Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Ghidra Software Reverse Engineering for Beginners
  • Table Of Contents Toc
  • Feedback & Rating feedback
Ghidra Software Reverse Engineering for Beginners

Ghidra Software Reverse Engineering for Beginners

By : David Álvarez Pérez
4.6 (8)
Buy this Book
close
close
Ghidra Software Reverse Engineering for Beginners

Ghidra Software Reverse Engineering for Beginners

4.6 (8)
By: David Álvarez Pérez
Buy this Book

Overview of this book

Ghidra, an open source software reverse engineering (SRE) framework created by the NSA research directorate, enables users to analyze compiled code on any platform, whether Linux, Windows, or macOS. This book is a starting point for developers interested in leveraging Ghidra to create patches and extend tool capabilities to meet their cybersecurity needs. You'll begin by installing Ghidra and exploring its features, and gradually learn how to automate reverse engineering tasks using Ghidra plug-ins. You’ll then see how to set up an environment to perform malware analysis using Ghidra and how to use it in the headless mode. As you progress, you’ll use Ghidra scripting to automate the task of identifying vulnerabilities in executable binaries. The book also covers advanced topics such as developing Ghidra plug-ins, developing your own GUI, incorporating new process architectures if needed, and contributing to the Ghidra project. By the end of this Ghidra book, you’ll have developed the skills you need to harness the power of Ghidra for analyzing and avoiding potential vulnerabilities in code and networks.
Table of Contents (20 chapters)
close
close
close
Preface
Icon
Preface
Icon
Who this book is for
Icon
What this book covers
Icon
To get the most out of this book
Icon
Download the example code files
Icon
Code in Action
Icon
Download the color images
Icon
Conventions used
Icon
Get in touch
Icon
Reviews
1
Section 1: Introduction to Ghidra
Icon
Section 1: Introduction to Ghidra
Lock Free Chapter
2
Chapter 1: Getting Started with Ghidra
chevron up
Icon
Chapter 1: Getting Started with Ghidra
Icon
Technical requirements
Icon
WikiLeaks Vault 7
Icon
Ghidra versus IDA and many other competitors
Icon
Ghidra overview
Icon
Summary
Icon
Questions
3
Chapter 2: Automating RE Tasks with Ghidra Scripts
Icon
Chapter 2: Automating RE Tasks with Ghidra Scripts
Icon
Technical requirements
Icon
Using and adapting existing scripts
Icon
The script class
Icon
Script development
Icon
Summary
Icon
Questions
4
Chapter 3: Ghidra Debug Mode
Icon
Chapter 3: Ghidra Debug Mode
Icon
Technical requirements
Icon
Setting up the Ghidra development environment
Icon
Debugging the Ghidra code and Ghidra scripts
Icon
Ghidra RCE vulnerability
Icon
Summary
Icon
Questions
Icon
Further reading
5
Chapter 4: Using Ghidra Extensions
Icon
Chapter 4: Using Ghidra Extensions
Icon
Technical requirements
Icon
Installing existing Ghidra extensions
Icon
Understanding the Ghidra extension skeleton
Icon
Developing a Ghidra extension
Icon
Summary
Icon
Questions
Icon
Further reading
6
Section 2: Reverse Engineering
Icon
Section 2: Reverse Engineering
7
Chapter 5: Reversing Malware Using Ghidra
Icon
Chapter 5: Reversing Malware Using Ghidra
Icon
Technical requirements
Icon
Setting up the environment
Icon
Looking for malware indicators
Icon
Dissecting interesting malware sample parts
Icon
Summary
Icon
Questions
Icon
Further reading
8
Chapter 6: Scripting Malware Analysis
Icon
Chapter 6: Scripting Malware Analysis
Icon
Technical requirements
Icon
Using the Ghidra scripting API
Icon
Writing scripts using the Java programming language
Icon
Writing scripts using the Python programming language
Icon
Deobfuscating malware samples using scripts
Icon
Summary
Icon
Questions
Icon
Further reading
9
Chapter 7: Using Ghidra Headless Analyzer
Icon
Chapter 7: Using Ghidra Headless Analyzer
Icon
Technical requirements
Icon
Why use headless mode?
Icon
Creating and populating projects
Icon
Performing analysis on imported or existing binaries
Icon
Running non-GUI scripts in a project
Icon
Summary
Icon
Questions
Icon
Further reading
10
Chapter 8: Auditing Program Binaries
Icon
Chapter 8: Auditing Program Binaries
Icon
Technical requirements
Icon
Understanding memory corruption vulnerabilities
Icon
Finding vulnerabilities using Ghidra
Icon
Exploiting a simple stack-based buffer overflow
Icon
Summary
Icon
Questions
Icon
Further reading
11
Chapter 9: Scripting Binary Audits
Icon
Chapter 9: Scripting Binary Audits
Icon
Technical requirements
Icon
Looking for vulnerable functions
Icon
Looking for sscanf callers
Icon
Analyzing the caller function using PCode
Icon
Summary
Icon
Questions
Icon
Further reading
12
Section 3: Extending Ghidra
Icon
Section 3: Extending Ghidra
13
Chapter 10: Developing Ghidra Plugins
Icon
Chapter 10: Developing Ghidra Plugins
Icon
Technical requirements
Icon
Overview of existing plugins
Icon
The Ghidra plugin skeleton
Icon
Developing a Ghidra plugin
Icon
Summary
Icon
Questions
Icon
Further reading
14
Chapter 11: Incorporating New Binary Formats
Icon
Chapter 11: Incorporating New Binary Formats
Icon
Technical requirements
Icon
Understanding the difference between raw binaries and formatted binaries
Icon
Developing a Ghidra loader
Icon
Understanding filesystem loaders
Icon
Summary
Icon
Questions
Icon
Further reading
15
Chapter 12: Analyzing Processor Modules
Icon
Chapter 12: Analyzing Processor Modules
Icon
Technical requirements
Icon
Understanding the existing Ghidra processor modules
Icon
Overviewing the Ghidra processor module skeleton
Icon
Developing Ghidra processors
Icon
Summary
Icon
Questions
Icon
Further reading
16
Chapter 13: Contributing to the Ghidra Community
Icon
Chapter 13: Contributing to the Ghidra Community
Icon
Technical requirements
Icon
Overviewing the Ghidra project
Icon
Exploring contributions
Icon
Summary
Icon
Questions
Icon
Further reading
17
Chapter 14: Extending Ghidra for Advanced Reverse Engineering
Icon
Chapter 14: Extending Ghidra for Advanced Reverse Engineering
Icon
Technical requirements
Icon
Learning the basics of advanced reverse engineering
Icon
Using Ghidra for advanced reverse engineering
Icon
Summary
Icon
Questions
Icon
Further reading
18
Assessments
Icon
Chapter 1
Icon
Chapter 2
Icon
Chapter 3
Icon
Chapter 4
Icon
Chapter 5
Icon
Chapter 6
Icon
Chapter 7
Icon
Chapter 8
Icon
Chapter 9
Icon
Chapter 10
Icon
Chapter 11
Icon
Chapter 12
Icon
Chapter 13
Icon
Chapter 14
19
Other Books You May Enjoy
Icon
Other Books You May Enjoy
Icon
Leave a review - let other readers know what you think

Chapter 1: Getting Started with Ghidra

In this introductory chapter, we will provide an overview of Ghidra in some respects. Before starting, it would be convenient to know how to acquire and install the program. This is obviously something simple and trivial if you want to install a release version of the program. But I guess you probably want to know this program in depth. In which case, I can tell you in advance that it is possible to compile the program by yourself from the source code.

Since the source code of Ghidra is available and ready to be modified and extended, you will probably also be interested in knowing how it is structured, what kind of pieces of code exist, and so on. This is a great opportunity to discover the enormous possibilities that Ghidra offers us.

It is also interesting to review the main functionalities of Ghidra from the point of view of a reverse engineer. This will arouse your interest in this tool since it has its own peculiarities, and this is precisely the most interesting thing about Ghidra.

In this chapter, we're going to cover the following main topics:

  • WikiLeaks Vault 7
  • Ghidra versus IDA and many other competitors
  • Ghidra overview
Visually different images
CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
Ghidra Software Reverse Engineering for Beginners
End of Section 2
Next Section
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist download Download options
font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon