Reverse Engineering with Ghidra

⚠️ Authorized testing only. For systems you own or are explicitly permitted to test — labs, CTFs, sanctioned engagements. See Rules of Engagement and Authorization.

Ghidra is the NSA's open-source reverse-engineering suite — it disassembles a compiled binary and decompiles it into readable C-like pseudocode, the core skill for CTF "rev" and "pwn" challenges and malware triage.

#The workflow

1. Import the binary; let Ghidra auto-analyze.
2. Find main (or the entry point) in the Symbol Tree.
3. Read the Decompiler window — pseudocode beside the assembly.
4. Rename variables/functions as you understand them; the picture sharpens fast.

#What you're hunting

#Pair with dynamic analysis

Static reading + a debugger (gdb with pwndbg) to watch it run:

gdb ./binary
break *main
run

Static tells you what could happen; dynamic shows what does. Use both. Leads into Malware Analysis Basics.

Related: Malware Analysis Basics · Building a Home Pentest Lab · CTF Methodology and Writeup Template