Reverse › Module 5 › Lesson 2
Ghidra Literacy
Ghidra decompiler and project workflow — analyze crackmes on $RE_LAB, export notes not commercial patches.
Visual · re_ghidra_literacy
Ghidra literacy. $RE_LAB only. Original Cyberlium.
Opening
Ghidra turns bytes into pseudocode — rename, retype, and annotate on authorized targets only.
Ghidra is a free NSA RE suite: import binary, analyze, disassemble, decompile to C-like pseudocode. Rename functions (check_password), set types, add bookmarks, export listings. Projects live on $RE_LAB VM — not mixed with pirated commercial trees on host. Cyberlium teaches Ghidra literacy for CTF and crackmes. You will NOT distribute Ghidra scripts that patch paid software licenses. Next: IDA/Binary Ninja Named.
1. Import and analyze workflow
New project → import YOUR toy binary → analyze with default options → open CodeBrowser. Entry appears in Symbol Tree; Decompile window shows pseudocode for selected function.
Accept default analysis on $RE_LAB crackmes; note sha256 in project notes field.
Command guide
Try these commands — Import and analyze workflow
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Ghidra — https://ghidra.re/ (download and install for GUI decompilation) Ghidra docs — https://ghidra.re/courses/GhidraClass/ (official training literacy) objdump — https://man7.org/linux/man-pages/man1/objdump.1.html (CLI baseline before GUI)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install binutils
macOS: Built-in (Xcode CLI) or brew install binutils
Windows: Built-in (PowerShell: Invoke-WebRequest) Use WSL binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
curl -sS https://ghidra-sre.org/ | head -8
curl -sS -o /dev/null -w "Ghidra download page HTTP %{http_code}
" https://github.com/NationalSecurityAgency/ghidra/releases
objdump -d "$LAB_RE/bin/hello" | grep -A10 '<main>:' | head -12
echo 'Ghidra GUI (after objdump): File > New Project > Import $LAB_RE/bin/hello > Analyze > Window > Decompile'Primary tools to practice this lesson: curl, objdump. Reference sites: Ghidra (https://ghidra.re/); Ghidra docs (https://ghidra.re/courses/GhidraClass/); objdump (https://man7.org/linux/man-pages/man1/objdump.1.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rename, retype, comment
Rename nonsense FUN_ labels to meaningful names matching source if toy binary. Retype char* for string args. Comments document CMP/JMP gates — not crack steps for commercial apps.
Export decompilation snippet to chmod 600 text for writeup — methodology, not one-click patch file.
3. Ghidra literacy boundaries
Forbidden: Ghidra scripts for mass commercial cracking, sharing patched binaries from Ghidra exports, or analyzing employer IP without written authorization.
Ship: Ghidra workflow checklist — import, analyze, rename three symbols, one comment on gate. Next: IDA/Binary Ninja Named.
4. What you ship: Ghidra workflow checklist for $RE_LAB
Import/analyze/rename/comment steps on YOUR toy. $RE_LAB project path. NEVER commercial patch exports. chmod 600.
5. What you record before the next lesson
Date. Ghidra checklist. $RE_LAB named. File t23-m05-l02-ghidra-literacy.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Export patched commercial exe from Ghidra. Skip project notes on target sha256.
Right
Write Ghidra workflow checklist for $RE_LAB toy. Next: IDA/Binary Ninja Named.
Mission: document YOUR Ghidra workflow
1) List import → analyze → rename → comment steps. 2) Name three symbols you will rename on YOUR toy. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Decompiler pseudocode bridges asm and source thinking.
Knowledge Check
APPLY: Ghidra literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Ghidra Decompile window shows C-like pseudocode.
True or False
Knowledge Check
APPLY: Renaming FUN_ labels helps by:
Multiple choice