A guide to using the Ghidra software reverse engineering tool suite. The ability to analyze
software with a disassembler is a crucial reverse engineering skill and one of the core
competencies expected of malware analysts and software security researchers. Ghidra is one of
the world's most capable disassemblers and it's the only one that includes an environment for
collaborative reverse engineering. Ghidra is also a comprehensive open source tool suite and a
powerful alternative to the commercial competitors that come with a hefty price tag and steep
learning curve. The Ghidra Book teaches you how to use Ghidra to answer the hardest problems
about software behavior. It is a tutorial about Ghidra's features that includes instructions on
how to use and modify the open source software to make it meet the needs of any individual or
organization. The book begins with some background on the reverse engineering process. You are
then introduced to important Ghidra features together with examples showing how to customize
and augment the suite. You'll learn how to: • Navigate a disassembly • Use Ghidra's built-in
decompiler to expedite analysis • Analyze obfuscated binaries • Extend Ghidra to recognize new
data types • Build new Ghidra analyzers • Build new Ghidra loaders • Add support for new
processors and instruction sets • Script Ghidra tasks to automate workflows • Set up and use a
collaborative reverse engineering environment By the end of the book readers will have learned
how to use Ghidra efficiently and maximize its effectiveness.
