Ghidra

Reverse engineering — decompiler, XREFs, shortcuts & headless analysis

Ghidra Cheat Sheet

Ghidra is the NSA's open-source software reverse-engineering suite: a disassembler and decompiler for static analysis of binaries across many architectures. This sheet covers the workflow, key windows, and default shortcuts. For authorized testing only.

1. Project & import workflow

File → New Project          (Non-Shared for solo work)
File → Import File...        drag a binary in, or Batch Import a folder
Double-click the file →      open in CodeBrowser
"Analyze?" → Yes →           run Auto-Analysis (accept defaults first pass)

# Headless analysis (CLI) — scriptable, no GUI
analyzeHeadless <project_dir> <ProjName> -import ./binary
analyzeHeadless <project_dir> <ProjName> -process ./binary -postScript MyScript.py

2. Core windows

Window	What it shows
Listing	Disassembly (the main center view)
Decompiler	C-like pseudocode of the current function
Symbol Tree	Imports, Exports, Functions, Labels, Classes
Functions	Flat list of all functions
Defined Strings	Recovered strings + addresses
Program Trees	Memory sections (.text, .data …)
Bytes	Raw hex editor
Function Graph	Control-flow graph of a function

Open any from Window →.

3. Essential shortcuts (defaults)

Key	Action
G	Go to address / symbol
L	Rename label / variable / function
;	Add a comment (EOL)
T	Edit data type at cursor
D	Disassemble
C	Clear code bytes (back to undefined)
F	Create function
Ctrl+Shift+E	Edit function signature
Ctrl+Shift+G	Copy special / address
Ctrl+L	Set equate / change number format
Ctrl+Alt+R	Re-run analysis
Alt+← / Alt+→	Navigate back / forward
Space	Toggle Listing ⇄ Function Graph

4. Navigation & search

G                      → jump to address (e.g. 0x401136) or symbol (main)
Search → Memory...     → byte/string/regex search across the image
Search → For Strings   → enumerate strings, then double-click to jump
Search → Program Text  → search instructions/comments/labels
Right-click → References → Show References to (XREFs to a function/data)

XREFs are the workhorse: right-click a function/string → References → Show References to Address to find every caller.

5. Decompiler usage

• Click any function → the Decompiler renders pseudocode.
• Press L on a variable to rename it; Ctrl+L to retype it — the decompiler updates live.
• Ctrl+Shift+E to fix a wrong function signature (return type / params).
• Right-click a variable → Highlight to trace its data flow.
• Right-click a constant → Set Equate to swap a magic number for a named flag.
• Right-click in decompiler → References → Find Uses of to track a symbol.

6. Defining & fixing data

T            → apply a data type (e.g. char[16], int *, a struct)
Right-click → Data → choose type (string, dword, pointer...)
Create struct: Data Type Manager → right-click → New → Structure
Apply struct over memory, then label fields with L

7. Recommended analysis flow

1. Import → run Auto-Analysis with defaults.
2. Symbol Tree → Exports → double-click `main` (or `entry`).
3. Read the Decompiler; rename (L) variables/functions as you understand them.
4. Search → For Strings; XREF interesting strings ("flag", "password", "/bin/sh").
5. Follow calls into helper functions; annotate with comments (;).
6. For obfuscation, identify the decode routine → script it (Window → Script Manager).

8. Scripting

Window → Script Manager      → browse/run bundled scripts
Create New Script            → Python (Jython) or Java

# Ghidra Python (Jython) — flat API basics
fm = currentProgram.getFunctionManager()
for f in fm.getFunctions(True):
    print(f.getName(), f.getEntryPoint())

# current cursor / selection
print(currentAddress)
print(getFunctionContaining(currentAddress))

# read bytes / define a label
print(getBytes(toAddr(0x401000), 16))
createLabel(toAddr(0x401136), "decode_flag", True)

PyGhidra (CPython 3) is available in recent versions for native-Python scripting.

9. Patching & export

Bytes window → enable "Edit" → overwrite hex to patch instructions.
File → Export Program... → choose:
   • Original File / Binary  (save patched bytes)
   • C/C++                   (decompiled pseudocode)
   • ASCII / HTML            (listing)

10. Tips

• Diff two binaries with the Version Tracking tool or the BSim feature for similar-function matching.
• Set the language/processor manually on import if auto-detection misfires (e.g. ARM Thumb, MIPS endianness).
• Use bookmarks (Ctrl+D) to mark spots you'll revisit during a long RE session.
• The decompiler is a model, not ground truth — cross-check against the Listing when it looks wrong.

Authorized testing only. Practice on the AYSEC challenges. Pair with GDB + pwndbg for dynamic analysis of the same binary.