What is Ghidra and why is it needed for the analysis of binary
Ghidra is a free, reversed-down software tool released by the NSA in 2019. Before its introduction, the market of disassemblers held an IDA Pro with the Hex-Rays plugin - a bundle of powerful, but with a price tag that closed the entrance to beginners and small teams. The emergence of Ghidra this barrier has been demolished. More information about our material about binary analysis of vulnerabilities.
The main difference from simple disassemblers is the built-in decompiler. Disassembler translates machine code into assembly instructions (MOV, PUSH, CALL) – it is hard to read them without preparation. The decompiler goes further: restores from the bytecode a semblance of the source text on C. Instead of dozens of lines of assembly, you see if, for, function calls with arguments. This is not the code that the author of the program wrote, and in places the decompiler lies – but for the first analysis of the executables is enough for the eyes.
Ghidra supports dozens of architectures: x86, x86_64, ARM, MIPS, PowerPC. For typical tasks on a regular PC - malware analysis, the solution of CTF-tasks - is enough x86_64.
Installation of Ghidra in five minutes
Russian-language guides often offer to collect Ghidra from a master branch – with the installation of Visual Studio, Gradle and compilation from the source. The Securelist article details this process for Windows, Linux and macOS. If you need the latest fixes from the dev branch, the assembly is justified. For the first acquaintance - redundant, and it is at this step that many quit.
Quick path:
Set JDK 17 or newer (recommend Adoptium Temurin). Ghidra is written in Java – without JDK will not start.
Download the latest release from the GitHub repository NationalSecurityAgency/ghidra (Reparements section, ready ZIP archive).
Unpack the archive and run ghidraRun (Linux/macos) or ghidraRun.bat (Windows).
At the first launch, Ghidra will offer to create a project. Project – container for results: binary database, your comments, renamed features, data types. One project can store multiple files. Without the project, you can not work - all changes will disappear when closing. (I stepped on these rakes in the first week — I’ve been creating a project even for a one-off analysis.)
After creating the project, open CodeBrowser through a green dragon icon is the main work environment for reverse engineering.
Binary Import and Autoanalysis
In CodeBrowser via File → Import File, select Binary. Ghidra will determine the format (ELF, PE, Mach-O) and architecture automatically. At this stage, you usually do not need to change the settings - confirm the import.
Immediately after importing Ghidra will offer to launch autoanalysis (Auto Analysis). You can't miss him. Autoanalysis launches a set of algorithms that:
Mark functions – determine where each begins and ends
Restore cross-references: what function causes which
Find string literals — text messages, URLs, paths to files
Launch the Ghidra decompile for each function found
For a binary up to a few megabytes, autoanalysis takes seconds. For the big ones, minutes. Once completed, you receive a fully marked file ready to dissect.
CodeBrowser interface: windows for reverse engineering
CodeBrowser looks overloaded at the first opening – four or five panels with unfamiliar information. Don't be scared. For the analysis of binary in Ghidra, four windows are really needed.
Program Trees (left at the top) — the structure of the binary: sections .text (executable code) .data (data), .rodata (lines and constants). Consider it a table of contents of the file. Section .text where the functions live.
Symbol Tree (left) - list of all names: functions, imported library calls, global variables. If the binary is not stripped (not deprived of debugging information), here will be original names: main, check_license, send_report. If stripped – Ghidra will generate names of the species FUN_00401000, where the number is the start address of the function. The second option is more common.
Listing (center) is a disassembly window. Shows the assembly code. It seems frightening to beginners, but it is not necessary to read it entirely. Listing is useful for navigation: click on the address or name - Ghidra transfers to the right place.
Decompile (right) is the main window for those who do not know the assembler on the tooth. Ghidra decompiler turns machine code into a C-like pseudocode. Click on the function in Symbol Tree or Listing - Decompile shows its restored text. Here there are 80% of the analyst's work.
Synchronization between windows
Windows are linked: click on the line in Decompile highlights the appropriate instructions in Listing, and vice versa. This allows you to match the pseudocode string with the real CPU instructions – useful when the decompiler is wrong. And he is wrong regularly.
Ghidra decompilation: read pseudocode instead of assembler
Let’s say you open the feature and see in the Decompile window:
void FUN_00401150(void) {
char local_28[32];
puts("Enter password:");
fgets(local_28, 32, stdin);
if (strcmp(local_28, "s3cr3t_k3y\n") == 0) {
puts("Access granted!");
} else {
puts("Wrong password.");
}
}
Even without experience in reverse engineering for beginners see: function requests password, compares it with s3cr3t_k3y through strcmp and derives the result. You just “solved” a simple CrackMe – a typical category of reverse on CTF competitions. The assembler didn't need.
A few nuances of pseudocode reading that are worth knowing from the first day:
Automatic variable names. Ghidra generates names like local_28, param_1, uVar2. They mean nothing, technical labels. Right click on the variable → Rename Variable allows you to give a meaningful name. I rename the key variables for each analysis – after an hour, the binary turns into a readable program.
Types of data. The decompiler tries to guess the types, but often misses. undefined4 means “four bytes of unknown type” – with a high probability it int or uint32_t. Through Retype Variable, you can fix the type, after which the decompiler will recalculate the dependent expressions.
Appeals to the fields of structures. Designs of the species *(int *)(param_1 + 0x10) – appeal to the field of the structure on displacement. Ghidra doesn't know the original structure, so shows the raw offset. If you can understand which structure is used, you can create your type in Data Type Manager and apply it - the pseudocode will become much more readable.
Decompiler errors. Ghidra decompiler sometimes generates designs that were not in the source code: superfluous type-bringing, “dead” variables, incorrect cycle boundaries. If the pseudocode looks illogical, switch to Listing and check with the assembly instructions. This is why the windows are synchronized. Don’t trust the decompiler blindly – he’s an instrument, not an oracle.
Ghidra is a free, reversed-down software tool released by the NSA in 2019. Before its introduction, the market of disassemblers held an IDA Pro with the Hex-Rays plugin - a bundle of powerful, but with a price tag that closed the entrance to beginners and small teams. The emergence of Ghidra this barrier has been demolished. More information about our material about binary analysis of vulnerabilities.
The main difference from simple disassemblers is the built-in decompiler. Disassembler translates machine code into assembly instructions (MOV, PUSH, CALL) – it is hard to read them without preparation. The decompiler goes further: restores from the bytecode a semblance of the source text on C. Instead of dozens of lines of assembly, you see if, for, function calls with arguments. This is not the code that the author of the program wrote, and in places the decompiler lies – but for the first analysis of the executables is enough for the eyes.
Ghidra supports dozens of architectures: x86, x86_64, ARM, MIPS, PowerPC. For typical tasks on a regular PC - malware analysis, the solution of CTF-tasks - is enough x86_64.
Installation of Ghidra in five minutes
Russian-language guides often offer to collect Ghidra from a master branch – with the installation of Visual Studio, Gradle and compilation from the source. The Securelist article details this process for Windows, Linux and macOS. If you need the latest fixes from the dev branch, the assembly is justified. For the first acquaintance - redundant, and it is at this step that many quit.
Quick path:
Set JDK 17 or newer (recommend Adoptium Temurin). Ghidra is written in Java – without JDK will not start.
Download the latest release from the GitHub repository NationalSecurityAgency/ghidra (Reparements section, ready ZIP archive).
Unpack the archive and run ghidraRun (Linux/macos) or ghidraRun.bat (Windows).
At the first launch, Ghidra will offer to create a project. Project – container for results: binary database, your comments, renamed features, data types. One project can store multiple files. Without the project, you can not work - all changes will disappear when closing. (I stepped on these rakes in the first week — I’ve been creating a project even for a one-off analysis.)
After creating the project, open CodeBrowser through a green dragon icon is the main work environment for reverse engineering.
Binary Import and Autoanalysis
In CodeBrowser via File → Import File, select Binary. Ghidra will determine the format (ELF, PE, Mach-O) and architecture automatically. At this stage, you usually do not need to change the settings - confirm the import.
Immediately after importing Ghidra will offer to launch autoanalysis (Auto Analysis). You can't miss him. Autoanalysis launches a set of algorithms that:
Mark functions – determine where each begins and ends
Restore cross-references: what function causes which
Find string literals — text messages, URLs, paths to files
Launch the Ghidra decompile for each function found
For a binary up to a few megabytes, autoanalysis takes seconds. For the big ones, minutes. Once completed, you receive a fully marked file ready to dissect.
CodeBrowser interface: windows for reverse engineering
CodeBrowser looks overloaded at the first opening – four or five panels with unfamiliar information. Don't be scared. For the analysis of binary in Ghidra, four windows are really needed.
Program Trees (left at the top) — the structure of the binary: sections .text (executable code) .data (data), .rodata (lines and constants). Consider it a table of contents of the file. Section .text where the functions live.
Symbol Tree (left) - list of all names: functions, imported library calls, global variables. If the binary is not stripped (not deprived of debugging information), here will be original names: main, check_license, send_report. If stripped – Ghidra will generate names of the species FUN_00401000, where the number is the start address of the function. The second option is more common.
Listing (center) is a disassembly window. Shows the assembly code. It seems frightening to beginners, but it is not necessary to read it entirely. Listing is useful for navigation: click on the address or name - Ghidra transfers to the right place.
Decompile (right) is the main window for those who do not know the assembler on the tooth. Ghidra decompiler turns machine code into a C-like pseudocode. Click on the function in Symbol Tree or Listing - Decompile shows its restored text. Here there are 80% of the analyst's work.
Synchronization between windows
Windows are linked: click on the line in Decompile highlights the appropriate instructions in Listing, and vice versa. This allows you to match the pseudocode string with the real CPU instructions – useful when the decompiler is wrong. And he is wrong regularly.
Ghidra decompilation: read pseudocode instead of assembler
Let’s say you open the feature and see in the Decompile window:
void FUN_00401150(void) {
char local_28[32];
puts("Enter password:");
fgets(local_28, 32, stdin);
if (strcmp(local_28, "s3cr3t_k3y\n") == 0) {
puts("Access granted!");
} else {
puts("Wrong password.");
}
}
Even without experience in reverse engineering for beginners see: function requests password, compares it with s3cr3t_k3y through strcmp and derives the result. You just “solved” a simple CrackMe – a typical category of reverse on CTF competitions. The assembler didn't need.
A few nuances of pseudocode reading that are worth knowing from the first day:
Automatic variable names. Ghidra generates names like local_28, param_1, uVar2. They mean nothing, technical labels. Right click on the variable → Rename Variable allows you to give a meaningful name. I rename the key variables for each analysis – after an hour, the binary turns into a readable program.
Types of data. The decompiler tries to guess the types, but often misses. undefined4 means “four bytes of unknown type” – with a high probability it int or uint32_t. Through Retype Variable, you can fix the type, after which the decompiler will recalculate the dependent expressions.
Appeals to the fields of structures. Designs of the species *(int *)(param_1 + 0x10) – appeal to the field of the structure on displacement. Ghidra doesn't know the original structure, so shows the raw offset. If you can understand which structure is used, you can create your type in Data Type Manager and apply it - the pseudocode will become much more readable.
Decompiler errors. Ghidra decompiler sometimes generates designs that were not in the source code: superfluous type-bringing, “dead” variables, incorrect cycle boundaries. If the pseudocode looks illogical, switch to Listing and check with the assembly instructions. This is why the windows are synchronized. Don’t trust the decompiler blindly – he’s an instrument, not an oracle.
