Ghidra Literacy

Ghidra decompiler and project workflow — analyze crackmes on $RE_LAB, export notes not commercial patches.

Ghidra Literacy• Audio Walkthrough

00:00/03:16

Visual · re_ghidra_literacy

Ghidra literacy. $RE_LAB only. Original Cyberlium.

Ghidra turns bytes into pseudocode — rename, retype, and annotate on authorized targets only.

Ghidra is a free NSA RE suite: import binary, analyze, disassemble, decompile to C-like pseudocode. Rename functions (check_password), set types, add bookmarks, export listings. Projects live on $RE_LAB VM — not mixed with pirated commercial trees on host. Cyberlium teaches Ghidra literacy for CTF and crackmes. You will NOT distribute Ghidra scripts that patch paid software licenses. Next: IDA/Binary Ninja Named.

1. Import and analyze workflow

New project → import YOUR toy binary → analyze with default options → open CodeBrowser. Entry appears in Symbol Tree; Decompile window shows pseudocode for selected function.

Accept default analysis on $RE_LAB crackmes; note sha256 in project notes field.

Command guide

Try these commands — Import and analyze workflow

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, objdump. Reference sites: Ghidra (https://ghidra.re/); Ghidra docs (https://ghidra.re/courses/GhidraClass/); objdump (https://man7.org/linux/man-pages/man1/objdump.1.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Rename, retype, comment

Rename nonsense FUN_ labels to meaningful names matching source if toy binary. Retype char* for string args. Comments document CMP/JMP gates — not crack steps for commercial apps.

Export decompilation snippet to chmod 600 text for writeup — methodology, not one-click patch file.

3. Ghidra literacy boundaries

Forbidden: Ghidra scripts for mass commercial cracking, sharing patched binaries from Ghidra exports, or analyzing employer IP without written authorization.

Ship: Ghidra workflow checklist — import, analyze, rename three symbols, one comment on gate. Next: IDA/Binary Ninja Named.

4. What you ship: Ghidra workflow checklist for $RE_LAB

Import/analyze/rename/comment steps on YOUR toy. $RE_LAB project path. NEVER commercial patch exports. chmod 600.

5. What you record before the next lesson

Date. Ghidra checklist. $RE_LAB named. File t23-m05-l02-ghidra-literacy.txt chmod 600.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Export patched commercial exe from Ghidra. Skip project notes on target sha256.
Right: Write Ghidra workflow checklist for $RE_LAB toy. Next: IDA/Binary Ninja Named.

Hands-on Exercise