GO KALI FREE

Ghidra

Reverse Engineering

Advancedlow risk

Ghidra is a software reverse engineering (SRE) framework developed by NSA. It includes a suite of full-featured, high-end software analysis tools for analyzing compiled code.

Installation

sudo apt install ghidra

Basic Syntax

ghidraRun

Quick Facts

Full Name
Ghidra SRE Framework
License
Apache 2.0
Language
Java
Platforms
Linux, macOS, Windows
Category
Reverse Engineering
Created By
NSA

Tool Overview

Ghidra is a software reverse engineering framework developed by the NSA. It includes a suite of tools for analyzing compiled code, including disassembly and decompilation.

The tool supports multiple processor architectures and executable formats. It features a built-in decompiler that converts assembly to pseudo-C code.

Ghidra is widely used for malware analysis, vulnerability research, and software reverse engineering. Its headless mode enables automated batch analysis.

Common Commands

ghidraLaunch the Ghidra graphical reverse-engineering suite on Kali
ghidraRunAlternative launcher script that starts the Ghidra GUI
analyzeHeadless /path/to/projects MyProject -import /path/to/binaryImport a binary into a project and auto-analyze it without the GUI
analyzeHeadless /path/to/projects MyProject -import /path/to/binary -overwriteRe-import a binary, overwriting any existing program of the same name
analyzeHeadless /path/to/projects MyProject -import /path/to/dir -recursiveRecursively import every file in a directory tree
analyzeHeadless /path/to/projects MyProject -import /path/to/binary -noanalysisImport without running auto-analysis (analyze later)
analyzeHeadless /path/to/projects MyProject -processRe-run analysis/scripts against programs already in the project
analyzeHeadless /path/to/projects MyProject -process binary -postScript Decompile.javaRun a post-analysis script against an existing program
analyzeHeadless /path/to/projects MyProject -import /path/to/binary -postScript MyScript.pyImport, analyze, then run a Python (Jython) post-script
analyzeHeadless /path/to/projects MyProject -import /path/to/binary -preScript Setup.javaRun a script before analysis begins
analyzeHeadless /path/to/projects MyProject -import bin -scriptPath /path/to/scriptsSpecify where Ghidra should look for headless scripts
analyzeHeadless /path/to/projects MyProject -import bin -deleteProjectDelete the project after the headless run completes
analyzeHeadless /path/to/projects MyProject -import bin -processor x86:LE:64:defaultForce a specific processor language ID for analysis
analyzeHeadless /path/to/projects MyProject -import bin -cspec gccSet the compiler specification used during analysis
analyzeHeadless /path/to/projects MyProject -import bin -loader ElfLoaderChoose a specific loader for the imported file

Step-by-Step Guide

  1. 1Start the application from your terminal
  2. 2Establish a new workspace project
  3. 3Load the target executable into the tool
  4. 4Allow the engine to automatically parse and disassemble the code
  5. 5Explore the function tree and symbolic links
  6. 6Review the pseudo-C code generated by the decompiler pane
  7. 7Look for hardcoded credentials or hidden string variables

Warnings

Use Cases

Malware Analysis

Analyze malware samples and understand behavior.

Vulnerability Research

Find vulnerabilities in compiled software.

Binary Analysis

Understand compiled code without source.

CTF Challenges

Solve reverse engineering CTF problems.

Key Features

Related Tools

Radare2

Reverse Engineering

Command-line RE framework.

Frequently Asked Questions

What is Ghidra used for?

Ghidra is used for reverse engineering and binary analysis. It provides disassembly, decompilation, and scripting capabilities for analyzing compiled code.

Is Ghidra free?

Yes, Ghidra is completely free and open source, developed by the NSA.

How does Ghidra compare to IDA Pro?

Ghidra is free and offers comparable decompilation. IDA Pro has better plugin ecosystem but costs thousands of dollars.

Can Ghidra analyze malware?

Yes, Ghidra is widely used for malware analysis with its decompiler and scripting capabilities.

Tags

#reverse-engineering#sre#framework#decompiler

Output Explanation

The interface displays several panes including the raw hex, the assembly instructions, a graphical function flow, and a high-level decompiled representation of the code.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.