The Ghidra Book

The Ghidra Book

by Chris Eagle, Kara Nance
Released August 2020
Publisher(s): No Starch Press
ISBN: 9781718501027

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency’s most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world’s most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere — and The Ghidra Book is the one and only guide you need to master it.

In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra’s components, features, and unique capacity for group collaboration. You’ll learn how to:

•Navigate a disassembly
•Use Ghidra’s built-in decompiler to expedite analysis
•Analyze obfuscated binaries
•Extend Ghidra to recognize new data types
•Build new Ghidra analyzers and loaders
•Add support for new processors and instruction sets
•Script Ghidra tasks to automate workflows
•Set up and use a collaborative reverse engineering environment

Designed for beginner and advanced users alike, The Ghidra Book will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro.

Table of contents

  1. Cover Page
  2. Title Page
  3. Copyright Page
  4. About the Authors
  5. About the Tech Reviewer
  6. BRIEF CONTENTS
  7. CONTENTS IN DETAIL
  8. ACKNOWLEDGMENTS
  9. INTRODUCTION
    1. About This Book
    2. Who Should Read This Book?
    3. What’s in This Book?
  10. PART I INTRODUCTION
  11. 1 INTRODUCTION TO DISASSEMBLY
    1. Disassembly Theory
    2. The What of Disassembly
    3. The Why of Disassembly
    4. The How of Disassembly
    5. Summary
  12. 2 REVERSING AND DISASSEMBLY TOOLS
    1. Classification Tools
    2. Summary Tools
    3. Deep Inspection Tools
    4. Summary
  13. 3 MEET GHIDRA
    1. Ghidra Licenses
    2. Ghidra Versions
    3. Ghidra Support Resources
    4. Downloading Ghidra
    5. Installing Ghidra
    6. Summary
  14. PART II BASIC GHIDRA USAGE
  15. 4 GETTING STARTED WITH GHIDRA
    1. Launching Ghidra
    2. Creating a New Project
    3. Analyzing Files with Ghidra
    4. Desktop Behavior During Initial Analysis
    5. Ghidra Desktop Tips and Tricks
    6. Summary
  16. 5 GHIDRA DATA DISPLAYS
    1. CodeBrowser
    2. CodeBrowser Windows
    3. Other Ghidra Windows
    4. Summary
  17. 6 MAKING SENSE OF A GHIDRA DISASSEMBLY
    1. Disassembly Navigation
    2. Stack Frames
    3. Ghidra Stack Views
    4. Searching
    5. Summary
  18. 7 DISASSEMBLY MANIPULATION
    1. Manipulating Names and Labels
    2. Comments
    3. Basic Code Transformations
    4. Basic Data Transformations
    5. Summary
  19. 8 DATA TYPES AND DATA STRUCTURES
    1. Making Sense of Data
    2. Recognizing Data Structure Use
    3. Creating Structures with Ghidra
    4. C++ Reversing Primer
    5. Summary
  20. 9 CROSS-REFERENCES
    1. Referencing Basics
    2. Reference Management Windows
    3. Summary
  21. 10 GRAPHS
    1. Basic Blocks
    2. Function Graphs
    3. Function Call Graphs
    4. Trees
    5. Summary
  22. PART III MAKING GHIDRA WORK FOR YOU
  23. 11 COLLABORATIVE SRE
    1. Teamwork
    2. Ghidra Server Setup
    3. Shared Projects
    4. Project Window Menus
    5. Project Repository
    6. Summary
  24. 12 CUSTOMIZING GHIDRA
    1. CodeBrowser
    2. Ghidra Project Window
    3. Tools
    4. Workspaces
    5. Summary
  25. 13 EXTENDING GHIDRA’s WORLDVIEW
    1. Importing Files
    2. Analyzers
    3. Word Models
    4. Data Types
    5. Function IDs
    6. Function ID Plugin
    7. Summary
  26. 14 Basic Ghidra Scripting
    1. Script Manager
    2. Script Development
    3. Introduction to the Ghidra API
    4. Ghidra Scripting Examples
    5. Summary
  27. 15 ECLIPSE AND GHIDRADEV
    1. Eclipse
    2. GhidraDev Menu
    3. Example: Ghidra Analyzer Module Project
    4. Summary
  28. 16 GHIDRA IN HEADLESS MODE
    1. Getting Started
    2. Writing Scripts
    3. Summary
  29. PART IV A DEEPER DIVE
  30. 17 GHIDRA LOADERS
    1. Unknown File Analysis
    2. Manually Loading a Windows PE File
    3. Example 1: SimpleShellcode Loader Module
    4. Example 2: Simple Shellcode Source Loader
    5. Example 3: Simple ELF Shellcode Loader
    6. Summary
  31. 18 GHIDRA PROCESSORS
    1. Understanding Ghidra Processor Modules
    2. Modifying a Ghidra Processor Module
    3. Summary
  32. 19 THE GHIDRA DECOMPILER
    1. Decompiler Analysis
    2. The Decompiler Window
    3. Summary
  33. 20 COMPILER VARIATIONS
    1. High-Level Constructs
    2. Compiler Build Options
    3. Compiler-Specific C++ Implementation
    4. Locating the main Function
    5. Summary
  34. PART V REAL-WORLD APPLICATIONS
  35. 21 OBFUSCATED CODE ANALYSIS
    1. Anti–Reverse Engineering
    2. Static Deobfuscation of Binaries Using Ghidra
    3. Summary
  36. 22 PATCHING BINARIES
    1. Planning Your Patch
    2. Finding Things to Change
    3. Applying Your Patch
    4. Exporting Files
    5. Example: Patching a Binary
    6. Summary
  37. 23 BINARY DIFFERENCING AND VERSION TRACKING
    1. Binary Differencing
    2. Comparing Functions
    3. Version Tracking
    4. Summary
  38. GHIDRA FOR IDA USERS
    1. The Basics
    2. Scripting
    3. Summary
  39. INDEX

Product information

  • Title: The Ghidra Book
  • Author(s): Chris Eagle, Kara Nance
  • Release date: August 2020
  • Publisher(s): No Starch Press
  • ISBN: 9781718501027