Ghidra Reverse Engineering

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-reverse.md

2. NOW

   : Confirm the need for Ghidra (No IDA / Prefer open source / Batch headless)

3. NEXT

   : Read

   ../tool-index.md

   to check the path of ghidra / ghidra-mcp

4. NEXT

   : If tools are missing → bootstrap

   ghidra-mcp

   (if manifest supports) or install Ghidra manually

5. ACT

   : Import sample → Auto-analyze → Export decompilation of key functions

Applicable Scenarios

• Primary reverse engineering entry when IDA license is unavailable
• Batch headless analysis / decompilation in CI
• Automation with Ghidra scripts (Java/Python Jython/PyGhidra)
• Integration with ghidriff from

  binary-diff

  /

  patch-diff-exploit

Division of Labor with IDA

ida-reverse/

radare2/

Workflow

1. Project and Auto-Analysis

□ Create new Project → Import file → Analyze (default analyzer)
□ Record language/compiler recognition results and base address
□ Mark entry points, export tables, string xrefs

2. Key Functions

□ Trace back from strings / imported APIs
□ Restore algorithm in Decompile window
□ Rename functions/variables; write Plate comment
□ Hand over to Frida/GDB for dynamic analysis when needed (reverse-engineering dynamic chapter)

3. Headless (Batch Processing)

# Example: analyzeHeadless path varies by installation, MUST retrieve from tool-index
analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.py

4. MCP (If Configured)

□ Confirm ghidra MCP port (commonly 8765, refer to tool-index)
□ Pull decompilation / xrefs using MCP tool, do not guess ports

Toolchain

ghidra-mcp

patch-diff-exploit

References

• references/ghidra-cheatsheet.md

• ../ida-reverse/

  ../radare2/

  ../binary-diff/

Routing Context

pwn-chain

ida-reverse

Task Completion Self-Check

• Is it based on real Ghidra/tool-index path?
• Are function addresses and renames annotated?
• Are there reproducible steps?
• Is there a Checklist / journal?