HackBlue

Tools · Workbench

Ghidra

Lessons on reading a program you are allowed to study, and on writing down what it does and what should change.

  • 22 lessons
  • 6 h of reading
Start with lesson 1All workbenches

Ghidra is a free reverse-engineering workbench. It loads a binary, names functions, and shows a decompiler beside the disassembly. The lessons linked below are about using that view to explain what the program does.

A disassembly is a reading of a program. The write-up needs an impact and a fix. Study programs you have the right to examine, on a machine you can revert.

Lessons

22 lessons

  1. 01Ghidra: install the tool and open a projectGhidra is a reverse-engineering workbench. A project is the folder that will hold every program you import and every name you later assign. This lesson gets a local project open before any binary is involved.15 min
  2. 02Ghidra: import a binary you are allowed to readImport copies a file you may study into the project and records how Ghidra intends to decode it. The language and the compiler spec you accept here decide whether the next screen is instructions or noise.16 min
  3. 03Ghidra: memory blocks, image base, and the entry pointThe memory map is Ghidra’s picture of the file after the loader laid it out. Blocks, permissions, and the entry point are the facts every later address has to sit on.15 min
  4. 04Ghidra: what auto-analysis is claimingAuto-analysis is a queue of analyzers that propose functions, strings, references, and signatures. Each proposal is a hypothesis you can check against the bytes. The listing is still yours to correct.16 min
  5. 05Ghidra: the Listing and the DecompilerThe Listing is the addresses, the bytes, and the instructions. The Decompiler is a C-like reading of those instructions. They describe one database, and they are allowed to disagree. When they do, the bytes win.17 min
  6. 06Ghidra: navigation that keeps your placeReading a program is a series of jumps: to an address, to a name, back to where you were. Ghidra’s history, Go To, and the trees are how you move without losing the question you came in with.14 min
  7. 07Ghidra: functions as the unit of readingA function in Ghidra is an object: an entry address, a body, a signature, a calling convention, and a stack frame. You read programs one of those objects at a time. Creating or clearing one is an edit to the database.16 min
  8. 08Ghidra: cross-referencesA cross-reference is an edge the reference analyzer could prove: this instruction calls that function, or this instruction reads that address. The edges are how you move from a string to its user, and from a function to its callers.16 min
  9. 09Ghidra: names and comments that record a decisionA placeholder name means you have not decided yet. A name you assign, and a comment you attach, are decisions stored in the program database. They should say what you know, at the size you actually know it.16 min
  10. 10Ghidra: data types and why the decompiler changesA type is a promise about how bytes are grouped: a pointer, an integer, a structure, an enum. The decompiler believes the promise immediately and reprints the function. A careful type makes the reprint calmer. A wrong type makes it lie in complete sentences.17 min
  11. 11Ghidra: strings and the bytes they occupyA string is data with an encoding, a length, and an address. The string search window is an index of runs that look like text. A defined string is one the database has committed to. Where it sits, and who references it, is the reading.16 min
  12. 12Ghidra: finding main when the entry point is startupThe entry point of a hosted C program is startup code. main is a function that startup calls. You find it by following that handoff, and you confirm it by the strings and calls that belong to the program you recognize.17 min
  13. 13Ghidra: compiler output and hand-written codeOrdinary compiler output has habits: a consistent calling convention, structured branches, and library calls you can name. Hand-written bytes often lack those habits. Optimization is still the compiler. Density alone is not a verdict.16 min
  14. 14Ghidra: switches and calling conventionsA switch is a selection among cases, compiled either as a chain of compares or as a jump through a table. A calling convention is the agreement about where arguments and the return value sit. Both are concepts you set in the database so the decompiler stops guessing.18 min
  15. 15Ghidra: stack frames and where locals liveThe stack frame is the function’s private storage: locals, saved registers, and any arguments that did not fit in registers. Ghidra’s frame lists each slot’s size and where it lives. Reading that list is how param_ and local_ names become real objects.15 min
  16. 16Ghidra: bookmarksA bookmark is a saved jump: an address, a type, and a short note, listed in one window. Comments explain a line. Bookmarks let you return to the handful of addresses that hold the story together.13 min
  17. 17Ghidra: comparing two program versionsVersion Tracking is the tool that lines up two programs already in your project and proposes which functions are the same. You use it to see what a rebuild or a vendor update changed. Matching functions is a reading aid. It does not patch either file.17 min
  18. 18Ghidra: the Script Manager for navigation and renamingThe Script Manager runs a small program inside the tool, against the program you have open. Used well, a script lists functions, jumps you toward an unnamed one, or applies a name you have already decided. This lesson stays on that side of the line.16 min
  19. 19Ghidra: saving, archives, and a shared projectSave writes the program database. Exporting a Ghidra zip makes a portable copy of that database. A shared project adds checkout and check-in so a team can hand the same database around. None of these steps rewrite the executable you imported.16 min
  20. 20Ghidra: imports, exports, and the Symbol TreeThe Symbol Tree is the index of names: functions you found, data you defined, imports the file expects from other libraries, and exports it offers to other programs. Imports are a capability list. They say what the file is built to ask for, not what it will do on a given run.15 min
  21. 21Ghidra: a triage reading of a lab sampleTriage reading asks what a sample is built to refer to: which hosts appear as strings, and which imports look like network or persistence activity. You are annotating references in a database. You are not running the sample, and you are not reconstructing a working program.18 min
  22. 22Ghidra: read one function from the bytes to a sentenceThis is the whole curriculum in one function. You start from a string, land on the instructions, check the decompiler against them, name only what you can defend, and leave with a sentence a teammate can use.16 min