MAA
Start free

Ghidra

Tool

Ghidra Cheatsheet

What It Is

NSA's free and open-source reverse engineering framework with disassembler and decompiler.

Quick Start

  1. Import binary: File → Import File
  2. Auto-analyze when prompted (select all analyzers)
  3. Navigate using Symbol Tree, Functions list, or search

Key Windows

WindowPurpose
ListingDisassembly view
DecompileC-like pseudocode
Symbol TreeFunctions, labels, imports
Data Type ManagerType definitions
BytesRaw hex view

Essential Shortcuts

  • G – Go to address
  • L – Label/rename
  • T – Set data type
  • Ctrl+Shift+F – Find string
  • X – Show cross-references
  • `` – Toggle comment
  • Ctrl+E – Edit function signature

Analysis Workflow

  1. Find main or entry point
  2. Rename functions as you understand them
  3. Follow cross-references (X key) to trace data flow
  4. Focus on API calls (imports) to understand behavior
  5. Add comments as you go

Common Mistakes

  • Not running auto-analysis on import
  • Trying to read everything linearly (follow execution flow instead)
  • Ignoring the decompiler window (it's usually more readable)