Ghidra: navigation that keeps your place
Reading a program is a series of jumps: to an address, to a name, back to where you were. Ghidra’s history, Go To, and the trees are how you move without losing the question you came in with.
Go To is the whole map in one field
Press G in the Listing. The field accepts a symbol, an address in hex, and a simple expression built from those. Entry, main, a FUN_ name, and a bare address all belong there. If the name exists in this program, you land on it. If it does not, you are spelling a name the database does not have, which is its own piece of information. Labels are case-sensitive in the form the tool stored them.
Double-click does the same job when the address is already on the screen. A cross-reference comment, an operand that names a label, and a call target are all double-clickable. The Symbol Tree has a filter box. Type a few letters of fopen or of a name you assigned and the tree narrows. Program Trees is the coarser map: click .text or .rodata and you are at the start of that block.
History is part of the answer
Every jump the tool considers navigation is recorded. The back and forward arrows in the CodeBrowser toolbar walk that list. Use them. A reading session that only moves forward ends with a cursor in a thunk and no memory of which call got you there. The history is per tool session. It is not saved as part of the program. Bookmarks, in a later lesson, are the durable version of “I need to come back here.”
Keep the question written down beside the keyboard. “Who references the default path?” is a question you can finish. “Understand the binary” is a mood. When you follow a call, you are choosing to hold that question and answer a smaller one first. Back returns you to the larger one. This is the whole discipline of navigation.
Search is navigation with a clue
Search > For Strings opens an index of text runs, with the address and an indication of whether anything refers to each hit. Double-click a row to move the Listing. Search > Memory asks for a byte pattern or a value. Use it when you already know a constant from the source or from a previous function, such as the immediate 0x40 that the lab passes as the host buffer length. A memory search for an immediate finds the instruction that embeds it. It is a way to move. It is not a reason to collect every constant in the file.
The instruction search and the text search under the Search menu are the same idea pointed at mnemonics. Early on you will not need them. Go To, double-click, the two trees, string search, and the back arrow are enough to cross harbor-check without getting lost.
Lab: five jumps, then back
Start at entry. From there, reach the check.conf string in five jumps or fewer. Write each jump down as a pair: what you clicked or typed, and where you landed. A plausible trail is entry, the call it makes into the C runtime, the function that call’s argument points at, the load of the string address, and the string itself. Your binary’s startup may be shorter or longer. The notebook trail is the result, and the exact count can be under five.
Then walk the back arrow until the cursor is on entry again. If you cannot retrace the trail, the history was not what you thought and the written list is the artifact that saved you. Keep that list. The next lessons start from the string and walk the other direction, toward callers.
Diagram
A jump you can retrace
- Question
You start with a concrete target: the entry symbol, a string, or a function you already named.
- Go To
The G key asks for an address or a name. Enter accepts it and the Listing moves.
- Follow
Double-click a reference, a call, or a tree node. Each jump is pushed on the navigation history.
- Back
The back and forward arrows in the toolbar replay that history, so a dead end still returns you to the question.
G Go To an address or a symbol name Double-click a name, an xref, or a tree node Toolbar back / forward Symbol Tree filter, type a fragment of a name Program Trees, click a block Search > For Strings, then double-click a hit Search > Memory, for a constant you already saw
G Go To an address or a symbol name Double-click a name, an xref, or a tree node Toolbar back / forward Symbol Tree filter, type a fragment of a name Program Trees, click a block Search > For Strings, then double-click a hit Search > Memory, for a constant you already saw
Check yourself
1. You followed a call three functions deep and forgot which instruction you started from. What returns you there?
2. You know the function is still named FUN_00101240. How do you land on it?
3. You remember the program prints the word missing, and you want the instruction that uses it. A reliable first jump is: