Read more
A guide to using the Ghidra software reverse engineering tool suite.
The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency''s most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world''s most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere -- and
In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra''s components, features, and unique capacity for group collaboration. You''ll learn how to:
Designed for beginner and advanced users alike,
List of contents
Acknowledgments
Introduction
Part I: Getting Started
Chapter 1: Introduction to Disassembly
Chapter 2: Reversing and Disassembly Tools
Chapter 3: Meet Ghidra
Part II: Basic Ghidra Usage
Chapter 4: Beginning Your Analysis
Chapter 5: Exploring Ghidra's Data Displays
Chapter 6: Making Sense of a Disassembly
Chapter 7: Refining a Disassembly
Chapter 8: Working with Data Types and Data Structures
Chapter 9: Understanding Cross-References
Chapter 10: Using Graph Views
PART III: Customizing and Extending Ghidra
Chapter 11: Using Ghidra Collaboratively
Chapter 12: Customizing Ghidra
Chapter 13: Extending Ghidra's Worldview
Chapter 14: Basic Scripting with Ghidra and PyGhidra
Chapter 15: Integrated Scripting with Eclipse and GhidraDev
Chapter 16: Running Ghidra in Headless Mode
Part IV: A Deeper Dive
Chapter 17: Loaders
Chapter 18: Processors
Chapter 19: The Decompiler
Chapter 20: Compiler Variations
PART V: Real-World Applications
Chapter 21: Obfuscation and Emulation
Chapter 22: Patching Binaries
Chapter 23: BSim and Other Comparison Tools
Appendix: Ghidra for IDA Users
About the author
Kara Nance is a private security consultant. She has been a professor of computer science for many years. She has served on the Honeynet Project Board of Directors and given numerous talks at conferences around the world. She enjoys building Ghidra extensions and regularly provides Ghidra training.
Chris Eagle has been reverse engineering software for 40 years. He is the author of The IDA Pro Book (No Starch Press) and is a highly sought-after provider of reverse engineering training. He has published numerous reverse engineering tools and given talks at conferences such as Blackhat, Defcon, and Shmoocon.
