Ghidra
Master Ghidra for CTF reverse engineering - navigation, decompilation, scripting, and analysis.
Ghidra
Ghidra is the NSA's open-source reverse engineering suite that combines disassembly, decompilation, and analysis tools to convert compiled binaries into readable pseudocode and C-like source for analysis. How it works: Decompiler uses static analysis to identify functions, recover variables, recognize control flow structures (loops, conditionals); supports manual annotation, renaming, cross-referencing; plugins enable scripting for automation across multiple architectures (x86, ARM, MIPS, PPC). Why it matters: Free alternative to expensive IDA Pro; handles multiple binary formats (ELF, PE, Mach-O) and architectures; active community contributes plugins; essential for CTF reversing when source code is unavailable.
Analysis Workflow
Installation
# Java required (JDK 17+)
sudo apt install openjdk-17-jdk
# Download from https://ghidra-sre.org/
wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1_build/ghidra_11.1_PUBLIC_20240607.zip
unzip ghidra_11.1_PUBLIC_20240607.zip
cd ghidra_11.1_PUBLIC
./ghidraRunFirst-Time Analysis
Create Project and Import
Launch Ghidra → New Project (non-shared) → File → Import File → select binary.
Run Auto-Analysis
Double-click the binary → CodeBrowser opens → auto-analyze dialog appears → accept defaults → Analyze. Wait 30 seconds to several minutes.
Navigate to Main
Symbol Tree (left panel) → expand Functions → find main. Double-click to navigate.
Read the Decompiler
Window → Decompile panel shows C-like pseudocode. This is your primary view.
Rename and Retype
Select a variable → press L to rename (e.g. local_28 → input_buffer). Press Ctrl+L to retype when the declared type is wrong.
Interface Overview
| Panel | Description |
|---|---|
| Symbol Tree | Functions, labels, namespaces - navigate to main, win, etc. |
| Listing | Assembly disassembly view |
| Decompile | C-like pseudocode (most useful!) |
| Program Trees | Memory segments (.text, .data, .bss) |
| Defined Strings | All strings found in the binary |
Essential Keyboard Shortcuts
G Go to address (0x401234 or function name)
L Rename variable or label
Ctrl+L Retype a variable (change declared type)
X Show cross-references (who calls this?)
Ctrl+F Text search in decompiler
Alt+← Go back
Alt+→ Go forward
; Add a comment at current address
Ctrl+D Bookmark current addressCommon CTF Patterns
/* Decompiler output: */
iVar1 = strcmp(input, "s3cr3t_p4ssw0rd");
if (iVar1 == 0) {
puts("Correct! Flag: flag{...}");
}The password is right there - submit it directly.
Finding the Flag Logic
Ghidra vs IDA vs Binary Ninja
| Feature | Ghidra | IDA Free | Binary Ninja |
|---|---|---|---|
| Price | Free | Free (limited) | Paid |
| Decompiler | Excellent | Hex-Rays (paid) | Good |
| Scripting | Python/Java | IDApython | Python |
| Plugin ecosystem | Growing | Large | Growing |
| Best for CTF | Yes | Industry standard | Fast UI |
Checklist
- Let auto-analysis finish before browsing
- Rename variables as you go - legible code is solved code
- Check Defined Strings for hardcoded flags/keys
- Use
X(XREFs) to trace data flow - If decompilation looks wrong - check assembly in Listing view
- Bookmark interesting addresses with
Ctrl+D
Last updated on