Introduction to Ghidra

STUDENT GUIDE

Notes:

Notes:

Notes:

Notes:

Notes:

• Ghidra is a highly extensible application for performing software reverse engineering.
• Ghidra is built upon a completely generic application framework. Each Application-specific capability is provided by small software bundles called plugins, and each one provides one or more features.
• There are five major parts of Ghidra including: Programs, Plugins, Tools, Project Manager, and the Server . Each of these parts will be discussed in more detail later on in the course.

Notes:

Notes:

Notes:

Notes:

Notes:

Notes:

Notes:

• Starting Ghidra
• To run Ghidra, double-click the ghidra.bat file (or run the ghidra.sh file for Linux or Mac) that is located in the Ghidra install directory
• The first time Ghidra runs, it may take a few minutes while it searches for plugins and other dynamic extensions. After the first time, it should start much faster. Also, the first time you launch Ghidra, a HELP window will appear displaying the "What's New" page in Ghidra. If this window appears, you can dismiss it for now. You can always get it back using the HELP subsystem which will be explained later
• An empty Ghidra Project window should now be displayed. This window will allow you to manage your tools, data, and projects.

Notes:

• The Project Manager is the place to:
• Create, open, or archive projects
• Non-Shared: project for individual users
• Shared: project for a team of users
• Import new programs into a project
• Project can contain multiple programs
• View the content of other projects
• Open programs in existing tools by dragging and dropping program onto tool in Tool Chest.
• View and open the contents of other projects (read-only)
• Manage your tools
• Can have multiple tools
• Shows which tools are available and running
• Can open the tools and create new tools
• Import default or user-created tools
• Store your project data archives
• Store your version tracking sessions
• View information about programs using tree or table view
• Create and switch Ghidra workspaces

Notes:
Before you can do anything else, you must first create a project. Projects are used to store all the programs and related information together in one place. This helps Ghidra locate the files, making them easily accessible to the user. Projects are populated with data using the import process, which will be explained in the next step.

Notes:

• When you complete your exercise you will have created a new Ghidra project. At this point you should see tools in the tool chest and should see a folder named MyProject.

Notes:
Below are steps for importing a file in the Program Manager.

1. Go to File->Import File...
2. Browse to the program you want to import. Click on "supported formats" if you want to see a list of formats Ghidra supports. Ghidra can import (PE, ELF, raw binary, intel hex, gzf (ghidra zip file), etc.)
3. Recognized type: If recognizable, Ghidra will fill in the correct file format otherwise it will show "raw binary" and you must choose the correct language/compiler pair.
4. Raw Binary: You may always choose raw binary if you do not want any imported information and you must choose the correct language/compiler pair.
5. Choose a new project folder if you want the loading programs in a subfolder.
6. Options Button:
• There are several import options including a few for importing and linking dynamically linked library (DLL) files along with your program.
• You can choose to use libraries already in your project or import them from disk
• You can edit the list of paths to search for on disk libraries
• You can choose a subfolder in your project to save them
• Hit F1 on the Options window to see more information about all of the import options.

Notes:

Notes:

Notes:

• When a program first opens in a tool, it automatically kicks off Auto-Analysis and asks the user if they wants to analyze the program.
• If you choose not to start Auto-Analysis right away, you can start it later by doing Analysis->Auto-Analyze.
• There are numerous analysis options that can be chosen. The default options change depending on what type of binary has been imported. See Help for more information.

Notes:

• During Auto-Analysis, Ghidra:
• Starts at Entry Points
• Disassembles by following flows
• Creates Functions at called locations
• Creates Cross References
• Depending on what options you have selected, Auto-Analysis will perform other functions such as:
• Using operand references to create code or data where operand points to
• Make switch statements using decompiler information
• Make function signatures based on decompiler information
• Demangle mangled names
• Recognize and name library functions
• Perform specific functions depending on the binary type
• Look for images
• If you would like to cancel Auto-Analysis at any time, you can click on the little red square at the bottom of the listing.
• Look at the log in the bottom right of the Program Manager to see which analyzers were run and how long they took.

Notes:

• For many binaries, analysis gives better results with a layered approach. This means the user should run analysis with basic options first, then rerun with other options later.
• Initial analysis:
• Turn off anything speculative or extra, such as stack analysis, especially if you have a large binary. You can turn these options back on after an initial analysis and rerun analysis on selected functions or the whole program.
• In general, you should leave on reference analyzers, data analyzers, and function analyzers in order to determine what is code and what is data.
• Follow-on analysis:
• Can rerun analysis with different options OR turn on one-shot analyzers, which are analyzers that run one type of analysis at a time
• One-shot analyzers can be run from the Analysis->One-Shot menu. Some common ones are:
• Decompiler Parameter ID
• Decompiler Switch Analysis
• Stack
• Recognize and fix problems:
• Red x's indicate bad flow. The error bookmarks might indicate what analyzer caused the problem so the user can rerun with better options.
• Analysis may not completely determine all code and data in a program, especially if certain analyzers are turned off.
• Use analysis scripts to recognize and fix problems. Here are some examples:
• FixupNoReturnFunction.java fixes functions that do not return and the resulting bad flow from the call to the function
• FindPotentialDecompilerProblems.java runs decompiler and indicates potential issues like unaffected registers and input values that might be global
• FindSharedReturnFunctions.java finds potential places where the function is jumping to another function to share a return. If you do not fix these, the function analyzer and decompiler will merge the two functions
• FindInstructionsNotInsideFunctionScript.java identifies code that is not in functions yet
• CreateFunctionsFromSelection.java allows user to quickly make functions recognized by user when analysis does not find them all, etc.

Notes:

Notes:

• The CodeBrowser is the default tool, created by configuring Ghidra plugins in a way that makes it useful for disassembling, navigating, and documenting assembly code. It has been configured to provide all the basic functionality needed to reverse-engineer a program.
• To configure more plugins into a particular tool, such as the CodeBrowser, use the File->Configure action.

Notes:

• F1 Help There is extensive help that explains each action in Ghidra which can be obtained by hovering on an action and pressing the F1 key. F1 also works on any open window. The entire searchable HELP document can be obtained in Ghidra by clicking on Help->Contents
• F4 Set Key bindings Within a tool, you can give each lowest level action a key binding or change the default key binding. In order to do this, hover on an action and hit the F4 key. An alternative method is to go to Edit->Tool Options to find a list of all key bindings and then edit from there
• Undo Within the CodeBrowser and other similarly configured tools, each action, no matter how big or small, can be undone or redone by clicking on the curvy arrows at the top of a tool. Hover on the arrows first to see what action you are undoing/redoing. The Undo history is cleared after a save
• To close a tool either click the X at the top right of the tool or use the File->Close Tool action.
• To exit Ghidra, choose File->Exit Ghidra from any tool or the Project Manager or click the X at the top right of the Project Manager.
• NOTE: You do not need to close your tools before exiting Ghidra. In fact if you want to pick up where you left off, do not close your tools. Simply exit Ghidra and your state will be saved and when you reopen your tools, cursor location, etc.. will be as you left them.
• Main menus and sub-menus in general are used for global actions. The right-click menu is context-sensitive, which means that different actions are available on the right-click menu depending on what item your mouse is on.
• If there is no selection, many actions act only on the current cursor location. When there is a selection, these actions will act on an entire selection.
• Common Windows Menu icons The last several icons on the icon bar correspond to some of the common items in the Windows menu: Bookmark manager, ByteViewer, Function Call Tree, Data Type Manager, Decompiler, Function Graph, Script manager, Memory Map, Register Manager, Symbol Table, Symbol References, Symbol Tree. These will be covered separately later.
• Themes You can change the look and feel of Ghidra to include colors, fonts and such using themes. To do so, choose Edit->Theme... from the Project Manager window. You can switch to a new theme (for example Dark Theme), configure the current theme, create a new theme, import an existing theme that someone else created, export a theme you created, or delete a theme.

Notes:

• Selections:
• Show up in green in the tool
• Are temporary. If you click in Listing, they go away.
• Searches and selections act on current selection unless changed
• Can be created manually by click and drag, click and shift-click for a range, click and ctrl-click and drag for disjoint ranges
• Can be created using Select menu. (All undefines, all data, all instructions, current function, flow, etc.)
• Can be created using any table by selecting row(s) and doing right-click->Make Selection
• Highlights:
• Show up in yellow in the tool
• Are semi-permanent selections. The selection stays until you clear it using Select->Program Highlight->Clear
• If you want to create Highlights use Select->Program highlight->Entire Selection, Add Selection, or Remove selection

Notes:

Notes:
Below are directions for using the Field Editor.

1. Use the Edit the Listing Fields icon in the top right of the Listing to toggle open or to close the field editor.
2. Field groupings are different depending on what area of the program your cursor is on. Examples of different fields include: Code/Data, Open Array or Structure, and Function Signature.
3. When the cursor is on the current field, the field will be highlighted in the field editor.
4. Use the mouse to move or resize the fields. Notice their counterparts in the Listing also move and resize at the same time.
5. Use the right click menu to choose from a variety of options including: enable, disable, add, or remove fields.
6. Disabling a field will leave the space but remove the content from the listing view.
7. Removing a field will remove the space and the content from the listing view.
8. You can add new rows, spacers, and other field types.
9. You can reset back to the default if you wish.

Notes:

• Most windows are considered docking windows which means they can be relocated to other parts of the tool.
• If you want to dock window, click on the title bar of window so that it turns blue.
• Drag the window to the top, bottom, right, or left edge of another window. When you see a black arrow then drop the window and it will now be located above, below, to the right or to the left of the other window.
• Drag the window so that it is overlapping another window. When you see overlapping boxes, drop the window and it will be tabbed on top of other window. Clicking on the tabs below the window will determine which window is visible.
• You will see a circle with a slash if you cannot drop the window.
• You can drop the window outside the tool and it will still be functionally connected to the tool.
• NOTE:If you want to dock a window that is not already docked, you need to click and drag using the inner bar that contains the title of the window. It will turn blue when you click on it. The reason disconnected windows have extra items on the top is so that users can easily access menus and icons.

Notes:

• To edit options in any tool use the Edit->Tool Options menu item in that tool. This will open the Edit Options Dialog
• There are hundreds of options within the Edit Options dialog. Users can use the filter option or folder tree to find the option needed within the dialog's subwindows. For more information about a particular subset of options, hit F1 while in that particular Edit Options subwindow.
• Ghidra does not need to be restarted for edit options to take effect. Users can just hit apply in the Edit Options Dialog to have them take effect.
• The modified tool state can be saved to the current tool or to a new tool with a new name and/or icon. To save the tool state, go to File->Save Tool or File->Save Tool As... Another alternative method to save your tool state is to exit Ghidra and your tool state will be automatically saved to the current tool.
• Tool can be exported then imported for others to use. In order to export a tool, go to File->Export Tool... from any tool and Tools->Import Tool... to import any tool from the Project Manager.
• Tool states are saved in your project and will come back the same way when you reopen Ghidra.

Notes:

Notes:

Notes:

• Below are notes about different ways to navigate.
• Navigation History arrows and pull down list - users can navigate in order to addresses visited before or use the pull down lists to choose one.
• Selection/Highlight Arrows
If there is a selection (green) or highlight (yellow) these arrows will allow navigation to different ranges of the selection or highlight.
• Navigation Buttons The blue up/down arrow toggles direction forward/backward for all of the following buttons:
• I navigate to the next range of instructions
• D navigate to the next range of data
• U navigate to the next range of undefined bytes
• L navigate to the next label
• F navigate to the next function
• notF navigate to the next range of instructions not in a function
• notV navigate to the next range of bytes not equal to the current byte value
• B navigate to the next bookmark (pull down arrow to change to a specific bookmark type)
• Navigation Markers
• The markers show up in the right margin for the current overall view. The view is determined in the Program Tree window by the small red flag.
• Click on a marker to navigate to that location in the program.
• Right click on the margin to see the various types of navigation markers. You can select/deselect what is shown in the margin from the right mouse menu.
• Below, are a few examples of the different types of Navigation Markers.
• Orange Analysis Bookmarks
• Black Changes since last save
• Purple User Bookmarks
• Green Current Selection
• Yellow Current Highlight
• Red Error Bookmarks
• More Navigation Marker Panels
• There are two more panels that have navigation markers. When opened, they appear as new marker bars to the right of the main navigation bar. To open them, click on the pull down arrow in the Listing icon bar and choose:
• Show Overview
This navigation bar shows different colors for the following items: Functions, Uninitialized memory, External References, Instructions, Data, Undefined bytes. Right-click->Show Legend on the bar to see the colors mapped to the various items.
• Show Entropy
This navigation bar shows different colors corresponding to entropy scores which can indicate areas of uniform byte values, ASCII, UTF16, code, or compression.Right-click->Show Legend on the bar to see the colors mapped to the various items

Notes:

• If you have the external program imported into your project and the external references have been created, you can click on the external reference and navigate to the external program. If the program is not open, it will be opened and tabbed in the Listing next to the current program.
• To create external references:
• Automatically: Choose Load External Libraries in the File->Import File... Options dialog.
• Manually: Right-click on the place you want to create the reference in the Listing and choose References->Add/Edit then click on the green plus button then choose the External button. All references from one external library will be created if you do this for one of them.

Notes:

• All tables have the following basic features:
• Navigation You can navigate by address or label column. Just click on the value in the column to start navigation.
• Sorting You can sort by any column, ascending or descending. To sort, click on the top of the column and you will see a stair step indicating ascending or descending. Then click to reverse. You can sub-sort by doing Ctrl-click on the other secondary columns
• Filtering/Filter Options You can type the filter value in the bottom text box and press enter. The filter option has a default setting that will filter out any row that does not contain the text in the filter unless you change the default option using the Filter Settings button to the right of the filter. Other filter settings include: Starts With, Matches Exactly, Regular Expressions, Case Sensitive, Inverting the filter, and Multi-Term Filtering. There is also a Create Column Filter button which will allow for more complex filtering on a specific column or using set operations on multiple column filters.
• Add/remove columns You can right-click on any column and choose to remove it or add a new column next to it.
• Move columns You can move columns by clicking, dragging, and letting go of the click where you want the column to end up.
• Column settings Some columns have special settings you can change using the right-click menu.
• Selections You can make selections in the listing by selecting row(s) from the table and choosing Right-click->Make Selection.
• Copy You can select rows and copy text to paste in any editor (notepad, Ghidra comment, etc.).
• Export to CSV Text file You can export a table selection to a Comma Separated Value text file.

Notes:

Notes:

• Instruction Manual Right-click on any instruction and choose Processor Manual from the menu. If the manual is in your installation, your default web browser will open the manual to the first page containing that instruction if it allows page numbers. If not, the first page of the manual will open. If the manual is not in your installation, a window will open with a link to the manual and tell you where to put the manual in the installation.
• Info Fields at bottom of Browser: The Little window with basic assembly shows what the original assembly looked like before Ghidra marked it up. The current address window shows the address of the cursor and the function name.
• Hover: Use hover by placing the mouse over all items with references and all data types to bring up a temporary window with a referenced item or data definition. The hover window stays visible as long as the cursor is in the window.
• Cursor text highlight: Click on any text in a Listing field with the middle mouse button. All matching text in the listing will be highlighted in yellow. By default, there is different behavior when middle-mousing on a register. Every matching register or sub-register in the current scope of the register will be highlighted in green. The register's initialization within the current scope will be highlighted mustard yellow. Every matching register or subregister outside the current scope of the register will be highlighted in yellow. You can change the colors or the default behavior of this feature by going to the Edit->Tool Options...
• Snapshots: You can make as many snapshots of the Listing and other windows as you would like. Snapshots have a yellow ring around them and you can dock them anywhere just like any docking window. Snapshots have full functionality of the original window, but are different because Snapshots don't track with the Listing. Snapshots are valuable because you can see more than one view of different areas of code at the same time.
• References and Decompiler are described more fully in future slides.

Notes:

• XRef Field This Listing field contains a list of all addresses that reference the current address/item. Each item in the XREF field has a type indicator next to it.
• XREF Header This is located above the XRef Field and shows how many references there are to the current address/item. You can double click the XREF Header to bring up a table of all of them.
• References->Show References To Another way to bring up a table of references is to click on the item and choose References->Show References To.
• Edit/Create References To edit/create references, right-click on an operand or instruction and choose References->Add/Edit. Use the green + to add a reference. Choose the type of reference you wish to create: memory, external, stack, or register. Fill in the appropriate text boxes with address, offset, and external location. The text boxes may vary depending on the type of reference you pick.

Notes:

• Labels and Comments are ways for a user to annotate what is happening in the code or data.
• Below are basic steps for editing/creating labels and creating comments. We will discuss more after the next exercise.
• To create a label, click on an address and choose the L key or right-click the address and choose Add Label....
• To edit an existing label, click on the label and choose the L key or right-click the label and choose Edit Label....
• To create a comment, click on any field in a code unit and choose the ; key or right-click and choose Comment-> then choose the type of comment you wish to create.
• There are five types of comments:
• EOL comment Shows up at end of current line.
• Plate comment Shows up above current line surrounded by box.
• Post comment Shows up below current line.
• Pre comment Shows up above current line.
• Repeatable comment Shows up anywhere the current address is referenced.

Notes:

Notes:

Notes:

• To open a Decompiler Window go to Window->Decompiler or use the appropriate icon on the CodeBrowser icon bar.

Editing using the decompiler

• The decompiler usually gets things right but if necessary, you can edit parameter, local variable, and return types and names, function signature options, structure members and names, etc.
• Edits to these items in the Listing or Decompiler will also be reflected in the other window.
• You can edit these items individually by clicking on them in the Decompiler or Listing and choosing the appropriate action from the right mouse menu.
• OR you can edit several at once by editing the function signature. To do this right-click on the function signature and choose Edit->Function... from the Listing or Edit->Function Signature... from the Decompiler. In general, users should change function signatures called by multiple places instead of changing local variables in each individual function that is called. The local variable types will automatically update when related function signatures are changed.
• The more information you can fill in about data types, especially structure information, the better the decompiler output will be. It is most important to get the correct number of parameters even if you do not know the types yet. If you have associated header files that you can pull in information from, it will allow the decompiler to propagate that information into the calling functions.

Notes:
Decompiler Parameter ID

• This is an auto-analysis option that runs through the program and locks what the decompiler figures out throughout the program. Any future changes to other functions or data that would have affected that function will not be considered. Use this option only if you have rich data type information first, such as Windows known library calls and known DLL calls with parameter and return types applied during the import process or before running analysis with this option.

Automatically Create Structures

• If you suspect a variable is an undefined structure, you can have the decompiler try to figure out the structure definition for you by right-clicking on the variable and choosing Auto Create Structure.

Commit Parameters and Locals

• This options does the same thing as Decompiler parameter ID but is done individually and manually by the user
• Can do separately to parameters/returns or local variables
• CAUTION: Only use this feature if you want to lock the decompiler output instead of adjusting to program changes.

Following Variable Usage

• Middle-mouse click simple-text-match highlighting similar to Listing Cursor Text Highlight on non-registers
• Highlight Def-use highlights where the current variable is used and defined, similar to Listing Cursor Text Highlight for registers
• Forward Slice highlights each variable whose value may be affected by the value in the current variable
• Backward Slice highlights all variables in the function that contain a value involved in the creation of the current variable.

Export current function

• This feature allows the user to export the current function to a text file.

Notes:

• If you see a function that isn't getting the correct number of parameters or types, you can fix it by applying specific data types to the parameters or adding/removing the parameters. However, adding/removing the parameters forces the decompiler to use your information everywhere that the function is called. Be careful because this can be good if you get it right or bad if you get it wrong.


• Users should change function signatures called by multiple places instead of locals in each individual function that is called. However, in some special cases, such as functions with variable numbers of arguments, you can override a signature from the call. Use the Override Signature action from the right mouse menu in this case only.


• Examples of read-only memory include indirect pointers to data and global values in memory used as constants.


• If the decompiler thinks the pointers are not constant, then it won’t follow them to the data they are referencing.

Notes:

Notes:

• More information about labels:
• Labels can have more than one label at an address.
• Primary labels show up in references by default, you can change which label is primary using Edit Label... action.
• To add another label, right-click on the address and choose Add Label....
• Global variables exist in the whole program and can only have one unique name
• Local variables exist in a namespace and can have more than one of the same name. Labels inside a function are, by default, in that function's namespace. The namespace can be changed using the right-click->Edit Label... action.
• The function name in the function signature is the same as the primary label at that address. You can add secondary labels at the function entry point address but only the primary label is reflected in the function signature name.
• Use right-click->Show Label History to see how the label has changed and who changed it.
• Use Search->Label History to find an old label name that does not exist in your program anymore.

Notes:

• Annotations To add comment annotations using the comment editor, use the pull-down menu, choose an annotation type, and then click the Add Annotation button.
• Address Fill in the interesting address. The comment will display the given address as a hyperlink. Double-click the link to navigate to that address.
• Execute Fill in path to an executable. Double-click the resulting link to launch the specified executable in your OS with given optional parameters.
• Program Fill in existing Ghidra program name (case-sensitive) to displays a hyperlink to the given Ghidra program name. Double-click the link to open the program in a new Listing tab. Optionally use the @symbol name after the program name to go to a specific symbol in the program.
• Symbol Fill in the address of the interesting symbol. The comment will display the given symbol as a hyperlink. Double-click to navigate to the symbol. Changes to the symbol in the Listing will automatically change the comment to display the new symbol.
• URL Displays the given URL as a hyperlink. Double-click to open what the link is pointing to. References to ghidra://, which refer to a program within a Ghidra Server repository, will be opened within the Listing display, while all other URL protocols (e.g., http://, https://, file://, etc.) will be launched via an external web browser. See HELP command configuration for Processor Manuals for more information.

Notes:

• This course only covers the basics of data types. More information is covered in the intermediate class.

Applying Data Types:
• You can apply a data type to a single address or a selected range of addresses. If you apply a data type to a selection, that data type will be applied contiguously until it reaches the end of the selection. You can also apply a data type to a parameter or a local variable.

Notes:

• The Data Type Manager normally resides in the lower left corner of the CodeBrowser. If it is not there, open it using Window->Data Type Manger.
• There are different folders for each of the following Data Types:
• BuiltInTypes
• Contains Data Types created by the Ghidra development team
• Program Data Types
• Contains Data Types that have been applied to the current program
• Contains Data Types created by the user
• Prebuilt Data Types
• There may be more than one folder of this type
• Contains data types parsed from data definition files
• Your Own Data Archives
• Users can create their own data archives so they can use their data in multiple programs or projects
• These Archives can be stored on the File System (File Archive) and shared by multiple projects or they can be stored in the current project (Project Archive) and be shared by all programs in the current project
• To find the data types you are looking for, you can:
• Filter
• Open Folders
• Pull down menu to find by size or name
• To apply data, click on the data type and drag it to a:
• Single address
• Selection
• Parameter/local/return types

Notes:

• There are two ways to apply a data type from the right-click menu.
• First, click on an address or select a range of address where you want to apply the data type.
• Then choose either:
• Right-click menu Data->Choose Data Type... then browse or start typing the name of the data type you want to apply.
• Right-click menu-> then choose a data type from the list of your "favorite" data types which can be customized in the Data Type Manager by toggling the Right-click->Favorite action.

Notes:

• When applying data in cycle groups, click on an address or select a range where you want to apply the data type.
• Use the Right-click->Data->Cycle Groups or the following shortcut keys to cycle through the following data types:
• B (byte, word, dword, qword)
• " (char, ascii string, unicode string)
• F (float, double)

Notes:

• In order to use Markup Clearing, you need to select the item(s) you want to clear and choose one of the following Markup Clearing options from the right-click menu:
• Clear Code Bytes This option clears the defined code or data and leaves labels, comments, etc. alone
• Clear with Options... This allows you to choose which items you want to clear (symbols, comments, code, functions, references, bookmarks, etc.)
• Clear Flow and Repair... This allows you to clear and repair code which was produced in error. Click on the first bad instruction, and then invoke the action.

Notes:

• The Convert action only appears on the right mouse menu if the cursor is on a constant operand. It only works on the current scalar.
• The Set Equate... action only appears on right mouse menu if the cursor is on a constant operand. It works on the current scalar and if there is a selection on all matching scalars in the selection.
• To group Equates or Enums into a single Enum in the Data Type Manager, use the filter to group them (if possible), select them using click and drag, then do right-click->Create Enum from Selection.
• The Apply Enum... action allows users to apply the enum names to multiple matching values in an instruction or selection of instructions. It only appears on the right mouse menu if the cursor is on a constant operand (no selection) or there are are constant operands in the current selection.
• Applying Equates and Enums to the Listing will rename most in the decompiler, however...
• PREFERRED METHOD: To apply Enum names to the decompiler view, find a variable being assigned or compared to the constants then do right-click->Retype variable or right-click->Retype global. Make sure that the Enum size (1,2,4,or 8 bytes) matches the size of the variable in the decompiler or it will not display the names.

Notes:

Notes:

• Bookmarks
• To create a bookmark, right-click on an address and choose Bookmark from the right-click menu. Then fill in a Category (optional) and description. If there is a current selection, bookmarks will be made at the top of each selected range. A purple checkmark will be placed at each bookmark location.
• Bookmarks show up in individually in left margin if in your current visible portion of Listing or in right margin as marker margin color if in the current Listing view.
• If you would like to see a list of bookmarks, open the Bookmark manager in Window->Bookmarks. The bookmark table you will see allows filtering by text and/or by bookmark type.
• Types of bookmarks:
• User notes (purple check symbol) shows bookmarks the user has added
• Analysis (blue bolt symbol) shows bookmarks that auto-analysis added to describe what analyzer created the code/data at that location
• Information (white circle with I in the middle) is added by importer to describe what items the importer identified in the import process
• Error (red x symbol) shows bookmarks used to indicate an unknown opcode, can be caused by bad auto analysis disassembly or bad user disassembly
• Warning (yellow triangle) shows bookmarks used to indicate a possible problem

Notes:

Notes:

• Ghidra allows users to export a selection or an entire program to the following formats:
• Ghidra Zip file (GZF) uses custom format to compress all information contained in a Ghidra program so that users can share program information.
• XML Used to export information about the current program, to other tools if an importer has been written to recognize it in the other tool. There is potential loss of information due to inconsistencies between tools. NOTE: An exemplar IdaPro set of plugins/loaders are included in ghidra_/Extensions/IDAPro. Also included is an IdaPro export plugin that creates XML that Ghidra can import.
• HTML exports selection or entire program as navigable html
• Raw Bytes exports selection or entire program as binary. This does not preserve the original file layout unless there was only one memory block in the original file.
• Intel Hex exports selection or entire program as Intel hex format
• C exports selection or entire program as C code (Including corresponding .h file)
• Ascii exports selection or entire program as printable Ascii file
• Original File Writes a program back to its original file layout. By default, any file-backed bytes that were modified by the user in the program database will be reflected in the new file. Optionally, the program can be written back to its unmodified file bytes, discarding all user modifications.
• SARIF Creates SARIF files that contains information from a Ghidra program so that users can share program information.

Notes:

• The Program Tree is normally open in top left of the default Codebrowser OR to open go to Window->Program Trees.
• Program Tree Basics:
• Structure of Program:
• Program Tree can either be created by the import process's read of the program header OR by the user when he/she imports and splits the program into different code/memory blocks.
• In the Program Tree you can:
• Create folders and fragments
• Select code/data/undefined selection and drag it onto a folder or fragment.
• Items can only exist in one fragment but the same fragment can exist in multiple folders
• Program still exists in same address order but your visualization of it is rearranged in this tree
• Make multiple program trees each with different organizations of the program. Create a new tree by clicking on the new tree icon in top right of the Program Tree
• Changing Current View
• Red flag indicates the view currently contained in the Codebrowser Listing
• Double-click on fragment/folder changes view to that fragment/folder
• Track the Listing
• Click on the icon with a green arrow in the top right of the Program Tree and the segment containing the current location in your Listing will be selected.
• Multiple Trees:
• To make a new Program Tree, click on the icon with a '+' on it in the top right of the Program Tree window.
• To rename a tree, right-click on its tab and choose Rename from the right mouse menu.

Notes

• NOTE:Create a new Program Tree every time you modularize. The Modularization actions do not work effectively on already modularized trees.
• In the Program Tree, right-click on a CODE segment and choose Modularize By->:
  • Subroutine-> This breaks code into segments by a chosen subroutine model.
  • Complexity Depth This groups functions into folders Level 0 to n, where Level 0 contains the entry function(s), Level 1 contains functions called by entry functin(s), and so on. Level n contains functions that do not call any other functions within the current program but may call external functions.
  • Dominance This groups functions in folders according to which functions dominate other functions. Function A dominates Function B if every path from the entry to Function B must go through Function A.

Notes:

• To open the ByteViewer window go to Window->Bytes:
• Byte Viewer allows you to view and edit program bytes in various formats. Byte Viewer navigation tracks the Listing and vice versa.
• Byte Viewer Basics Information:
• To Edit:
• Enable editing using pencil icon.
• If editing code bytes, clear them in the Listing before editing then redisassemble. No need to clear if editing data bytes.
• Edit in whatever Byte Viewer field makes most sense (i.e., if you want to change ascii, type in the ASCII field, hex in the hex field, etc.)
• Fields can be added using the wrench icon:
• Choose from Hex, Binary, ASCII, Octal, HexInteger, Address, Integer, or Disassembled
• ASCII Shows ASCII or '.'; if non-ASCII value.
• Disassembled Shows '.' if disassembled code or defined data. Shows box if undefined.
• Address Shows a black circle if bytes at a specific location represent a valid address in the current program space. Shows '.' if bytes do not represent a valid address.

Notes:

• To open the Search Program Text dialog go to Search->Program Text
• Allows users to search for any markup text put there by Ghidra or the user including: comments, labels, fields, etc.
• Can search all fields or narrow to specific field(s).
• Can use Next/Previous buttons to navigate to one found instance at a time or use the Search All button to bring up a table of all found instances.

Notes:

• To open the Search Memory dialog go to Search->Memory...
• This dialog allows users to search for byte(s) contained in program memory
• Can limit to a selection
• Can enter search value as hex, string, decimal, binary, float, double or regular expression.
• There is an options panel which allows you to set various options such as endianess, alignment, size, signedness, encoding, case sensitiveness, and whether bytes are in instructions, defined data, or undefined data and whether in loaded memory blocks or other types of blocks.
• Using regular expressions in search memory allow a more flexible byte pattern search such as searching for two numerical digits followed by three ASCII characters without knowing the exact values.
• After doing one search, the user can use the New Search pull down to perform set operations between the first search and a follow-on search.
• There is a scan panel that can be used to rescan the bytes in the current search results table to see if any of the found bytes are the same, have changed, have increased, or have decreased.

Notes:

• To open the Search for Strings dialog go to Search->for Strings...
• Allows users to search for potential strings found in all or selected portion of memory.
• By default searches for null terminated ASCII and unicode.
• Can choose to search for Pascal instead.
• Can change the minimum length of found strings.
• Can have it report only strings found on certain alignment.
• Result Table has following columns::
• Address of found potential string.
• Label if there is a label there.
• Code Unit to shows what is already defined at that location (data/instruction).
• ASCII to show what the string would look like if it were created.
• String Type to show what kind of string was found.
• Make Strings Panel:
• Can be toggled open or closed
• Can select multiple rows in the table.
• Allows user to choose whether to auto-label the string (s_stringname, u_ for unicode, p_ for Pascal).
• Creates the correct type of string.
• Can change the offset of the beginning of the string if there are ASCII chars at the beginning that do not belong in your string.
• Can have it include alignment nulls at the end of the string. The number of nulls included is based on the alignment value chosen.
• There is a similar string search that allows you to search for strings with other encodings beyond the simple string search. To run it choose Search -> for Encoded Strings... It is similar to search for strings but will show strings using the given encoding. You can also choose to limit the search to a specific script (ie alphabet), translate the found strings, and more. Do F1 on this action to get more detailed information.

Notes:

• To open the Search for Direct References dialog use Search->For Direct References
• Allows users to find places in memory where the bytes form the current cursor address or selected addresses
• Can run search for direct references on one address or a selection of addresses
• In Ghidra, a direct reference is considered to be a reference that uses bytes representing an address to reference that address. For example, in the instruction CALL 12345678, if you look in the bytes field for that instruction you can see the bytes 12 34 56 and 78 (or 78 56 34 and 12 in little endian code), that would be a direct reference to address 12345678

Notes:

• To open the Search for Address Tables dialog go to Search->For Address Tables...
• Allows users to find runs of direct references to addresses
• Can run this on one address or a selection of addresses
• Can change the minimum length of the found table
• Can have it report only tables found on certain alignment
• Can specify a length to skip between valid direct references
• Can create Address tables directly from the table using the Make Table button which will create a label and address data type for each item in the table
• If it is determined that the table values all point to code, you can kick off disassembly at each address referenced by the table with the Disassemble button.

Notes:

• There are two actions that allow you to search for Instruction patterns. Both work on either the current instruction or a selection:
• Search->For Matching Instructions-><option> where option indicates whether to:
• Exclude Operands
• Include Operands
• Include Operands(except constants)
• Search->For Instruction Patterns... which brings up a dialog that allows you to choose the exact instruction pieces to look for and which to omit

Notes:

• To use Search for Scalars:
• Search->for Scalars... then fill in range or specific scalar in hex or decimal (use 0x prefix for hex)

Notes:

Notes:

• To open the Symbol Table window go to Window->Symbol Table
• Fields in the Symbol Table contain the following information about symbols:
• Type of Symbol:
• Function label
• Data label
• Instruction label
• Parameter name
• Local Variable name
• Number of references:
• Number of references to the symbol
• Number of off-cut references:
• Number of references in the middle of the code or data at the location of the symbol
• Namespace:
• Displays the namespace that the symbol belongs to or Global if it is defined in the whole program
• Source of Symbol:
• Default FUN_, LAB_, DWORD_etc.
• User Defined User names it
• Imported Named by importer
• Analysis Named by auto-analysis
• The Filter Dialog allows filtering on numerous items such as symbol source, symbol type, etc.

Notes:

• You can bring up the Symbol Table Reference Window using Window->Symbol References. This window lists and shows information about the currently selected symbol in the Symbol Table.
• Different modes in Symbol Table Reference Window include:
• S (default mode) Shows all references to the selected symbol, a preview of the reference and the type of reference
• I Only works if the selected symbol is a function. Shows a preview of all navigation instructions contained in the selected function.
• D Only works if the selected symbol is a function. Shows preview of all data references contained in the selected function.

Notes:

• To open the Symbol Tree Window go to Window->Symbol Tree

Notes:

• To open the Data Type Preview Window go to Window->Data Type Preview
• The window changes what is displayed based on where you click in the Listing
• The bytes at the address are displayed in the various formats in the table
• You can add or remove data types using the + or the X
• To open the Disassembled View Window go to Window->Disassembled View
• The window changes what is displayed based on where you click in the Listing
• The bytes at the clicked address are displayed as they would look if they were disassembled code

Notes:

• To open the Defined Data Window go to Window->Defined Data
• This table lists all defined data in the current program
• To open the Defined Functions Window go to Window->Functions
• This table lists all functions in the current program
• Note: One cool thing you can do with this table is select a subset of the functions and choose Compare Function(s) to see a side by side comparison view of the functions that you chose. For more info about this table, hit F1 while it is open.
• To open the Defined Strings Window go to Window->Defined Strings
• This table lists all defined strings in the current program
• To open the Defined Equates Window go to Window->Equates Table
• This table lists all applied equates in the current program

Notes:

• To open the Script Manager go to Window->Script Manager
• Unlike plugins that stay around once they are configured, scripts are meant to be one-shot actions.
• To run a script, select it in the script manager and either double-click the table entry or click the green circle icon.
• Script messages appear in the console.
• The console is "smart". If it recognizes a label or address, you can click on it in the console to navigate in the Listing.
• The Intermediate Ghidra class covers detailed information about scripts such as how to:
• Customize your script directories
• Add scripts to menus
• Make key bindings for scripts
• Edit existing or develop new scripts

Notes:

• To open the Function Graph window go to Window->Function Graph.
• There is a Satellite View inset window at the bottom right of the window. If it gets in your way, you can right-click on the Function Graph canvas window and deselect its option.
• If you hover on an edge, it will present a popup window showing you the branch/jump statement, and the code at the target destination. This can obscure a large portion of your window. If you would like to turn it off you may from the right-click menu.
• If you desire, the edge colors can be changed on the tool options screen.

Notes:

• The focused block is the block containing the current cursor location in the listing. The block (node) in the graph surrounded by a yellow highlighted oval is the focused block.
• The focused block always contains the current cursor location in the program; however, it does not mean the cursor location is at the top of the block. If you click on a block, the cursor is placed at the top. But if you navigate using the listing or decompiler or other window, your current location can move to a place within the block (but not at the top). If you navigate the current location outside the current block, the focus will follow and the new block containing the current location will be highlighted.
• You will learn more about what focus is useful for (besides a visual indicator of location) in a few slides.
• The hovered block is the block that your mouse is currently over. You will also learn more about this in a few slides.


• NOTE: When double-clicking on an edge to navigate blocks, note that you are actually taken to the block furthest away from your current canvas position. Usually that results in the behavior described in the slide; you double-click on an edge coming out of a block, and you are taken to the destination of the jump. But if you see an edge "out in space" (i.e., you don't see its source or its destination block), remember it will take you to the block that is furthest away, which might not be the destination block the first time you double-click it.

Notes:

• Your monitor might report strange values for its actual resolution, which will confuse Java as to the point when preview rendering should occur. Your preview rendering then might just look like little dots you cannot read! This is not very useful, so zoom in a little more.

Notes:

Notes:

Notes:

• There are two pull-down menus in the Graph Window Icon Bar. Each mode contains almost the same set of options that are explained in the next several slides. The difference is in how they are enabled and displayed in the graph:
• Hover mode
• Enabled when placing the cursor over a block without clicking
• Shows "ants marching" on links
• Focus mode
• Enabled when clicking on a block
• Shows bold links

Notes:

• For those unfamiliar with dominance in graph theory, the basic idea is that some nodes are more "important" than others because they act as dispersing or condensing "gateways" for flow.
• Show Scoped Flow From Block will encompass all blocks in the flow after the principal block that can ONLY execute if the principal block executes. In other words, if control never makes it to the principal block, none of the neighborhood blocks will execute.
• Show Scoped Flow To Block will encompass all blocks in the flow before the principal block, such that all blocks in the neighborhood MUST have executed if the principle block executes.

Notes:

Notes:

• In a function graph focus, you are presented with a normal task dialog when all loops are being computed. If you cancel, it will ask for confirmation and then display the results as far as it was able to get. For most functions, this is pretty close to the right answer but it still might have missed one or two small loops, depending on the complexity of the function.

Notes:

Notes:

Notes:

• To group vertices use Ctrl button with right-click and drag to make a box around group of vertices then right-click and choose Group Selected Vertices. Enter new name and hit ok to collapse into one node.
• To expand back into original vertices, right-click on the grouping and choose Ungroup Selected Vertices.

Notes:

• To open the Function Call Tree either right-click in a function and choose References->Show Call Trees or choose the corresponding icon in the CodeBrowser icon bar.
• By default the Function Call Trees show all calls in address order to or from the current function. There is an option to collapse any duplicates and show each call once.
• Optionally toggle whether Listing navigates to currently selected function.
• Optionally toggle whether Function Call Trees updates when navigating to new function in Listing.
• There is an option in the black triangle pull down to show or not show thunks to functions in the tree.
• There is an option in the black triangle pull down to show or not show the namespace of the function names in the tree.

Notes:

Notes: