The Ghidra Book: The Definitive Guide

Description

A guide to using the Ghidra software reverse engineering tool suite. The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency's most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world's most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere -- and The Ghidra Book is the one and only guide you need to master it. In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra's components, features, and unique capacity for group collaboration. You'll learn how to: • Navigate a disassembly • Use Ghidra's built-in decompiler to expedite analysis • Analyze obfuscated binaries • Extend Ghidra to recognize new data types • Build new Ghidra analyzers and loaders • Add support for new processors and instruction sets • Script Ghidra tasks to automate workflows • Set up and use a collaborative reverse engineering environment Designed for beginner and advanced users alike, The Ghidra Book will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro. Brief Contents Contents in Detail Acknowledgments Introduction About This Book Who Should Read This Book? What’s in This Book? Part I: Introduction Part II: Basic Ghidra Usage Part III: Making Ghidra Work for You Part IV: A Deeper Dive Part V: Real-World Application Part I: Introduction Chapter 1: Introduction to Disassembly Disassembly Theory The What of Disassembly The Why of Disassembly Malware Analysis Vulnerability Analysis Software Interoperability Compiler Validation Debugging Displays The How of Disassembly A Basic Disassembly Algorithm Linear Sweep Disassembly Recursive Descent Disassembly Summary Chapter 2: Reversing and Disassembly Tools Classification Tools file PE Tools PEiD Summary Tools nm ldd objdump otool dumpbin c++filt Deep Inspection Tools strings Disassemblers Summary Chapter 3: Meet Ghidra Ghidra Licenses Ghidra Versions Ghidra Support Resources Downloading Ghidra Installing Ghidra The Ghidra Directory Layout Starting Ghidra Summary Part II: Basic Ghidra Usage Chapter 4: Getting Started with Ghidra Launching Ghidra Creating a New Project Ghidra File Loading Using the Raw Binary Loader Analyzing Files with Ghidra Auto Analysis Results Desktop Behavior During Initial Analysis Saving Your Work and Exiting Ghidra Desktop Tips and Tricks Summary Chapter 5: Ghidra Data Displays CodeBrowser CodeBrowser Windows The Listing Window Creating Additional Disassembly Windows Ghidra Function Graph View The Program Trees Window The Symbol Tree Window The Data Type Manager Window The Console Window The Decompiler Window Other Ghidra Windows The Bytes Window The Defined Data Window The Defined Strings Window The Symbol Table and Symbol References Windows The Memory Map Window The Function Call Graph Window Summary Chapter 6: Making Sense of a Ghidra Disassembly Disassembly Navigation Names and Labels Navigation in Ghidra Go To Navigation History Stack Frames Function Call Mechanics Calling Conventions Additional Stack Frame Considerations Local Variable Layout Stack Frame Examples Ghidra Stack Views Ghidra Stack Frame Analysis Stack Frames in Listing View Decompiler-Assisted Stack Frame Analysis Local Variables as Operands The Ghidra Stack Frame Editor Searching Search Program Text Search Memory Summary Chapter 7: Disassembly Manipulation Manipulating Names and Labels Renaming Parameters and Local Variables Renaming Labels Adding a New Label Editing Labels Removing a Label Navigating Labels Comments End-of-Line Comments Pre and Post Comments Plate Comments Repeatable Comments Parameter and Local Variable Comments Annotations Basic Code Transformations Changing Code Display Options Formatting Instruction Operands Manipulating Functions Converting Data to Code (and Vice Versa) Basic Data Transformations Specifying Data Types Working with Strings Defining Arrays Summary Chapter 8: Data Types and Data Structures Making Sense of Data Recognizing Data Structure Use Array Member Access Structure Member Access Creating Structures with Ghidra Creating a New Structure Editing Structure Members Applying Structure Layouts C++ Reversing Primer The this Pointer Virtual Functions and Vftables The Object Life Cycle Name Mangling Runtime Type Identification Inheritance Relationships C++ Reverse Engineering References Summary Chapter 9: Cross-References Referencing Basics Cross-References (Back References) References Example Reference Management Windows XRefs Window References To Symbol References Advanced Reference Manipulation Summary Chapter 10: Graphs Basic Blocks Function Graphs Function Call Graphs Trees Summary Part III: Making Ghidra Work for You Chapter 11: Collaborative SRE Teamwork Ghidra Server Setup Shared Projects Creating a Shared Project Project Management Project Window Menus File Edit Project Project Repository Version Control Example Scenario Summary Chapter 12: Customizing Ghidra CodeBrowser Rearranging Windows Editing Tool Options Editing the Tool Special Tool Editing Features Saving the CodeBrowser Layout Ghidra Project Window Tools Workspaces Summary Chapter 13: Extending Ghidra’s Worldview Importing Files Analyzers Word Models Data Types Creating New Data Type Archives Function IDs Function ID Plugin Function ID Plugin Example: UPX Function ID Plugin Example: Profiling a Static Library Summary Chapter 14: Basic Ghidra Scripting Script Manager Script Manager Window Script Manager Toolbar Script Development Writing Java Scripts (Not JavaScript!) Edit Script Example: Regex Search Python Scripts Support for Other Languages Introduction to the Ghidra API The Address Interface The Symbol Interface The Reference Interface The GhidraScript Class The Program Class The Function Interface The Instruction Interface Ghidra Scripting Examples Example 1: Enumerating Functions Example 2: Enumerating Instructions Example 3: Enumerating Cross-References Example 4: Finding Function Calls Example 5: Emulating Assembly Language Behavior Summary Chapter 15: Eclipse and GhidraDev Eclipse Eclipse Integration Starting Eclipse Editing Scripts with Eclipse GhidraDev Menu GhidraDev > New Navigating the Package Explorer Example: Ghidra Analyzer Module Project Step 1: Define the Problem Step 2: Create the Eclipse Module Step 3: Build the Analyzer Step 4: Test the Analyzer Within Eclipse Step 5: Add the Analyzer to Our Ghidra Installation Step 6: Test the Analyzer Within Ghidra Summary Chapter 16: Ghidra in Headless Mode Getting Started Step 1: Launch Ghidra Steps 2 and 3: Create a New Ghidra Project in a Specified Location Step 4: Import a File to the Project Steps 5 and 6: Auto Analyze the File, Save, and Exit Options and Parameters Writing Scripts HeadlessSimpleROP Automated FidDb Creation Summary Part IV: A Deeper Dive Chapter 17: Ghidra Loaders Unknown File Analysis Manually Loading a Windows PE File Example 1: SimpleShellcode Loader Module Step 0: Take a Step Back Step 1: Define the Problem Step 2: Create the Eclipse Module Step 3: Build the Loader Step 4: Add the Loader to Our Ghidra Installation Step 5: Test the Loader Within Ghidra Example 2: Simple Shellcode Source Loader Update 1: Modify the Response to the Importer Poll Update 2: Find the Shellcode in the Source Code Update 3: Convert Shellcode to Byte Values Update 4: Load Converted Byte Array Results Example 3: Simple ELF Shellcode Loader Housekeeping ELF Header Format Find Supported Load Specifications Load File Content into Ghidra Format Data Bytes and Add an Entry Point Language Definition Files Opinion Files Results Summary Chapter 18: Ghidra Processors Understanding Ghidra Processor Modules Eclipse Processor Modules SLEIGH Processor Manuals Modifying a Ghidra Processor Module Problem Statement Example 1: Adding an Instruction to a Processor Module Example 2: Modifying an Instruction in a Processor Module Example 3: Adding a Register to a Processor Module Summary Chapter 19: The Ghidra Decompiler Decompiler Analysis Analysis Options The Decompiler Window Example 1: Editing in the Decompiler Window Example 2: Non-Returning Functions Example 3: Automated Structure Creation Summary Chapter 20: Compiler Variations High-Level Constructs switch Statements Example: Comparing gcc with Microsoft C/C++ Compiler Compiler Build Options Example 1: Modulo Operator Example 2: The Ternary Operator Example 3: Function Inlining Compiler-Specific C++ Implementation Function Overloading RTTI Implementations Locating the main Function Example 1: _start to main with gcc on Linux x86-64 Example 2: _start to main with clang on FreeBSD x86-64 Example 3: _start to main with Microsoft’s C/C++ compiler Summary Part V: Real-World Applications Chapter 21: Obfuscated Code Analysis Anti–Reverse Engineering Obfuscation Anti–Static Analysis Techniques Imported Function Obfuscation Anti–Dynamic Analysis Techniques Static Deobfuscation of Binaries Using Ghidra Script-Oriented Deobfuscation Emulation-Oriented Deobfuscation Step 1: Define the Problem Step 2: Create the Eclipse Script Project Step 3: Build the Emulator Step 4: Add the Script to Our Ghidra Installation Step 5: Test the Script Within Ghidra Summary Chapter 22: Patching Binaries Planning Your Patch Finding Things to Change Searching Memory Searching for Direct References Searching for Instruction Patterns Finding Specific Behaviors Applying Your Patch Making Basic Changes Making Nontrivial Changes Exporting Files Ghidra Export Formats The Binary Export Format Script-Assisted Export Example: Patching a Binary Summary Chapter 23: Binary Differencing and Version Tracking Binary Differencing Program Diff Tool Example: Merging Two Analyzed Files Comparing Functions Function Comparison Window Example: Comparing Crypto Routines Version Tracking Version Tracking Concepts Summary Ghidra for IDA Users The Basics Database Creation Basic Windows and Navigation Scripting Summary Index