Ghidra – First impressions of the NSA Reverse Engineering Tool

Ghidra is a reverse engineering tool, written in Java, that was recently open-sourced by the National Security Agency (NSA). You can find the Github page here and the download link here.

Once downloaded you will need to depackage (dpkg) the Debian file. We have installed it on our Kali Linux box to complement the tools we already have.

$199 ENROLLS YOU INTO OUR SELF PACED COURSE – LFS264 – OPNFV FUNDAMENTALS!

The documentation that comes with the tools is very detailed and let’s you know how to install and use the tool. This is our first impression.

When we installed the software we are presented with a small GUI. We will need to upload a file to the platform for inspection so we wrote a simple “Hello World” Python program to test.

To upload a file is simple, choose File> Import File.

ghid7

We can see our file has uploaded successfully. So now we just click on the dragon icon over the file for inspection. Next we need to run a Ghidra script against our file. To choose a script we just need to click on the green play button on the software. There is a lot of scripts to choose from (237 to be exact).

ENROLL TODAY IN THE SELF PACED COURSE – LFS263 – ONAP FUNDAMENTALS FOR $199!

ghidra2

To use of the the scripts we just need to check the box beside the file and right click to run it.

ghidra3

As we can see from the image above we can modify the code if we like in either Eclipse or a built in basic editor.

$299 REGISTERS YOU FOR OUR NEWEST SELF PACED COURSE! LFD201 – INTRODUCTION TO OPEN SOURCE DEVELOPMENT, GIT, AND LINUX!

When we run a script we inspect the results in the console below the Listing pane.

ghidra

As we can see, the toll has been well developed and all scripts are nicely put into handy folders for us and named appropriately, which can be helpful if you don’t have much time.

ghidra4

The Listing pane also gives us a lot of information on the addresses in RAM where the bits reside.

REGISTER TODAY FOR YOUR KUBERNETES FOR DEVELOPERS (LFD259) COURSE AND CKAD CERTIFICATION TODAY! $499!    $299 now!!

ghidra5

We did not have much time to do much more testing but more posts will follow so like, share and follow and stay tuned for more blogs about the tool in the near future.

Thank for reading and I hope the article was informative. Enjoy the tool guys!!

QuBits 2019-03-13

LFD430

 

 

 

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.