A guide to using the Ghidra software reverse engineering tool suite.

The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency''s most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world''s most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere -- and <The Ghidra Book< is the one and only guide you need to master it.

In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra''s components, features, and unique capacity for group collaboration. You''ll learn how to:

<lNavigate a disassembly
</l<lUse Ghidra''s built-in decompiler to expedite analysis
</l<lAnalyze obfuscated binaries
</l<lExtend Ghidra to recognize new data types
</l<lBuild new Ghidra analyzers and loaders
</l<lAdd support for new processors and instruction sets
</l<lScript Ghidra tasks to automate workflows
</l<lSet up and use a collaborative reverse engineering environment
</l

Designed for beginner and advanced users alike, <The Ghidra Book< will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro.

Autorentext
Dr. Kara Nance is a private security consultant and has been a professor of computer science for many years. She regularly speaks at conferences around the world and enjoys building Ghidra extensions as well as providing Ghidra training. 

Chris Eagle has been reverse engineering software for 45 years. He is the author of The IDA Pro Book (No Starch Press) and is a highly sought-after provider of reverse engineering training.

Klappentext

Dance with the Dragon

“A must-read for any reverse engineer.”
­—Max “Libra” Kersten

Developed through more than a decade of research within the NSA, Ghidra was created to address some of the most challenging reverse engineering problems faced by the US government. With its open source release, this formerly restricted tool suite is now freely available to cybersecurity practitioners, researchers, and students worldwide. The Ghidra Book provides a clear, practical guide to understanding and using this powerful platform.

In addition to introducing core reverse engineering techniques for software and malware analysis, the book explains Ghidra’s key components, features, and support for extensibility and collaborative analysis. Beginning with the fundamentals and progressing to more advanced workflows, you’ll learn how to use Ghidra effectively and adapt it to new challenges.

You’ll learn how to:

• Navigate and interpret a disassembly
• Use Ghidra’s built-in decompiler to expedite analysis
• Analyze unfamiliar and obfuscated binaries
• Extend Ghidra to recognize new data types
• Build custom analyzers, loaders, and processor support modules
• Script Ghidra tasks to automate analysis tasks
• Set up a collaborative reverse engineering environment
  This fully revised second edition reflects the modern Ghidra platform as it is used in practice, with updated tooling, improved workflows, and hands-on real-world examples. Designed for beginners and experienced users alike, The Ghidra Book prepares you to tackle real reverse engineering problems with confidence.

New to this edition:

• Behavioral analysis with BSim
• Full Python 3 support via PyGhidra
• Enhanced debugging and graphing tools
• Modern container-based deployment

Inhalt
Acknowledgments
Introduction

Part I: Getting Started
Chapter 1: Introduction to Disassembly
Chapter 2: Reversing and Disassembly Tools
Chapter 3: Meet Ghidra

Part II: Basic Ghidra Usage
Chapter 4: Beginning Your Analysis
Chapter 5: Exploring Ghidra’s Data Displays
Chapter 6: Making Sense of a Disassembly
Chapter 7: Refining a Disassembly
Chapter 8: Working with Data Types and Data Structures
Chapter 9: Understanding Cross-References
Chapter 10: Using Graph Views

Part III: Customizing and Extending Ghidra
Chapter 11: Using Ghidra Collaboratively
Chapter 12: Customizing Ghidra
Chapter 13: Extending Ghidra’s Worldview
Chapter 14: Basic Scripting with Ghidra and PyGhidra
Chapter 15: Integrated Scripting with Eclipse and GhidraDev
Chapter 16: Running Ghidra in Headless Mode

Part IV: A Deeper Dive
Chapter 17: Loaders
Chapter 18: Processors
Chapter 19: The Decompiler
Chapter 20: Compiler Variations

Part V: Real-World Applications
Chapter 21: Obfuscation and Emulation
Chapter 22: Patching Binaries
Chapter 23: BSim and Other Comparison Tools

Appendix: Ghidra for IDA Users
Index**
**