DOCSEARCHbyAlgolia
Submit Docs

Ghidra Software Reverse Engineering Framework

repository·master·Indexed 13 days ago

https://github.com/nationalsecurityagency/ghidra

A professional-grade software reverse engineering (SRE) framework developed by the NSA, providing tools for disassembly, decompilation, and analysis across various processor architectures. It includes support for headless analysis, GUI mode, and server configurations, as well as debugger agents for GDB, LLDB, x64dbg, and drgn via Trace RMI. Features include a Taint Analysis Module, BSim for signature generation with Elasticsearch integration, and Python 3 bindings via PyGhidra and ghidratrace.

Tokens
180.1K
Snippets
410
Records
834
Agent score
99%

What's inside Ghidra

  1. Overview of the Debugger Ghidra Class courseware

    master
    The Debugger Ghidra Class provides training courseware for using the Ghidra Debugger. While the material is primarily developed for Linux user-space targets, the core concepts, user interface, and workflows are largely consistent across different platforms and instruction set architectures (ISAs). Users should expect minor differences in initial setup, target behavior subtleties, and specific instruction sets depending on their environment.

  3. Overview of PyGhidra capabilities

    master

    PyGhidra is a module designed to integrate Python into the Ghidra environment. It provides four primary capabilities:

    1. PyGhidra Python library: A dedicated Python library and its dependencies for interacting with Ghidra.
    2. CPython Interpreter Plugin: A Ghidra plugin that provides a CPython interpreter within the Ghidra application.
    3. Native CPython 3 ScriptProvider: A provider that allows Ghidra to execute GhidraScripts written in native CPython 3.
    4. Interactive Python Launcher: An interactive script (support/pyghidra_launcher.py) used by Ghidra to install and launch PyGhidra, which manages virtual environments and handles externally managed environments.

  4. Introduction to the Headless Analyzer

    master

    The Headless Analyzer is a command-line, non-GUI version of Ghidra designed for automation and repetitive tasks. It allows you to perform operations without the Ghidra desktop interface, which is ideal for CI/CD pipelines or bulk processing.

    Core Capabilities:

    • Project Management: Create and populate Ghidra projects.
    • Binary Analysis: Import new binaries or process existing ones already in a project.
    • Scripting: Run non-GUI Ghidra scripts (program-dependent or program-independent) as pre-processing or post-processing steps.
    • Automation: Perform bulk imports/processing of directories or files using wildcards.
    • Control: Dictate program disposition (e.g., aborting analysis or deleting files after processing) via scripts.

    Important Usage Notes:

    • Concurrency: The Headless Analyzer may fail to run if the specified project is currently open in the Ghidra GUI.
    • Hidden Files: In bulk mode (importing directories or using wildcards), files starting with . are ignored by default. However, explicitly naming a hidden file (e.g., -import /path/to/.hidden.exe) will force its import.
    • Logging: Log redirection is only supported if Log4J is being used.

  5. New features in Ghidra 10.3

    master

    Ghidra 10.3 introduced several significant features across various modules:

    • Analysis: Initial support for Golang binary analysis (Go 1.18).
    • Debugger:
      • Added breakpoint indicators to the Decompiler margin.
      • Added Debugger control actions to the global toolbar.
      • Created independent launchers for Debugger agents.
      • Added a dedicated Emulator tool.
      • Added ability to export/serve symbols and types as Volatility ISF JSON.
      • Added hover tooltips for variable values in the Static Listing, Decompiler, and Dynamic Listing.
      • Added support for setting node timeouts and initial directory parameters.
    • Pcode: Introduced support for the lzcount operator in SLEIGH, the Decompiler, and emulation, which returns the count of leading zero bits.
    • Processors: Added support for eBPF and BPF processors.
    • GUI: Added dark theme support and the ability for programs to open to their last closed location by default.
    • Scripting: Added AssociateExternalPELibrariesScript to fix up external references for PE programs by associating imported library files.

  7. New features in Ghidra 9.1

    master

    Ghidra 9.1 introduced several significant features across various domains:

    • Data Types: Added bit-field support to the Structure and Union editor, including a dedicated Bit-field Editor for explicit placement in non-packed structures.
    • Eclipse Integration: Includes the GhidraSleighEditor Eclipse plugin (located in Extensions/Eclipse within the installation directory).
    • GUI Improvements:
      • Control-click the only sorted table column to turn off table sorting.
      • Hovering on an address displays its origin in the imported file.
    • Importers: Added a new loader for DYLD-shared cache files (Mach-O).
    • Memory API: New API to preserve original program bytes and their mapping to memory blocks.
    • Processors: Added support for Intel MCS-96, SH1/2/2a, Tricore, HCS12X, HCS05, HCS08, SH4, and MCS-48.
    • Sleigh Development: Added SleighDevTools and GnuDisassembler extension modules. Supports pcode JUnit tests using emulation of cross-compiled C code to verify instruction semantics.