Ghidra

Ghidra lets you open an executable without its source code and turn the machine code back into a readable form. For practice, use a small program that you wrote and compiled yourself, so you can check the results against the source.

This review is for people who have written simple programs in a language such as C and want to see what they look like after compilation. After reading it, you can do the following:

• Install and start Ghidra
• Import a program you compiled and run auto-analysis on it
• Compare the decompiler output with your original source code

##What Ghidra is for

Ghidra is a reverse engineering framework created by the Research Directorate of the US National Security Agency (NSA) and released as open source. The official README lists disassembly, assembly, decompilation, graphing, and scripting among its features. It analyzes compiled code for Windows, macOS, and Linux, and supports many processor instruction sets and executable formats.

You usually work in the GUI, but there is also a headless mode for batch analysis from the command line. You can write your own scripts and extensions in Java or Python.

##Requirements

The Getting Started document (as of Ghidra 12.2) lists these requirements:

##Try it safely with your own program

1. Install JDK 25 (64-bit).
2. On the official releases page, open “Assets” and download the file named ghidra_<version>_PUBLIC_<date>.zip. The “Source Code” files are not the release.
3. Extract the zip file anywhere you like. There is no installer, and you don’t need administrator rights. Don’t extract it on top of an older installation.
4. In the extracted folder, run ghidraRun.bat on Windows or ./ghidraRun on Linux and macOS. If Ghidra can’t find a JDK, it asks you for the JDK folder.
5. Write a small program for practice, such as a C program that prints a string, and compile it.
6. In Ghidra, choose File>New Project and create a project.
7. Choose File>Import File… and import the compiled file. The default file format is usually fine.
8. Open the imported file. The CodeBrowser tool starts and asks whether to run auto-analysis. Let it run.
9. In the Symbol Tree, select a function such as main. The Decompiler window shows C-like output. Compare it with your source.

When you are comfortable, move on to material that explicitly allows analysis, such as CTF practice challenges.

##Main windows and features

By default, the CodeBrowser shows these windows:

You can run auto-analysis again later from Analysis>Auto Analyze. Ghidra can also search for strings in the program, which helps you find where a message is displayed.

##Cautions

##Read next

• cd ../mobsfMobSFchecks the security of your own mobile apps
• cat ~/guides/lab-setup.mdHow to set up a safe test lab