The Ghidra Book, 2nd Edition The Definitive Guide (Kara Nance, Chris Eagle) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A hands-on field manual for learning software reverse engineering with Ghidra, from first disassembly to custom loaders, scripting, and collaborative malware analysis. Best suited to security analysts, malware researchers, and curious programmers who want both the analyst's mindset and practical tool mastery. 【Book Arc】 - **Opening (~0%–15%)**: Frames why reverse engineering matters (malware analysis, vulnerability research, interoperability, compiler validation) and explains disassembly theory, including linear sweep versus recursive descent, before introducing Ghidra's licensing, installation, and directory layout. - **Early (~15%–30%)**: Moves from general RE tooling—file classifiers, symbol/summary utilities, strings, and disassemblers—into Ghidra itself: creating projects, loading files (including raw binaries), running auto-analysis, and getting comfortable with the desktop. - **Middle (~30%–55%)**: Teaches reading and refining a disassembly: navigation, names and labels, stack frames, calling conventions, ABIs, cross-references, graph views, data types and structures, comments, and code transformations. - **Late (~55%–80%)**: Shifts to customization and extension: collaborative Ghidra use, UI customization, extending Ghidra's worldview, basic scripting with Ghidra and PyGhidra, Eclipse/GhidraDev integration, and headless operation. - **Ending (~80%–100%)**: A deeper dive into loaders, processors, the decompiler, and compiler variations, followed by real-world applications—obfuscation and emulation, binary patching, BSim and comparison tools—plus an appendix for IDA users. 【Book Arc】 - **Opening (~0%–15%)**: Establishes the conceptual foundation—what disassembly is, why analysts do it, and how disassemblers work—then gets Ghidra installed and running. - **Early (~15%–30%)**: Builds tool fluency: classifying and inspecting binaries with standard utilities, then loading and auto-analyzing files in Ghidra. - **Middle (~30%–55%)**: Develops the core analyst skill of making sense of a disassembly through navigation, stack-frame understanding, cross-references, data typing, and annotation. - **Late (~55%–80%)**: Turns Ghidra from a viewer into a platform through collaboration, customization, scripting, IDE integration, and headless automation. - **Ending (~80%–100%)**: Covers advanced internals (loaders, processors, decompiler, compiler variations) and applies everything to obfuscation, patching, and binary comparison. 【Key Takeaways】 - **Reverse engineering is a mindset, not just a tool skill** (Opening): The book grounds Ghidra use in disassembly theory and real motivations like malware and vulnerability analysis, so readers understand what they are looking at rather than only which buttons to press. - **Disassembly strategy matters** (Opening): Linear sweep and recursive descent approaches have different trade-offs; knowing them helps explain why Ghidra's output looks the way it does and when manual correction is needed. - **Ghidra's workflow starts with project and loader choices** (Early): Creating projects, loading files, and running auto-analysis—including the raw binary loader—are the gateways to productive analysis. - **Reading a disassembly requires stack and calling-convention literacy** (Middle): Stack frames, calling conventions, ABIs, and local variable layout are treated as essential knowledge for interpreting function behavior correctly. - **Annotation is analysis** (Middle): Renaming labels and variables, adding comments, converting data to code, and applying data types are presented as core techniques for refining understanding, not cosmetic extras. - **Ghidra is extensible by design** (Late): Customizing the UI, extending its worldview, and writing scripts with Ghidra and PyGhidra let analysts automate repetitive work and adapt the tool to new targets. - **Collaboration and automation are first-class features** (Late): Shared reverse-engineering environments, Eclipse/GhidraDev integration, and headless mode support team workflows and batch processing. - **Advanced targets demand deeper Ghidra knowledge** (Ending): Loaders, processors, the decompiler, and compiler variations are covered for analysts facing unusual binaries, while obfuscation, patching, and BSim comparison tools address real-world scenarios. 【Reading Tips】 - **Deep-read Parts I–II if you are new to RE**: The disassembly theory and basic Ghidra usage chapters build the foundation everything else depends on; skipping them makes later chapters harder. - **Skim the tool survey if you already know standard RE utilities**: The classification and summary tool chapters are useful reference but can be revisited as needed. - **Treat scripting and extension chapters as hands-on labs**: PyGhidra, GhidraDev, headless mode, loaders, and processors are best learned by building something small rather than reading passively. - **Use the IDA appendix as a bridge**: If you come from IDA Pro, start there to map familiar concepts onto Ghidra terminology. - **Keep the book nearby during real analysis**: The middle chapters on navigation, cross-references, and data types work well as a checklist when you are stuck in a disassembly. 【Coverage Limits】 This guide is based on stratified excerpts that include the front matter, table of contents, and chapter structure, but not the full chapter text; specific examples, code listings, and detailed walkthroughs are therefore not summarized here.