Përdorimi i Ghidra

Ghidra is a free, open-source reverse engineering framework released by the NSA in 2019 and now widely used by both defenders and researchers as an alternative to IDA Pro.

Ghidra can load most executable formats — PE, ELF, Mach-O, raw binaries — and disassembles them into an interactive listing. It also includes a powerful decompiler that produces C-like pseudo-code from disassembly, making unfamiliar architectures much more approachable. The decompiler is integrated with the listing view: renaming a variable in one view updates it in the other. A typical workflow: open the sample, let Ghidra auto-analyze, start from the entry point, and follow the call graph into interesting functions. Rename functions and variables as you learn what they do. Use the symbol tree to find imports (LoadLibraryA, VirtualAlloc) and see which functions call them. Use the cross-reference view to pivot from an interesting string or API call to the functions that use it. Save your project regularly — Ghidra uses a database-backed format and incremental saves are cheap. For malware-focused analysis, extensions like Ghidra Scripts (Python-style GhidraScript and P-code based Java scripts) let you automate common tasks: resolving obfuscated API calls, decoding strings with a known XOR key, finding CFG anomalies. Combined with a good note-taking habit, Ghidra can take you from a fresh sample to a usable report in a day for most commodity malware.

Mjete:

• Ghidra (NSA, open-source).
• IDA Free / Pro — standardi komercial.
• Binary Ninja, radare2/Cutter — alternative.

Workflow tipik në Ghidra:

1. Create Project → Import file (sample.exe).
2. Auto-analyze me default settings.
3. Hap Functions list, fillo nga entry ose WinMain.
4. Përdor Defined Strings → double-click → XRefs për të gjetur ku përdoret string-u.
5. Rename funksionet (shortcut L) dhe tipizo strukturat.

1. Analizo një crackme nga crackmes.one niveli 1/5 me Ghidra.
2. Ngarkon një PDB ose symbols nëse ka dhe krahaso rezultatin.

• Ghidra Docs (NSA).
• Kursi i Hex-Rays për IDA.