# Introduction to Ghidra

STUDENT GUIDE

How to Use Slides

- Use Arrow keys to go to next/previous slide
- Double click page number to edit/jump to specific page
- "withNotes" slide deck contains detailed notes below slides and can be used as a tutorial.
- Click "Pop-up" to launch presentation slides
- Should display correctly in modern versions of all browsers.
- Microsoft Edge displays incorrectly at first. To fix, go to Edge options (...) and click zoom once.

Installing Ghidra

- Unzip the Ghidra installation file:

- ghidra_<version>_<release>_<date>.zip

- <version> is the version number of the release
- <release> is the name of the release
- <date> is the date the release was built

- Platforms Supported:

- Microsoft Windows 10 or later (64-bit)
- Linux (64-bit)
- macOS 10.13 or later

Notes:

Exercise Files

- Go through these slides with your choice of program. The exercises were written to work with any program.

Notes:

Course Objectives

- By the end of this course you will be able to:

- Create, setup, and customize Ghidra projects
- Perform code analysis, markup, navigation, searching, selections, and basic data creation to support the reverse engineering process
- Use the byte viewer, decompiler, program tree, symbol table, symbol tree, function graph, and function call tree to support the reverse engineering process

Notes:

Course Topics

Install and Introduction Creating Projects Importing/Exporting programs Customizing tools Basic Code Analysis Selections Basic code Markup Basic Decompiler | Applying Data Types Navigation Searching ByteViewer Basic Program Tree Symbol Table/Tree Function Graph Function Call Tree

Notes:

What is Ghidra?

- Integrated development environment (IDE) for Reverse Engineering (RE) tasks
- Written in Java - mostly platform independent
- Five major parts:

- Programs
- Plugins
- Tools
- Project Manager
- Server

Notes:

- Ghidra is a highly extensible application for performing software reverse engineering.
- Ghidra is built upon a completely generic application framework. Each Application-specific capability is provided by small software bundles called plugins, and each one provides one or more features.
- There are five major parts of Ghidra including: Programs, Plugins, Tools, Project Manager, and the Server . Each of these parts will be discussed in more detail later on in the course.

Programs

- All data is stored using Ghidra's custom database
- All data added by the user also gets added to the Ghidra program database:

- Symbols
- Bytes
- References
- Instructions
- Data
- Comments
- Etc...

Notes:

Plugins

- Ghidra is a library of plugins. Each plugin provides specific functionality.
- All plugins communicate with each other within the tool that they are docked in.
- Plugins can be added or removed without restarting Ghidra so that users can customize the tool however they like.
- Users can write their own plugins.

Notes:

Tools

- Collections of plugins and their configurations
- Ghidra has several preconfigured tools which can be customized to suit individual requirements
- All tools can be customized
- New tools can be created by adding plugins to an empty tool
- Tool configurations are saved for the next use

Notes:

Project Manager

- Manages projects, tools, and data for a particular group of programs
- Programs must be imported into a project before work can be done
- Project configurations are saved for the next use

Notes:

Ghidra Server

- Ghidra projects can share project data by connecting to a Ghidra Server
- The Ghidra server:

- Is used when multiple users want to work together on the same program or set of programs
- Is a simple service running on any computer that a group of users has access to.
- Provides network storage for the shared project.
- Controls user access
- Allows files to be versioned
- Supports check out, check in, version history

Notes:

Why use Ghidra?

- Tools can dynamically share data.
- Supports teaming.
- Highly configurable environment
- Very extensible.
- Runs on multiple platforms
- Has undo!

Notes:

Starting Ghidra

- Run the following from the Ghidra installation directory, ie. .../ghidra_<version>

- ghidraRun.bat (Windows)
- ghidraRun.sh (Linux or macOS)

- The first time you run Ghidra you may be asked for the path to your Java installation.

Notes:

- Starting Ghidra

- To run Ghidra, double-click the ghidra.bat file (or run the ghidra.sh file for Linux or Mac) that is located in the Ghidra install directory
- The first time Ghidra runs, it may take a few minutes while it searches for plugins and other dynamic extensions. After the first time, it should start much faster. Also, the first time you launch Ghidra, a HELP window will appear displaying the "What's New" page in Ghidra. If this window appears, you can dismiss it for now. You can always get it back using the HELP subsystem which will be explained later
- An empty Ghidra Project window should now be displayed. This window will allow you to manage your tools, data, and projects.

Program Manager Layout

- The Program Manager is a place to:

- Create, open, or archive projects
- Import new programs into a project
- Open programs in tools.
- Create subfolders
- View other project contents (read only)
- Manage your tools
- Store your project data archives
- Store version tracking sessions

Notes:

- The Project Manager is the place to:

- Create, open, or archive projects

- Non-Shared: project for individual users
- Shared: project for a team of users

- Import new programs into a project

- Project can contain multiple programs

- View the content of other projects
- Open programs in existing tools by dragging and dropping program onto tool in Tool Chest.
- View and open the contents of other projects (read-only)
- Manage your tools

- Can have multiple tools
- Shows which tools are available and running
- Can open the tools and create new tools
- Import default or user-created tools

- Store your project data archives
- Store your version tracking sessions
- View information about programs using tree or table view
- Create and switch Ghidra workspaces

Program Manager
Creating a New Project

- Select File->New Project from the Ghidra Project Window
- Select Project type:

- Non-Shared for people working alone
- Shared for people working in a group (discussed in intermediate course)

- Select Project Directory and name

- Directory should be on local drive (not over network) for best performance.

- Enter a name for your project, select Finish

Notes:
Before you can do anything else, you must first create a project. Projects are used to store all the programs and related information together in one place. This helps Ghidra locate the files, making them easily accessible to the user. Projects are populated with data using the import process, which will be explained in the next step.

Exercise 1
Create a New Project

- Non-shared project
- Use default project directory
- Name it MyProject

Notes:

- When you complete your exercise you will have created a new Ghidra project. At this point you should see tools in the tool chest and should see a folder named MyProject.

Project Manager
Import Program

- To import a file, select File->Import File... and browse to the program you want to import
- OR Drag and drop from file system onto a Project Manager folder
- Use default or choose correct File Format and Language
- If necessary, edit the program name and choose subfolder
- If necessary, edit options such as the Library Search Path and/or import External Libraries using Options button.

Notes:
Below are steps for importing a file in the Program Manager.

1. Go to File->Import File...
2. Browse to the program you want to import. Click on "supported formats" if you want to see a list of formats Ghidra supports. Ghidra can import (PE, ELF, raw binary, intel hex, gzf (ghidra zip file), etc.)
3. Recognized type: If recognizable, Ghidra will fill in the correct file format otherwise it will show "raw binary" and you must choose the correct language/compiler pair.
4. Raw Binary: You may always choose raw binary if you do not want any imported information and you must choose the correct language/compiler pair.
5. Choose a new project folder if you want the loading programs in a subfolder.
6. Options Button:

- There are several import options including a few for importing and linking dynamically linked library (DLL) files along with your program.

- You can choose to use libraries already in your project or import them from disk
- You can edit the list of paths to search for on disk libraries
- You can choose a subfolder in your project to save them
- Hit F1 on the Options window to see more information about all of the import options.

Exercise 2
Import Program

- Import a program of your choice
- Use Auto-Detected Format and Language
- Turn on the Load External Libraries option and see if any DLLs are loaded with your program

Notes:

Open Program in Tool

- There are different ways to open programs in a tool, including:

- Click and Drag program onto tool
- Click on tool to bring up empty tool, then choose File->Open from the tool's menu
- Drag program from file system onto empty tool will start Import Wizard and open in the tool
- You can open more than one program in a tool. They will be tabbed in the tool

Notes:

How to Start Auto-Analysis

- When a program first opens in tool, it automatically kicks off Auto-Analysis and asks the user if they want to analyze the program
- There are numerous auto analysis options that can be chosen
- User can kick off auto-analysis later using the Analysis->Auto Analyze menu
- Certain analyzers are also kicked off whenever certain actions are performed such as code disassembly, function creation, and data creation.

Notes:

- When a program first opens in a tool, it automatically kicks off Auto-Analysis and asks the user if they wants to analyze the program.
- If you choose not to start Auto-Analysis right away, you can start it later by doing Analysis->Auto-Analyze.
- There are numerous analysis options that can be chosen. The default options change depending on what type of binary has been imported. See Help for more information.

What happens during
Auto-Analysis?

- At a minimum:

- Starts at Entry Points
- Disassembles by following flows
- Creates functions at called locations
- Creates Cross References

- Depending on what options you have selected, Auto- Analysis will do other things as well

Notes:

- During Auto-Analysis, Ghidra:

- Starts at Entry Points
- Disassembles by following flows
- Creates Functions at called locations
- Creates Cross References

- Depending on what options you have selected, Auto-Analysis will perform other functions such as:

- Using operand references to create code or data where operand points to
- Make switch statements using decompiler information
- Make function signatures based on decompiler information
- Demangle mangled names
- Recognize and name library functions
- Perform specific functions depending on the binary type
- Look for images

- If you would like to cancel Auto-Analysis at any time, you can click on the little red square at the bottom of the listing.
- Look at the log in the bottom right of the Program Manager to see which analyzers were run and how long they took.

Auto-Analysis

- Useful to take a layered approach by running analysis with basic options first and run one-shots later

- Focus on options that will get function starts and data first
- Turn off stack analysis if you have a large binary, can run it individually by function

- Learn how to recognize and fix problems

- Many useful scripts for this

Notes:

- For many binaries, analysis gives better results with a layered approach. This means the user should run analysis with basic options first, then rerun with other options later.
- Initial analysis:

- Turn off anything speculative or extra, such as stack analysis, especially if you have a large binary. You can turn these options back on after an initial analysis and rerun analysis on selected functions or the whole program.
- In general, you should leave on reference analyzers, data analyzers, and function analyzers in order to determine what is code and what is data.

- Follow-on analysis:

- Can rerun analysis with different options OR turn on one-shot analyzers, which are analyzers that run one type of analysis at a time

- One-shot analyzers can be run from the Analysis->One-Shot menu. Some common ones are:

- Decompiler Parameter ID
- Decompiler Switch Analysis
- Stack

- Recognize and fix problems:

- Red x's indicate bad flow. The error bookmarks might indicate what analyzer caused the problem so the user can rerun with better options.
- Analysis may not completely determine all code and data in a program, especially if certain analyzers are turned off.
- Use analysis scripts to recognize and fix problems. Here are some examples:

- FixupNoReturnFunction.java fixes functions that do not return and the resulting bad flow from the call to the function
- FindPotentialDecompilerProblems.java runs decompiler and indicates potential issues like unaffected registers and input values that might be global
- FindSharedReturnFunctions.java finds potential places where the function is jumping to another function to share a return. If you do not fix these, the function analyzer and decompiler will merge the two functions
- FindInstructionsNotInsideFunctionScript.java identifies code that is not in functions yet
- CreateFunctionsFromSelection.java allows user to quickly make functions recognized by user when analysis does not find them all, etc.

Exercise 3
Auto-Analysis

- Open your program in the Code Browser
- Auto-analyze using defaults

Notes:

CodeBrowser Layout

- By default CodeBrowser is configured with:

- Program Tree
- Symbol Tree
- Data Type manager
- Listing
- Console
- Decompiler

- Extra Windows are located in the Windows menu
- The CodeBrowser tool also consists of preconfigured plugins.
- Users can add additional actions with the File->Configure action

Notes:

- The CodeBrowser is the default tool, created by configuring Ghidra plugins in a way that makes it useful for disassembling, navigating, and documenting assembly code. It has been configured to provide all the basic functionality needed to reverse-engineer a program.
- To configure more plugins into a particular tool, such as the CodeBrowser, use the File->Configure action.

Useful Info

- F1 help
- F4 set key binding
- Undo/Redo
- Main menus vs. Context-sensitive menus
- Commonly used features placed on icon bar
- Hover on icons to see their function
- Closing a tool vs. exiting Ghidra
- Cursor vs. Selection driven actions
- Themes

Notes:

- F1 Help There is extensive help that explains each action in Ghidra which can be obtained by hovering on an action and pressing the F1 key. F1 also works on any open window. The entire searchable HELP document can be obtained in Ghidra by clicking on Help->Contents
- F4 Set Key bindings Within a tool, you can give each lowest level action a key binding or change the default key binding. In order to do this, hover on an action and hit the F4 key. An alternative method is to go to Edit->Tool Options to find a list of all key bindings and then edit from there
- Undo Within the CodeBrowser and other similarly configured tools, each action, no matter how big or small, can be undone or redone by clicking on the curvy arrows at the top of a tool. Hover on the arrows first to see what action you are undoing/redoing. The Undo history is cleared after a save
- To close a tool either click the X at the top right of the tool or use the File->Close Tool action.
- To exit Ghidra, choose File->Exit Ghidra from any tool or the Project Manager or click the X at the top right of the Project Manager.

- NOTE: You do not need to close your tools before exiting Ghidra. In fact if you want to pick up where you left off, do not close your tools. Simply exit Ghidra and your state will be saved and when you reopen your tools, cursor location, etc.. will be as you left them.

- Main menus and sub-menus in general are used for global actions. The right-click menu is context-sensitive, which means that different actions are available on the right-click menu depending on what item your mouse is on.
- If there is no selection, many actions act only on the current cursor location. When there is a selection, these actions will act on an entire selection.
- Common Windows Menu icons The last several icons on the icon bar correspond to some of the common items in the Windows menu: Bookmark manager, ByteViewer, Function Call Tree, Data Type Manager, Decompiler, Function Graph, Script manager, Memory Map, Register Manager, Symbol Table, Symbol References, Symbol Tree. These will be covered separately later.
- Themes You can change the look and feel of Ghidra to include colors, fonts and such using themes. To do so, choose Edit->Theme... from the Project Manager window. You can switch to a new theme (for example Dark Theme), configure the current theme, create a new theme, import an existing theme that someone else created, export a theme you created, or delete a theme.

Selections and Highlights

- Selections

- Are temporary, ie. go away when user clicks in Listing
- Can be created manually by click and drag
- Can be created using Select menu
- Can be created from tables
- Selections/Searches by use current selection by default

- Highlights

- Are semi-permanent, ie. do not go away until user clears using menu

Notes:

- Selections:

- Show up in green in the tool
- Are temporary. If you click in Listing, they go away.
- Searches and selections act on current selection unless changed
- Can be created manually by click and drag, click and shift-click for a range, click and ctrl-click and drag for disjoint ranges
- Can be created using Select menu. (All undefines, all data, all instructions, current function, flow, etc.)
- Can be created using any table by selecting row(s) and doing right-click->Make Selection

- Highlights:

- Show up in yellow in the tool
- Are semi-permanent selections. The selection stays until you clear it using Select->Program Highlight->Clear
- If you want to create Highlights use Select->Program highlight->Entire Selection, Add Selection, or Remove selection

Listing

- Consists of typical assembly code fields:

- Address
- Bytes
- Mnemonics
- Operands
- Comments
- Labels
- Etc.

- Listing fields can be customized using the Field Editor

Notes:

Field Editor

- Used to customize the Listing fields

- Add
- Remove
- Enable
- Disable
- Move
- Resize

Notes:
Below are directions for using the Field Editor.

1. Use the Edit the Listing Fields icon in the top right of the Listing to toggle open or to close the field editor.
2. Field groupings are different depending on what area of the program your cursor is on. Examples of different fields include: Code/Data, Open Array or Structure, and Function Signature.
3. When the cursor is on the current field, the field will be highlighted in the field editor.
4. Use the mouse to move or resize the fields. Notice their counterparts in the Listing also move and resize at the same time.
5. Use the right click menu to choose from a variety of options including: enable, disable, add, or remove fields.
6. Disabling a field will leave the space but remove the content from the listing view.
7. Removing a field will remove the space and the content from the listing view.
8. You can add new rows, spacers, and other field types.
9. You can reset back to the default if you wish.

Docking Windows

- Most windows can be docked, undocked, or resized.
- To dock a window:

- Click on the title bar of the window so that it turns blue.
- Drag and drop the window to the top, bottom, right, or left edge of another window.
- Drag and drop the window so that it is overlapping another window.

- To undock a window:

- Drag and drop the window outside of the tool.

- To resize a window:

- Click and drag window edges or corners.

Notes:

- Most windows are considered docking windows which means they can be relocated to other parts of the tool.
- If you want to dock window, click on the title bar of window so that it turns blue.

- Drag the window to the top, bottom, right, or left edge of another window. When you see a black arrow then drop the window and it will now be located above, below, to the right or to the left of the other window.
- Drag the window so that it is overlapping another window. When you see overlapping boxes, drop the window and it will be tabbed on top of other window. Clicking on the tabs below the window will determine which window is visible.
- You will see a circle with a slash if you cannot drop the window.
- You can drop the window outside the tool and it will still be functionally connected to the tool.

- NOTE:If you want to dock a window that is not already docked, you need to click and drag using the inner bar that contains the title of the window. It will turn blue when you click on it. The reason disconnected windows have extra items on the top is so that users can easily access menus and icons.

Edit Tool Options

- All tools have different options depending on what plugins have been added to them.
- Tool can be saved with new name and/or icon.
- Tool can be exported.

Notes:

- To edit options in any tool use the Edit->Tool Options menu item in that tool. This will open the Edit Options Dialog
- There are hundreds of options within the Edit Options dialog. Users can use the filter option or folder tree to find the option needed within the dialog's subwindows. For more information about a particular subset of options, hit F1 while in that particular Edit Options subwindow.
- Ghidra does not need to be restarted for edit options to take effect. Users can just hit apply in the Edit Options Dialog to have them take effect.
- The modified tool state can be saved to the current tool or to a new tool with a new name and/or icon. To save the tool state, go to File->Save Tool or File->Save Tool As... Another alternative method to save your tool state is to exit Ghidra and your tool state will be automatically saved to the current tool.
- Tool can be exported then imported for others to use. In order to export a tool, go to File->Export Tool... from any tool and Tools->Import Tool... to import any tool from the Project Manager.
- Tool states are saved in your project and will come back the same way when you reopen Ghidra.

Exercise 4
Customize the CodeBrowser

- Change your instruction fields

- Enable the PCode field
- Add the Stack Depth Field to the right of the Operands Field

- Look at the resulting changes to your Listing fields. If you like the changes keep them, or if not, disable or remove the fields you do not want
- Open the Function Graph window and dock it so that it is tabbed on top of the Decompiler window.
- Change the CodeBrowser's Edit->Tool Options... key binding to Shift-O.
- Change the Codebrowsers Tool Options so that Docking Windows are on top (to find the option easily use the filter).
- Hover on File->Save Tool As... and use F1 to bring up help describing how to save a tool.
- Save your new tool with a new name and new icon.

Notes:

Basic CodeBrowser Navigation

- Basic Navigation

- Scroll
- Page up / Page down
- Double-click on anything with a reference
- Goto (Navigation menu or 'G' key)

Notes:

More CodeBrowser Navigation

- Navigation history (arrow and list)
- Selection/Highlight Arrows
- Navigation buttons (arrow,I,D,U,L,F,notF,notV,B)
- Navigation markers in right margin

Notes:

- Below are notes about different ways to navigate.

- Navigation History arrows and pull down list - users can navigate in order to addresses visited before or use the pull down lists to choose one.
- Selection/Highlight Arrows
If there is a selection (green) or highlight (yellow) these arrows will allow navigation to different ranges of the selection or highlight.
- Navigation Buttons The blue up/down arrow toggles direction forward/backward for all of the following buttons:

- I navigate to the next range of instructions
- D navigate to the next range of data
- U navigate to the next range of undefined bytes
- L navigate to the next label
- F navigate to the next function
- notF navigate to the next range of instructions not in a function
- notV navigate to the next range of bytes not equal to the current byte value
- B navigate to the next bookmark (pull down arrow to change to a specific bookmark type)

- Navigation Markers

- The markers show up in the right margin for the current overall view. The view is determined in the Program Tree window by the small red flag.
- Click on a marker to navigate to that location in the program.
- Right click on the margin to see the various types of navigation markers. You can select/deselect what is shown in the margin from the right mouse menu.
- Below, are a few examples of the different types of Navigation Markers.

- Orange Analysis Bookmarks
- Black Changes since last save
- Purple User Bookmarks
- Green Current Selection
- Yellow Current Highlight
- Red Error Bookmarks

- More Navigation Marker Panels

- There are two more panels that have navigation markers. When opened, they appear as new marker bars to the right of the main navigation bar. To open them, click on the pull down arrow in the Listing icon bar and choose:

- Show Overview
This navigation bar shows different colors for the following items: Functions, Uninitialized memory, External References, Instructions, Data, Undefined bytes. Right-click->Show Legend on the bar to see the colors mapped to the various items.
- Show Entropy
This navigation bar shows different colors corresponding to entropy scores which can indicate areas of uniform byte values, ASCII, UTF16, code, or compression.Right-click->Show Legend on the bar to see the colors mapped to the various items

External Program Navigation

- Can navigate to other programs by clicking on an external reference:

- Must have external references created.
- Load External Libraries Importer option will do this automatically for some formats.
- Can use reference manager to create manually.

Notes:

- If you have the external program imported into your project and the external references have been created, you can click on the external reference and navigate to the external program. If the program is not open, it will be opened and tabbed in the Listing next to the current program.
- To create external references:

- Automatically: Choose Load External Libraries in the File->Import File... Options dialog.
- Manually: Right-click on the place you want to create the reference in the Listing and choose References->Add/Edit then click on the green plus button then choose the External button. All references from one external library will be created if you do this for one of them.

Basics of a Table

- Navigation
- Sorting
- Filtering
- Add/remove columns
- Move columns
- Column settings
- Selections
- Filter options
- Copy
- Export to CSV Text file

Notes:

- All tables have the following basic features:

- Navigation You can navigate by address or label column. Just click on the value in the column to start navigation.
- Sorting You can sort by any column, ascending or descending. To sort, click on the top of the column and you will see a stair step indicating ascending or descending. Then click to reverse. You can sub-sort by doing Ctrl-click on the other secondary columns
- Filtering/Filter Options You can type the filter value in the bottom text box and press enter. The filter option has a default setting that will filter out any row that does not contain the text in the filter unless you change the default option using the Filter Settings button to the right of the filter. Other filter settings include: Starts With, Matches Exactly, Regular Expressions, Case Sensitive, Inverting the filter, and Multi-Term Filtering. There is also a Create Column Filter button which will allow for more complex filtering on a specific column or using set operations on multiple column filters.
- Add/remove columns You can right-click on any column and choose to remove it or add a new column next to it.
- Move columns You can move columns by clicking, dragging, and letting go of the click where you want the column to end up.
- Column settings Some columns have special settings you can change using the right-click menu.
- Selections You can make selections in the listing by selecting row(s) from the table and choosing Right-click->Make Selection.
- Copy You can select rows and copy text to paste in any editor (notepad, Ghidra comment, etc.).
- Export to CSV Text file You can export a table selection to a Comma Separated Value text file.

Exercise 5
Navigation and Tables

- Use the "goto" feature to bring up a table of labels starting with "FUN".
- Dock your table over the Decompiler.
- How many entries are in your table?
- Add the "Function Size" field to the table.
- Sort the table by function size so that the smallest function is at the top.
- Navigate to the smallest function in your table.
- Use the filter to show a subset of items in your table.
- Optional If your program is a Windows GUI program: Use the "goto" feature to bring up a table of all labels that start with "Rsrc" to see the resources used in your program

Notes:

Code Browser
Features for Understanding Code

- Instruction Manual
- Info Fields at bottom of Browser
- Hover
- Cursor text highlight
- Snapshots
- References
- Decompiler

Notes:

- Instruction Manual Right-click on any instruction and choose Processor Manual from the menu. If the manual is in your installation, your default web browser will open the manual to the first page containing that instruction if it allows page numbers. If not, the first page of the manual will open. If the manual is not in your installation, a window will open with a link to the manual and tell you where to put the manual in the installation.
- Info Fields at bottom of Browser: The Little window with basic assembly shows what the original assembly looked like before Ghidra marked it up. The current address window shows the address of the cursor and the function name.
- Hover: Use hover by placing the mouse over all items with references and all data types to bring up a temporary window with a referenced item or data definition. The hover window stays visible as long as the cursor is in the window.
- Cursor text highlight: Click on any text in a Listing field with the middle mouse button. All matching text in the listing will be highlighted in yellow. By default, there is different behavior when middle-mousing on a register. Every matching register or sub-register in the current scope of the register will be highlighted in green. The register's initialization within the current scope will be highlighted mustard yellow. Every matching register or subregister outside the current scope of the register will be highlighted in yellow. You can change the colors or the default behavior of this feature by going to the Edit->Tool Options...
- Snapshots: You can make as many snapshots of the Listing and other windows as you would like. Snapshots have a yellow ring around them and you can dock them anywhere just like any docking window. Snapshots have full functionality of the original window, but are different because Snapshots don't track with the Listing. Snapshots are valuable because you can see more than one view of different areas of code at the same time.
- References and Decompiler are described more fully in future slides.

References

- References

- XRef Field

- For code:

- (c) Call, (j) - Jump

- For data:

- (*) Pointer, (W) Write, (R) Read

- Show references to

- Code
- Data

- Can edit and create references anywhere

Notes:

- XRef Field This Listing field contains a list of all addresses that reference the current address/item. Each item in the XREF field has a type indicator next to it.
- XREF Header This is located above the XRef Field and shows how many references there are to the current address/item. You can double click the XREF Header to bring up a table of all of them.
- References->Show References To Another way to bring up a table of references is to click on the item and choose References->Show References To.
- Edit/Create References To edit/create references, right-click on an operand or instruction and choose References->Add/Edit. Use the green + to add a reference. Choose the type of reference you wish to create: memory, external, stack, or register. Fill in the appropriate text boxes with address, offset, and external location. The text boxes may vary depending on the type of reference you pick.

CodeBrowser Basic Markup

- Basic Label
- Basic Comment

Notes:

- Labels and Comments are ways for a user to annotate what is happening in the code or data.
- Below are basic steps for editing/creating labels and creating comments. We will discuss more after the next exercise.

- To create a label, click on an address and choose the L key or right-click the address and choose Add Label....
- To edit an existing label, click on the label and choose the L key or right-click the label and choose Edit Label....
- To create a comment, click on any field in a code unit and choose the ; key or right-click and choose Comment-> then choose the type of comment you wish to create.

- There are five types of comments:

- EOL comment Shows up at end of current line.
- Plate comment Shows up above current line surrounded by box.
- Post comment Shows up below current line.
- Pre comment Shows up above current line.
- Repeatable comment Shows up anywhere the current address is referenced.

Exercise 6
Listing Understand/Markup

- In your current program, navigate to a small function with a default function name.
- Use only the Listing features, ie cursor text highlight, instruction manual, references, etc., to figure out what the function is doing. Give the function and its parameters descriptive labels and use comments to annotate what is happening in the function.

Notes:

Decompiler Overview

- Converts Assembly to PCode to C code
- Assembly and C code not one-to-one match
- Decompiler output may change due to program changes

- Changes to data or functions called by the current function
- Changes to data mutability (writable, read-only/constant or volatile)

- Selections and navigation made in Listing and Decompiler track one another

Notes:

Basic Decompiler Features

- Editing using the Decompiler

- Data Types
- Labels

Notes:

- To open a Decompiler Window go to Window->Decompiler or use the appropriate icon on the CodeBrowser icon bar.

Editing using the decompiler

- The decompiler usually gets things right but if necessary, you can edit parameter, local variable, and return types and names, function signature options, structure members and names, etc.
- Edits to these items in the Listing or Decompiler will also be reflected in the other window.
- You can edit these items individually by clicking on them in the Decompiler or Listing and choosing the appropriate action from the right mouse menu.
- OR you can edit several at once by editing the function signature. To do this right-click on the function signature and choose Edit->Function... from the Listing or Edit->Function Signature... from the Decompiler. In general, users should change function signatures called by multiple places instead of changing local variables in each individual function that is called. The local variable types will automatically update when related function signatures are changed.
- The more information you can fill in about data types, especially structure information, the better the decompiler output will be. It is most important to get the correct number of parameters even if you do not know the types yet. If you have associated header files that you can pull in information from, it will allow the decompiler to propagate that information into the calling functions.

Basic Decompiler Features

- Automatically Create Structures
- Decompiler Parameter ID
- Committing Parameters/Return and Locals
- Follow Variable Use
- Export current function

Notes:
Decompiler Parameter ID

- This is an auto-analysis option that runs through the program and locks what the decompiler figures out throughout the program. Any future changes to other functions or data that would have affected that function will not be considered. Use this option only if you have rich data type information first, such as Windows known library calls and known DLL calls with parameter and return types applied during the import process or before running analysis with this option.

Automatically Create Structures

- If you suspect a variable is an undefined structure, you can have the decompiler try to figure out the structure definition for you by right-clicking on the variable and choosing Auto Create Structure.

Commit Parameters and Locals

- This options does the same thing as Decompiler parameter ID but is done individually and manually by the user
- Can do separately to parameters/returns or local variables
- CAUTION: Only use this feature if you want to lock the decompiler output instead of adjusting to program changes.

Following Variable Usage

- Middle-mouse click simple-text-match highlighting similar to Listing Cursor Text Highlight on non-registers
- Highlight Def-use highlights where the current variable is used and defined, similar to Listing Cursor Text Highlight for registers
- Forward Slice highlights each variable whose value may be affected by the value in the current variable
- Backward Slice highlights all variables in the function that contain a value involved in the creation of the current variable.

Export current function

- This feature allows the user to export the current function to a text file.

Recommended Decompiler Techniques

- Change function signatures to cause global improvements
- Make function signature changes to handle specialized types of functions
- Apply writable memory, read-only memory and volatile memory settings correctly

Notes:

- If you see a function that isn't getting the correct number of parameters or types, you can fix it by applying specific data types to the parameters or adding/removing the parameters. However, adding/removing the parameters forces the decompiler to use your information everywhere that the function is called. Be careful because this can be good if you get it right or bad if you get it wrong.
- Users should change function signatures called by multiple places instead of locals in each individual function that is called. However, in some special cases, such as functions with variable numbers of arguments, you can override a signature from the call. Use the Override Signature action from the right mouse menu in this case only.
- Examples of read-only memory include indirect pointers to data and global values in memory used as constants.
- If the decompiler thinks the pointers are not constant, then it won’t follow them to the data they are referencing.

Exercise 7
Decompiler Understand/Markup

- Navigate to a function that calls the function you annotated in the previous exercise. Using your understanding of that function, use the decompiler and its features to start understanding the calling function. Start by using what you know about the previous function's parameters and what it returns, to start labeling variables in the calling function with descriptive names. Once you see the descriptive names used elsewhere in the function, it may help you understand more about the function. Continue labeling variables and parameters as you figure out their purposes until you have a good understanding of at least part of the function.

Notes:

CodeBrowser Markup
More About Labels

- Labeling

- Multiple labels
- Primary label
- Locals and Globals
- Function signature
- Show History
- Search Label History

Notes:

- More information about labels:

- Labels can have more than one label at an address.
- Primary labels show up in references by default, you can change which label is primary using Edit Label... action.
- To add another label, right-click on the address and choose Add Label....
- Global variables exist in the whole program and can only have one unique name
- Local variables exist in a namespace and can have more than one of the same name. Labels inside a function are, by default, in that function's namespace. The namespace can be changed using the right-click->Edit Label... action.
- The function name in the function signature is the same as the primary label at that address. You can add secondary labels at the function entry point address but only the primary label is reflected in the function signature name.
- Use right-click->Show Label History to see how the label has changed and who changed it.
- Use Search->Label History to find an old label name that does not exist in your program anymore.

CodeBrowser Markup
More About Comments

- Comment annotations embed display markup in Ghidra comments.
- Comment annotations appear as a hyperlinks to the items.
- Double-click to navigate to the item.
- Types of annotations:

- Address
- Execute
- Program
- Symbol
- URL

Notes:

- Annotations To add comment annotations using the comment editor, use the pull-down menu, choose an annotation type, and then click the Add Annotation button.

- Address Fill in the interesting address. The comment will display the given address as a hyperlink. Double-click the link to navigate to that address.
- Execute Fill in path to an executable. Double-click the resulting link to launch the specified executable in your OS with given optional parameters.
- Program Fill in existing Ghidra program name (case-sensitive) to displays a hyperlink to the given Ghidra program name. Double-click the link to open the program in a new Listing tab. Optionally use the @symbol name after the program name to go to a specific symbol in the program.
- Symbol Fill in the address of the interesting symbol. The comment will display the given symbol as a hyperlink. Double-click to navigate to the symbol. Changes to the symbol in the Listing will automatically change the comment to display the new symbol.
- URL Displays the given URL as a hyperlink. Double-click to open what the link is pointing to. References to ghidra://, which refer to a program within a Ghidra Server repository, will be opened within the Listing display, while all other URL protocols (e.g., http://, https://, file://, etc.) will be launched via an external web browser. See HELP command configuration for Processor Manuals for more information.

Applying Data Types

- Can apply data type at:

- Single address
- Selection of addresses
- Parameter/Local variable

Notes:

- This course only covers the basics of data types. More information is covered in the intermediate class.
Applying Data Types:
- You can apply a data type to a single address or a selected range of addresses. If you apply a data type to a selection, that data type will be applied contiguously until it reaches the end of the selection. You can also apply a data type to a parameter or a local variable.

Applying Data Types
Data Type Manager

- Data Type Manager Folders

- BuiltInTypes
- Program Data Types
- Prebuilt Data Types
- Your Own Data Archives

- To Find Data Type

- Filter/Find by name
- Open Folders
- Find by Size

- Drag to apply

Notes:

- The Data Type Manager normally resides in the lower left corner of the CodeBrowser. If it is not there, open it using Window->Data Type Manger.
- There are different folders for each of the following Data Types:

- BuiltInTypes

- Contains Data Types created by the Ghidra development team

- Program Data Types

- Contains Data Types that have been applied to the current program
- Contains Data Types created by the user

- Prebuilt Data Types

- There may be more than one folder of this type
- Contains data types parsed from data definition files

- Your Own Data Archives

- Users can create their own data archives so they can use their data in multiple programs or projects
- These Archives can be stored on the File System (File Archive) and shared by multiple projects or they can be stored in the current project (Project Archive) and be shared by all programs in the current project

- To find the data types you are looking for, you can:

- Filter
- Open Folders
- Pull down menu to find by size or name

- To apply data, click on the data type and drag it to a:

- Single address
- Selection
- Parameter/local/return types

Applying Data Types
Right Mouse Menu

- Data->Choose Data Type

- Browse
OR
- Start typing name of data type

- Data menu favorite list

- Can be customized in Data Type Manager

Notes:

- There are two ways to apply a data type from the right-click menu.
- First, click on an address or select a range of address where you want to apply the data type.
- Then choose either:

- Right-click menu Data->Choose Data Type... then browse or start typing the name of the data type you want to apply.
- Right-click menu-> then choose a data type from the list of your "favorite" data types which can be customized in the Data Type Manager by toggling the Right-click->Favorite action.

Applying Data Types
Cycle Groups

- Right-click->Data->Cycle Groups
- Key bindings

- B (byte, word, dword, qword)
- " (char, ascii string, unicode string)
- F (float, double)

Notes:

- When applying data in cycle groups, click on an address or select a range where you want to apply the data type.
- Use the Right-click->Data->Cycle Groups or the following shortcut keys to cycle through the following data types:

- B (byte, word, dword, qword)
- " (char, ascii string, unicode string)
- F (float, double)

Functions

- Functions are well formed subroutines.
- Create by disassembling first (D key) then hitting F key at top of function.
- Can edit each individual piece of function signature in Listing or Decompiler.
- Can also use the Edit Function... action to bring up dialog to edit multiple items at once.

CodeBrowser Markup
Clearing

- Clear Code Bytes
- Clear with Options
- Clear Flow and Repair

Notes:

- In order to use Markup Clearing, you need to select the item(s) you want to clear and choose one of the following Markup Clearing options from the right-click menu:

- Clear Code Bytes This option clears the defined code or data and leaves labels, comments, etc. alone
- Clear with Options... This allows you to choose which items you want to clear (symbols, comments, code, functions, references, bookmarks, etc.)
- Clear Flow and Repair... This allows you to clear and repair code which was produced in error. Click on the first bad instruction, and then invoke the action.

CodeBrowser Markup
Constants

- Convert

- Can display a constant in different formats

- Binary, decimal, characters, etc.

- Equates

- Can replace a constant with a descriptive name
- Some are predefined from parsed header files
- OR User can make their own

- Enums

- Can group Equates into an Enum
- Can apply to Codebrowser individually or to selection
- Can apply to Decompiler by changing a variable data type
- NOTE: Applying to the Listing will apply names to most matching scalars in Decompiler. However, the best way is to use Decompiler and get the data types correct. Currently, applying to Decompiler will not apply to Listing.

Notes:

- The Convert action only appears on the right mouse menu if the cursor is on a constant operand. It only works on the current scalar.
- The Set Equate... action only appears on right mouse menu if the cursor is on a constant operand. It works on the current scalar and if there is a selection on all matching scalars in the selection.
- To group Equates or Enums into a single Enum in the Data Type Manager, use the filter to group them (if possible), select them using click and drag, then do right-click->Create Enum from Selection.
- The Apply Enum... action allows users to apply the enum names to multiple matching values in an instruction or selection of instructions. It only appears on the right mouse menu if the cursor is on a constant operand (no selection) or there are constant operands in the current selection.
- Applying Equates and Enums to the Listing will rename most in the decompiler, however...
- PREFERRED METHOD: To apply Enum names to the decompiler view, find a variable being assigned or compared to the constants then do right-click->Retype variable or right-click->Retype global. Make sure that the Enum size (1,2,4,or 8 bytes) matches the size of the variable in the decompiler or it will not display the names.

Exercise 8
Constants

- Find a scalar operand and use the "Convert..." action to convert it to a different format.
- Find a scalar operand and use the "Set Equate..." action to rename it either a name of your choosing or from the given list.

Notes:

CodeBrowser Markup
Bookmarks

- Bookmarks

- Show up in left margin for currently displayed code
- Types

- User Notes
- Analysis
- Info
- Error
- Warning

- Can use Bookmark Manager to see them all

Notes:

- Bookmarks

- To create a bookmark, right-click on an address and choose Bookmark from the right-click menu. Then fill in a Category (optional) and description. If there is a current selection, bookmarks will be made at the top of each selected range. A purple checkmark will be placed at each bookmark location.
- Bookmarks show up in individually in left margin if in your current visible portion of Listing or in right margin as marker margin color if in the current Listing view.
- If you would like to see a list of bookmarks, open the Bookmark manager in Window->Bookmarks. The bookmark table you will see allows filtering by text and/or by bookmark type.

- Types of bookmarks:

- User notes (purple check symbol) shows bookmarks the user has added
- Analysis (blue bolt symbol) shows bookmarks that auto-analysis added to describe what analyzer created the code/data at that location
- Information (white circle with I in the middle) is added by importer to describe what items the importer identified in the import process
- Error (red x symbol) shows bookmarks used to indicate an unknown opcode, can be caused by bad auto analysis disassembly or bad user disassembly
- Warning (yellow triangle) shows bookmarks used to indicate a possible problem

Exercise 9
Bookmarks

- Create bookmarks at the tops of the functions you chose to annotate in Exercises 5 and 6.
- Bring up the Bookmark Manager and use it to display only user created bookmarks. Try this two different ways.
- Use navigation markers and the left margin markers to inspect some of the Analysis and Info bookmarks.
- Toggle-off the Analysis markers in the right margin.

Notes:

Export Formats

- GZF (Ghidra Zip File)
- XML
- HTML
- Raw Bytes
- Intel Hex
- C code (.c and .h files)
- Ascii
- Original File
- SARIF

Notes:

- Ghidra allows users to export a selection or an entire program to the following formats:

- Ghidra Zip file (GZF) uses custom format to compress all information contained in a Ghidra program so that users can share program information.
- XML Used to export information about the current program, to other tools if an importer has been written to recognize it in the other tool. There is potential loss of information due to inconsistencies between tools. NOTE: An exemplar IdaPro set of plugins/loaders are included in ghidra_/Extensions/IDAPro. Also included is an IdaPro export plugin that creates XML that Ghidra can import.
- HTML exports selection or entire program as navigable html
- Raw Bytes exports selection or entire program as binary. This does not preserve the original file layout unless there was only one memory block in the original file.
- Intel Hex exports selection or entire program as Intel hex format
- C exports selection or entire program as C code (Including corresponding .h file)
- Ascii exports selection or entire program as printable Ascii file
- Original File Writes a program back to its original file layout. By default, any file-backed bytes that were modified by the user in the program database will be reflected in the new file. Optionally, the program can be written back to its unmodified file bytes, discarding all user modifications.
- SARIF Creates SARIF files that contains information from a Ghidra program so that users can share program information.

Program Tree Basics

- Can use to see basic structure of program
- Can use to organize program
- Can use it to select whole memory blocks
- Can use to change current view in the Listing
- Can use to determine what part of program your cursor is located in
- Can have multiple trees with different organizations

Notes:

- The Program Tree is normally open in top left of the default Codebrowser OR to open go to Window->Program Trees.
- Program Tree Basics:

- Structure of Program:

- Program Tree can either be created by the import process's read of the program header OR by the user when he/she imports and splits the program into different code/memory blocks.

- In the Program Tree you can:

- Create folders and fragments
- Select code/data/undefined selection and drag it onto a folder or fragment.

- Items can only exist in one fragment but the same fragment can exist in multiple folders
- Program still exists in same address order but your visualization of it is rearranged in this tree

- Make multiple program trees each with different organizations of the program. Create a new tree by clicking on the new tree icon in top right of the Program Tree

- Changing Current View

- Red flag indicates the view currently contained in the Codebrowser Listing
- Double-click on fragment/folder changes view to that fragment/folder

- Track the Listing

- Click on the icon with a green arrow in the top right of the Program Tree and the segment containing the current location in your Listing will be selected.

- Multiple Trees:

- To make a new Program Tree, click on the icon with a '+' on it in the top right of the Program Tree window.
- To rename a tree, right-click on its tab and choose Rename from the right mouse menu.

Program Tree Modularization

- Can modularize CODE ONLY programmatically:

- Subroutine
- Complexity Depth
- Dominance

Notes

- NOTE:Create a new Program Tree every time you modularize. The Modularization actions do not work effectively on already modularized trees.
- In the Program Tree, right-click on a CODE segment and choose Modularize By->:
  - Subroutine-> This breaks code into segments by a chosen subroutine model.
  - Complexity Depth This groups functions into folders Level 0 to n, where Level 0 contains the entry function(s), Level 1 contains functions called by entry function(s), and so on. Level n contains functions that do not call any other functions within the current program but may call external functions.
  - Dominance This groups functions in folders according to which functions dominate other functions. Function A dominates Function B if every path from the entry to Function B must go through Function A.

Exercise 10
Program Tree

- Make the Program Tree follow the Listing
- Make a new Program Tree

- Rename it MyTree
- Make a folder called MyInterestingFunctions
- Make a folder called MyInterestingData
- Select any functions and/or data you think are interesting and drag and drop them into the appropriate folders.
- Make one or more new program trees and modularize each one with a different modularization technique.

Notes:

Byte Viewer Basics

- Can View and Edit bytes in various formats
- Selection and Navigation follow the Code Browser and vice versa
- Can add various format fields
- Can change bytes per group, bytes per line, line alignment

Notes:

- To open the ByteViewer window go to Window->Bytes:
- Byte Viewer allows you to view and edit program bytes in various formats. Byte Viewer navigation tracks the Listing and vice versa.
- Byte Viewer Basics Information:

- To Edit:

- Enable editing using pencil icon.
- If editing code bytes, clear them in the Listing before editing then redisassemble. No need to clear if editing data bytes.
- Edit in whatever Byte Viewer field makes most sense (i.e., if you want to change ascii, type in the ASCII field, hex in the hex field, etc.)

- Fields can be added using the wrench icon:

- Choose from Hex, Binary, ASCII, Octal, HexInteger, Address, Integer, or Disassembled
- ASCII Shows ASCII or '.'; if non-ASCII value.
- Disassembled Shows '.' if disassembled code or defined data. Shows box if undefined.
- Address Shows a black circle if bytes at a specific location represent a valid address in the current program space. Shows '.' if bytes do not represent a valid address.

Searching
Search Program Text

- Allows users to search for any markup text put there by Ghidra or the user: comments, labels, fields, etc.
- Works on whole program or selection
- Search next or previous
OR
- Search All instances to bring up a table

Notes:

- To open the Search Program Text dialog go to Search->Program Text

- Allows users to search for any markup text put there by Ghidra or the user including: comments, labels, fields, etc.
- Can search all fields or narrow to specific field(s).
- Can use Next/Previous buttons to navigate to one found instance at a time or use the Search All button to bring up a table of all found instances.

Searching
Search Memory

- Allows users to search for byte(s) contained in all or selected portion program memory
- Ways to enter search value

- Various formats (hex, strings, unicode...)
- Regular Expressions

- Search next or previous
OR
- Search All instances to bring up a table

Notes:

- To open the Search Memory dialog go to Search->Memory...

- This dialog allows users to search for byte(s) contained in program memory
- Can limit to a selection
- Can enter search value as hex, string, decimal, binary, float, double or regular expression.
- There is an options panel which allows you to set various options such as endianess, alignment, size, signedness, encoding, case sensitiveness, and whether bytes are in instructions, defined data, or undefined data and whether in loaded memory blocks or other types of blocks.
- Using regular expressions in search memory allow a more flexible byte pattern search such as searching for two numerical digits followed by three ASCII characters without knowing the exact values.
- After doing one search, the user can use the New Search pull down to perform set operations between the first search and a follow-on search.
- There is a scan panel that can be used to rescan the bytes in the current search results table to see if any of the found bytes are the same, have changed, have increased, or have decreased.

Searching
Search for Strings

- Allows users to search for potential strings found in all or selected portion of memory

- ASCII, Unicode, Pascal

- User can create strings and labels directly from the resulting table
- Can filter the resulting table to narrow list of results

Notes:

- To open the Search for Strings dialog go to Search->for Strings...

- Allows users to search for potential strings found in all or selected portion of memory.
- By default searches for null terminated ASCII and unicode.
- Can choose to search for Pascal instead.
- Can change the minimum length of found strings.
- Can have it report only strings found on certain alignment.

- Result Table has following columns::

- Address of found potential string.
- Label if there is a label there.
- Code Unit to shows what is already defined at that location (data/instruction).
- ASCII to show what the string would look like if it were created.
- String Type to show what kind of string was found.

- Make Strings Panel:

- Can be toggled open or closed
- Can select multiple rows in the table.
- Allows user to choose whether to auto-label the string (s_stringname, u_ for unicode, p_ for Pascal).
- Creates the correct type of string.
- Can change the offset of the beginning of the string if there are ASCII chars at the beginning that do not belong in your string.
- Can have it include alignment nulls at the end of the string. The number of nulls included is based on the alignment value chosen.

- There is a similar string search that allows you to search for strings with other encodings beyond the simple string search. To run it choose Search -> for Encoded Strings... It is similar to search for strings but will show strings using the given encoding. You can also choose to limit the search to a specific script (ie alphabet), translate the found strings, and more. Do F1 on this action to get more detailed information.

Searching
Search for Direct References

- Allows users to find places in program where bytes represent current cursor address or selected addresses

Notes:

- To open the Search for Direct References dialog use Search->For Direct References

- Allows users to find places in memory where the bytes form the current cursor address or selected addresses
- Can run search for direct references on one address or a selection of addresses
- In Ghidra, a direct reference is considered to be a reference that uses bytes representing an address to reference that address. For example, in the instruction CALL 12345678, if you look in the bytes field for that instruction you can see the bytes 12 34 56 and 78 (or 78 56 34 and 12 in little endian code), that would be a direct reference to address 12345678

Searching
Search for Address Tables

- Allows users to find runs of direct references
- Can specify gaps between these direct references

Notes:

- To open the Search for Address Tables dialog go to Search->For Address Tables...

- Allows users to find runs of direct references to addresses
- Can run this on one address or a selection of addresses
- Can change the minimum length of the found table
- Can have it report only tables found on certain alignment
- Can specify a length to skip between valid direct references
- Can create Address tables directly from the table using the Make Table button which will create a label and address data type for each item in the table
- If it is determined that the table values all point to code, you can kick off disassembly at each address referenced by the table with the Disassemble button.

Searching
Search for Instructions

- Allows users to find matching instruction patterns
- Can specify whether to include or exclude operands

Notes:

- There are two actions that allow you to search for Instruction patterns. Both work on either the current instruction or a selection:

- Search->For Matching Instructions-><option> where option indicates whether to:

- Exclude Operands
- Include Operands
- Include Operands(except constants)

- Search->For Instruction Patterns... which brings up a dialog that allows you to choose the exact instruction pieces to look for and which to omit

Searching
Search for Scalars

- Allows users to find all operands that are scalars and defined data used as scalars
- Can specify a range of interesting scalars or a specific scalar

Notes:

- To use Search for Scalars:
- Search->for Scalars... then fill in range or specific scalar in hex or decimal (use 0x prefix for hex)

Exercise 11
Search

- Search your program for interesting strings and scalars.

Notes:

Symbol Table Basics

- Symbol Table displays information about every symbol in the program

- Type of Symbol
- Number of References
- Number of Off-cut References
- Namespace
- Source of Symbol

- Can filter by any symbol property

- Type
- Source
- Etc.

Notes:

- To open the Symbol Table window go to Window->Symbol Table
- Fields in the Symbol Table contain the following information about symbols:

- Type of Symbol:

- Function label
- Data label
- Instruction label
- Parameter name
- Local Variable name

- Number of references:

- Number of references to the symbol

- Number of off-cut references:

- Number of references in the middle of the code or data at the location of the symbol

- Namespace:

- Displays the namespace that the symbol belongs to or Global if it is defined in the whole program

- Source of Symbol:

- Default FUN_, LAB_, DWORD_etc.
- User Defined User names it
- Imported Named by importer
- Analysis Named by auto-analysis

- The Filter Dialog allows filtering on numerous items such as symbol source, symbol type, etc.

Symbol Table
Reference Window

- List of references to a selected item in the Symbol Table
- Different modes

- S
- I
- D

Notes:

- You can bring up the Symbol Table Reference Window using Window->Symbol References. This window lists and shows information about the currently selected symbol in the Symbol Table.
- Different modes in Symbol Table Reference Window include:

- S (default mode) Shows all references to the selected symbol, a preview of the reference and the type of reference
- I Only works if the selected symbol is a function. Shows a preview of all navigation instructions contained in the selected function.
- D Only works if the selected symbol is a function. Shows preview of all data references contained in the selected function.

Symbol Tree Basics

- Organizes Symbols according to type in a tree view
- Nests symbols belonging to other items under that item's folder
- Can have it track the Listing
- Can create classes and namespaces

Notes:

- To open the Symbol Tree Window go to Window->Symbol Tree

Windows Menu
Previews

- Used to help determine what an undefined area is

- Data Type Preview

- Shows bytes as various data formats

- Disassembled View

- Shows bytes as disassembled code

Notes:

- To open the Data Type Preview Window go to Window->Data Type Preview

- The window changes what is displayed based on where you click in the Listing
- The bytes at the address are displayed in the various formats in the table
- You can add or remove data types using the + or the X

- To open the Disassembled View Window go to Window->Disassembled View

- The window changes what is displayed based on where you click in the Listing
- The bytes at the clicked address are displayed as they would look if they were disassembled code

Windows Menu
Defined Tables

- Shows all defined items of the following types

- Data
- Function
- Strings
- Equates

Notes:

- To open the Defined Data Window go to Window->Defined Data

- This table lists all defined data in the current program

- To open the Defined Functions Window go to Window->Functions

- This table lists all functions in the current program
- Note: One cool thing you can do with this table is select a subset of the functions and choose Compare Function(s) to see a side by side comparison view of the functions that you chose. For more info about this table, hit F1 while it is open.

- To open the Defined Strings Window go to Window->Defined Strings

- This table lists all defined strings in the current program

- To open the Defined Equates Window go to Window->Equates Table

- This table lists all applied equates in the current program

Windows Menu
Script Manager

- Meant to be one-shot actions
- Smart Console

- Displays script messages
- Enables navigation to valid locations

Notes:

- To open the Script Manager go to Window->Script Manager
- Unlike plugins that stay around once they are configured, scripts are meant to be one-shot actions.
- To run a script, select it in the script manager and either double-click the table entry or click the green circle icon.
- Script messages appear in the console.
- The console is "smart". If it recognizes a label or address, you can click on it in the console to navigate in the Listing.
- The Intermediate Ghidra class covers detailed information about scripts such as how to:

- Customize your script directories
- Add scripts to menus
- Make key bindings for scripts
- Edit existing or develop new scripts

Function Graph

- Represents function as a directed cyclic graph
- Edges (branching or jumps) represent flow control

- Conditional positive (success): green
- Conditional negative (failure, pass through): red
- Unconditional: blue
- Switch: also blue

- Nodes (blocks) represent a unit of code
- Note: Calls do not break block

Notes:

- To open the Function Graph window go to Window->Function Graph.
- There is a Satellite View inset window at the bottom right of the window. If it gets in your way, you can right-click on the Function Graph canvas window and deselect its option.
- If you hover on an edge, it will present a popup window showing you the branch/jump statement, and the code at the target destination. This can obscure a large portion of your window. If you would like to turn it off you may from the right-click menu.
- If you desire, the edge colors can be changed on the tool options screen.

Function Graph Basic Controls

- Click-drag on whitespace moves the "canvas"
- Click on block navigates in listing (and focuses)
- Double-click on edge navigates to jump target destination

- Double-click again and it will navigate to jump source (branch statement)

- Double-click on block centers, zooms to 1:1
- Mouse wheel zooms in and out

Notes:

- The focused block is the block containing the current cursor location in the listing. The block (node) in the graph surrounded by a yellow highlighted oval is the focused block.
- The focused block always contains the current cursor location in the program; however, it does not mean the cursor location is at the top of the block. If you click on a block, the cursor is placed at the top. But if you navigate using the listing or decompiler or other window, your current location can move to a place within the block (but not at the top). If you navigate the current location outside the current block, the focus will follow and the new block containing the current location will be highlighted.
- You will learn more about what focus is useful for (besides a visual indicator of location) in a few slides.
- The hovered block is the block that your mouse is currently over. You will also learn more about this in a few slides.
- NOTE: When double-clicking on an edge to navigate blocks, note that you are actually taken to the block furthest away from your current canvas position. Usually that results in the behavior described in the slide; you double-click on an edge coming out of a block, and you are taken to the destination of the jump. But if you see an edge "out in space" (i.e., you don't see its source or its destination block), remember it will take you to the block that is furthest away, which might not be the destination block the first time you double-click it.

Function Graph
Basic Controls (cont.)

- Zoomed out too far: Block contents blank

- No block interaction possible

- Zoomed out and Satellite View: Entry point green, return blocks red
- Zoomed medium: 3-D drop shadow

- Still no block interaction! Only preview rendering

- Zoomed in: Fully capable listing

- Selection works, navigation, right-click menu

- Selection, highlight operate PER BLOCK!

Notes:

- Your monitor might report strange values for its actual resolution, which will confuse Java as to the point when preview rendering should occur. Your preview rendering then might just look like little dots you cannot read! This is not very useful, so zoom in a little more.

Function Graph Node Buttons

- Paintbrush: Background color for block
- Window: Expand block to window (like mini-listing)
- Chain: Jump to one of this function's XRefs (callers)

Notes:

Function Graph
Window Buttons

- Home: Move to entry point block
- Layout: Select layout
- Field Editor: Change block field layout

- Independent of main listing field layout

- Hover/focus (discussed next slide)
- Camera: Make a snapshot window

Notes:

Function Graph Hover/Focus

- Hover mode

- Enabled when placing the cursor over a block without clicking
- Shows "ants marching" on links

- Focus mode

- Enabled when clicking on a block
- Shows bold links

Notes:

- There are two pull-down menus in the Graph Window Icon Bar. Each mode contains almost the same set of options that are explained in the next several slides. The difference is in how they are enabled and displayed in the graph:

- Hover mode

- Enabled when placing the cursor over a block without clicking
- Shows "ants marching" on links

- Focus mode

- Enabled when clicking on a block
- Shows bold links

Function Graph Hover/Focus

- Scoped Flow To/From Block

- Blocks after "From" must have passed through hover/focus
- Blocks before "To" must eventually pass through hover/focus

- Paths To/From Block go from entry block to return block(s)
- Loops Containing Block shows local loop neighborhood

Notes:

- For those unfamiliar with dominance in graph theory, the basic idea is that some nodes are more "important" than others because they act as dispersing or condensing "gateways" for flow.
- Show Scoped Flow From Block will encompass all blocks in the flow after the principal block that can ONLY execute if the principal block executes. In other words, if control never makes it to the principal block, none of the neighborhood blocks will execute.
- Show Scoped Flow To Block will encompass all blocks in the flow before the principal block, such that all blocks in the neighborhood MUST have executed if the principle block executes.

Function Graph Hover (Special)

- Paths from Focus to Hover

- Focus on "From" block
- Hover over "To" block

- Shows you the possible flows from Focus to Hover

Notes:

Function Graph Focus (Special)

- Show All Loops in Function

- Independent of currently focused block
- Can be computationally expensive

Notes:

- In a function graph focus, you are presented with a normal task dialog when all loops are being computed. If you cancel, it will ask for confirmation and then display the results as far as it was able to get. For most functions, this is pretty close to the right answer but it still might have missed one or two small loops, depending on the complexity of the function.

Function Graph
Right-Click Menu

- Highlight: Same as listing highlight menu
- Selection: Create from hovered or focused edges
- Pop-up windows on/off (block, edge)
- Satellite View

- Entry point is green and return blocks are red, just like "zoomed way out"
- Click or drag to navigate in Satellite

- Zoom to vertex, window
- Properties

Notes:

Function Graph Tool Buttons

- Disk: Save program
- Navigation arrows
- Undo/Redo

Notes:

Function Graph Group Vertices

- Can collapse nodes into one node
- Give new node new name to represent group
- Can expand node back into previous grouping

Notes:

- To group vertices use Ctrl button with right-click and drag to make a box around group of vertices then right-click and choose Group Selected Vertices. Enter new name and hit ok to collapse into one node.
- To expand back into original vertices, right-click on the grouping and choose Ungroup Selected Vertices.

Function Call Trees

- Tree view of current function's incoming and outgoing calls

- Left window - incoming calls to current function
- Right window - outgoing calls from the current function

- Folders expand and collapse until there are no more function callers or calls to follow

Notes:

- To open the Function Call Tree either right-click in a function and choose References->Show Call Trees or choose the corresponding icon in the CodeBrowser icon bar.
- By default the Function Call Trees show all calls in address order to or from the current function. There is an option to collapse any duplicates and show each call once.
- Optionally toggle whether Listing navigates to currently selected function.
- Optionally toggle whether Function Call Trees updates when navigating to new function in Listing.
- There is an option in the black triangle pull down to show or not show thunks to functions in the tree.
- There is an option in the black triangle pull down to show or not show the namespace of the function names in the tree.

Course Summary

- You should now be able to:

- Create, setup, and customize Ghidra projects
- Perform code analysis, markup, navigation, searching, selections, and basic data creation to support the reverse engineering process
- Use the hex editor, decompiler, program tree, symbol table, symbol tree, function graph, and function call trees to support the reverse engineering process

Notes:

Preview of Intermediate
Ghidra course

Advanced data types Memory Map Multi-user projects Comparing programs Version tracking | Scripting Development Running Ghidra in headless mode

Notes: