The Ghidra Book: The Definitive Guide

Brief Contents
Contents in Detail
Acknowledgments
Introduction
	About This Book
	Who Should Read This Book?
	What’s in This Book?
		Part I: Introduction
		Part II: Basic Ghidra Usage
		Part III: Making Ghidra Work for You
		Part IV: A Deeper Dive
		Part V: Real-World Application
Part I: Introduction
Chapter 1: Introduction to Disassembly
	Disassembly Theory
	The What of Disassembly
	The Why of Disassembly
		Malware Analysis
		Vulnerability Analysis
		Software Interoperability
		Compiler Validation
		Debugging Displays
	The How of Disassembly
		A Basic Disassembly Algorithm
		Linear Sweep Disassembly
		Recursive Descent Disassembly
	Summary
Chapter 2: Reversing and Disassembly Tools
	Classification Tools
		file
		PE Tools
		PEiD
	Summary Tools
		nm
		ldd
		objdump
		otool
		dumpbin
		c++filt
	Deep Inspection Tools
		strings
		Disassemblers
	Summary
Chapter 3: Meet Ghidra
	Ghidra Licenses
	Ghidra Versions
	Ghidra Support Resources
	Downloading Ghidra
	Installing Ghidra
		The Ghidra Directory Layout
		Starting Ghidra
	Summary
Part II: Basic Ghidra Usage
Chapter 4: Getting Started with Ghidra
	Launching Ghidra
	Creating a New Project
		Ghidra File Loading
		Using the Raw Binary Loader
	Analyzing Files with Ghidra
		Auto Analysis Results
	Desktop Behavior During Initial Analysis
		Saving Your Work and Exiting
	Ghidra Desktop Tips and Tricks
	Summary
Chapter 5: Ghidra Data Displays
	CodeBrowser
	CodeBrowser Windows
		The Listing Window
		Creating Additional Disassembly Windows
		Ghidra Function Graph View
		The Program Trees Window
		The Symbol Tree Window
		The Data Type Manager Window
		The Console Window
		The Decompiler Window
	Other Ghidra Windows
		The Bytes Window
		The Defined Data Window
		The Defined Strings Window
		The Symbol Table and Symbol References Windows
		The Memory Map Window
		The Function Call Graph Window
	Summary
Chapter 6: Making Sense of a Ghidra Disassembly
	Disassembly Navigation
		Names and Labels
		Navigation in Ghidra
		Go To
		Navigation History
	Stack Frames
		Function Call Mechanics
		Calling Conventions
		Additional Stack Frame Considerations
		Local Variable Layout
		Stack Frame Examples
	Ghidra Stack Views
		Ghidra Stack Frame Analysis
		Stack Frames in Listing View
		Decompiler-Assisted Stack Frame Analysis
		Local Variables as Operands
		The Ghidra Stack Frame Editor
	Searching
		Search Program Text
		Search Memory
	Summary
Chapter 7: Disassembly Manipulation
	Manipulating Names and Labels
		Renaming Parameters and Local Variables
		Renaming Labels
		Adding a New Label
		Editing Labels
		Removing a Label
		Navigating Labels
	Comments
		End-of-Line Comments
		Pre and Post Comments
		Plate Comments
		Repeatable Comments
		Parameter and Local Variable Comments
		Annotations
	Basic Code Transformations
		Changing Code Display Options
		Formatting Instruction Operands
		Manipulating Functions
		Converting Data to Code (and Vice Versa)
	Basic Data Transformations
		Specifying Data Types
		Working with Strings
		Defining Arrays
	Summary
Chapter 8: Data Types and Data Structures
	Making Sense of Data
	Recognizing Data Structure Use
		Array Member Access
		Structure Member Access
	Creating Structures with Ghidra
		Creating a New Structure
		Editing Structure Members
		Applying Structure Layouts
	C++ Reversing Primer
		The this Pointer
		Virtual Functions and Vftables
		The Object Life Cycle
		Name Mangling
		Runtime Type Identification
		Inheritance Relationships
		C++ Reverse Engineering References
	Summary
Chapter 9: Cross-References
	Referencing Basics
		Cross-References (Back References)
		References Example
	Reference Management Windows
		XRefs Window
		References To
		Symbol References
		Advanced Reference Manipulation
	Summary
Chapter 10: Graphs
	Basic Blocks
	Function Graphs
	Function Call Graphs
	Trees
	Summary
Part III: Making Ghidra Work for You
Chapter 11: Collaborative SRE
	Teamwork
	Ghidra Server Setup
	Shared Projects
		Creating a Shared Project
		Project Management
	Project Window Menus
		File
		Edit
		Project
	Project Repository
		Version Control
		Example Scenario
	Summary
Chapter 12: Customizing Ghidra
	CodeBrowser
		Rearranging Windows
		Editing Tool Options
		Editing the Tool
		Special Tool Editing Features
		Saving the CodeBrowser Layout
	Ghidra Project Window
	Tools
	Workspaces
	Summary
Chapter 13: Extending Ghidra’s Worldview
	Importing Files
	Analyzers
	Word Models
	Data Types
		Creating New Data Type Archives
	Function IDs
	Function ID Plugin
		Function ID Plugin Example: UPX
		Function ID Plugin Example: Profiling a Static Library
	Summary
Chapter 14: Basic Ghidra Scripting
	Script Manager
		Script Manager Window
		Script Manager Toolbar
	Script Development
		Writing Java Scripts (Not JavaScript!)
		Edit Script Example: Regex Search
		Python Scripts
		Support for Other Languages
	Introduction to the Ghidra API
		The Address Interface
		The Symbol Interface
		The Reference Interface
		The GhidraScript Class
		The Program Class
		The Function Interface
		The Instruction Interface
	Ghidra Scripting Examples
		Example 1: Enumerating Functions
		Example 2: Enumerating Instructions
		Example 3: Enumerating Cross-References
		Example 4: Finding Function Calls
		Example 5: Emulating Assembly Language Behavior
	Summary
Chapter 15: Eclipse and GhidraDev
	Eclipse
		Eclipse Integration
		Starting Eclipse
		Editing Scripts with Eclipse
	GhidraDev Menu
		GhidraDev > New
		Navigating the Package Explorer
	Example: Ghidra Analyzer Module Project
		Step 1: Define the Problem
		Step 2: Create the Eclipse Module
		Step 3: Build the Analyzer
		Step 4: Test the Analyzer Within Eclipse
		Step 5: Add the Analyzer to Our Ghidra Installation
		Step 6: Test the Analyzer Within Ghidra
	Summary
Chapter 16: Ghidra in Headless Mode
	Getting Started
		Step 1: Launch Ghidra
		Steps 2 and 3: Create a New Ghidra Project in a Specified Location
		Step 4: Import a File to the Project
		Steps 5 and 6: Auto Analyze the File, Save, and Exit
		Options and Parameters
	Writing Scripts
		HeadlessSimpleROP
		Automated FidDb Creation
	Summary
Part IV: A Deeper Dive
Chapter 17: Ghidra Loaders
	Unknown File Analysis
	Manually Loading a Windows PE File
	Example 1: SimpleShellcode Loader Module
		Step 0: Take a Step Back
		Step 1: Define the Problem
		Step 2: Create the Eclipse Module
		Step 3: Build the Loader
		Step 4: Add the Loader to Our Ghidra Installation
		Step 5: Test the Loader Within Ghidra
	Example 2: Simple Shellcode Source Loader
		Update 1: Modify the Response to the Importer Poll
		Update 2: Find the Shellcode in the Source Code
		Update 3: Convert Shellcode to Byte Values
		Update 4: Load Converted Byte Array
		Results
	Example 3: Simple ELF Shellcode Loader
		Housekeeping
		ELF Header Format
		Find Supported Load Specifications
		Load File Content into Ghidra
		Format Data Bytes and Add an Entry Point
		Language Definition Files
		Opinion Files
		Results
	Summary
Chapter 18: Ghidra Processors
	Understanding Ghidra Processor Modules
		Eclipse Processor Modules
		SLEIGH
		Processor Manuals
	Modifying a Ghidra Processor Module
		Problem Statement
		Example 1: Adding an Instruction to a Processor Module
		Example 2: Modifying an Instruction in a Processor Module
		Example 3: Adding a Register to a Processor Module
	Summary
Chapter 19: The Ghidra Decompiler
	Decompiler Analysis
		Analysis Options
	The Decompiler Window
		Example 1: Editing in the Decompiler Window
		Example 2: Non-Returning Functions
		Example 3: Automated Structure Creation
	Summary
Chapter 20: Compiler Variations
	High-Level Constructs
		switch Statements
		Example: Comparing gcc with Microsoft C/C++ Compiler
	Compiler Build Options
		Example 1: Modulo Operator
		Example 2: The Ternary Operator
		Example 3: Function Inlining
	Compiler-Specific C++ Implementation
		Function Overloading
		RTTI Implementations
	Locating the main Function
		Example 1: _start to main with gcc on Linux x86-64
		Example 2: _start to main with clang on FreeBSD x86-64
		Example 3: _start to main with Microsoft’s C/C++ compiler
	Summary
Part V: Real-World Applications
Chapter 21: Obfuscated Code Analysis
	Anti–Reverse Engineering
		Obfuscation
		Anti–Static Analysis Techniques
		Imported Function Obfuscation
		Anti–Dynamic Analysis Techniques
	Static Deobfuscation of Binaries Using Ghidra
		Script-Oriented Deobfuscation
		Emulation-Oriented Deobfuscation
		Step 1: Define the Problem
		Step 2: Create the Eclipse Script Project
		Step 3: Build the Emulator
		Step 4: Add the Script to Our Ghidra Installation
		Step 5: Test the Script Within Ghidra
	Summary
Chapter 22: Patching Binaries
	Planning Your Patch
	Finding Things to Change
		Searching Memory
		Searching for Direct References
		Searching for Instruction Patterns
		Finding Specific Behaviors
	Applying Your Patch
		Making Basic Changes
		Making Nontrivial Changes
	Exporting Files
		Ghidra Export Formats
		The Binary Export Format
		Script-Assisted Export
	Example: Patching a Binary
	Summary
Chapter 23: Binary Differencing and Version Tracking
	Binary Differencing
		Program Diff Tool
		Example: Merging Two Analyzed Files
	Comparing Functions
		Function Comparison Window
		Example: Comparing Crypto Routines
	Version Tracking
		Version Tracking Concepts
	Summary
Ghidra for IDA Users
	The Basics
		Database Creation
		Basic Windows and Navigation
	Scripting
	Summary
Index