....
View in text
Page 11
. . . 101 Local Variable Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Ghidra’s Stack Fr...
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay