Skip to main content

49. Reverse Engineering with Ghidra: A Practical Guide

Ghidra is an open-source reverse-engineering framework released by the NSA, and it has become an essential tool for security researchers, CTF participants, and malware analysts alike. This guide covers practical techniques for analyzing binaries with Ghidra.

Why Ghidra?​

Ghidra provides enterprise-grade analysis features for free. It supports many architectures and file formats, including x86, ARM, MIPS, and PowerPC, making it useful for everything from CTF challenges to real-world reversing.

Major advantages:

  • Powerful decompiler that generates readable C-like code
  • Collaborative analysis features
  • Extensible through Python/Java scripting
  • Cross-platform support for Windows, Linux, and macOS

Getting Started​

Download Ghidra from the NSA's official GitHub repository. Launch it with ghidraRun, create a new project, and begin the analysis.

Basic Workflow​

  1. Import the binary: Drag the target file into the project
  2. Run analysis: Start automatic analysis and select yes for the default analyzers
  3. Navigate: Use the Symbol Tree, Decompiler, and Listing views

Core Features​

Decompiler Window​

The decompiler converts assembly into pseudo-C code. Right-click a function to move between assembly and decompiled views. Editing the function signature with Ctrl+E produces cleaner output.

Cross-References (Xrefs)​

Use Ctrl+Shift+F to find every reference to a function or variable. This reveals program flow and data dependencies that are essential to understanding obfuscated code.

Function Graph​

Click the Graph icon to visualize control flow. This is useful for finding loops, conditional branches, and dead-code paths that commonly appear in CTF challenges.

Practical Techniques​

Finding the main Function​

To find main in a stripped binary:

  • Find the call to __libc_start_main
  • Inspect its first argument
  • Rename the function to make it clear

String Analysis​

Use Ctrl+Shift+E to display every string. Double-click a string to navigate to its use. Strings often hide encryption keys, command handlers, and backdoor triggers.

Binary Patching​

Export the program and edit its bytes in a hex editor, or use Ghidra's Patch Instruction feature. This is useful for bypassing checks or enabling debug functionality.

CTF Usage​

Analyzing Packed Executables​

  1. Inspect the entry point for packing signatures
  2. Set breakpoints on suspicious calls
  3. Dump memory after the unpacking routine
  4. Reanalyze the dumped binary in a new project

Solving Crackmes​

Check the following:

  • Comparisons after user input
  • Hardcoded keys or validation logic
  • Anti-debugging tricks that detect a debugger
  • Mathematical operations that transform the input

Analyzing Custom Protocols​

Define protocol structures with Ghidra's Data Type Manager. Applying a structure to a memory buffer makes the decompiler parse it automatically.

Advanced Tips​

Script automation: Write Python scripts in the Script Manager to automate repetitive analysis tasks. This is especially useful when processing several similar binaries.

Version tracking: Compare different binary versions to identify patches or vulnerability fixes. This is essential for 1-day exploit development.

Processor modules: Add support for custom or embedded architectures. Community-maintained modules are also available for game consoles and IoT devices.

Common Mistakes​

  • Blindly trusting the decompiler: Always cross-check it against the assembly
  • Ignoring calling conventions: Misidentified arguments cause confusion
  • Skipping analysis: Automatic analysis recognizes most patterns
  • Failing to save work: The project preserves comments and annotations

Integrated Tools​

Ghidra can be used alongside other tools:

  • GDB/LLDB: Dynamic analysis that complements static analysis
  • IDA Pro: Cross-check decompiler output
  • Binary Ninja: An alternative analysis workflow

Closing Thoughts​

Ghidra democratized reverse engineering with enterprise-grade tooling. Mastering the decompiler, Xref navigation, and scripting lets you handle CTF challenges and security research efficiently.

Start with simple crackmes, progress to CTF binaries, and then move on to real malware. As you analyze more, pattern recognition accumulates and each next target becomes easier.