Items related to The Ghidra Book: The Definitive Guide

The Ghidra Book: The Definitive Guide - Softcover

  • 4.33 out of 5 stars
    36 ratings by Goodreads
 
9781718501027: The Ghidra Book: The Definitive Guide

Synopsis

A guide to using the Ghidra software reverse engineering tool suite.

The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency's most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world's most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere -- and The Ghidra Book is the one and only guide you need to master it.

In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra's components, features, and unique capacity for group collaboration. You'll learn how to:

  • Navigate a disassembly
  • Use Ghidra's built-in decompiler to expedite analysis
  • Analyze obfuscated binaries
  • Extend Ghidra to recognize new data types
  • Build new Ghidra analyzers and loaders
  • Add support for new processors and instruction sets
  • Script Ghidra tasks to automate workflows
  • Set up and use a collaborative reverse engineering environment

  • Designed for beginner and advanced users alike, The Ghidra Book will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro.

    "synopsis" may belong to another edition of this title.

    About the Author

    Chris Eagle has been reverse engineering software for 40 years. He is the author of The IDA Pro Book (No Starch Press) and is a highly sought-after provider of reverse engineering training. He has published numerous reverse engineering tools and given numerous talks at conferences such as Blackhat, Defcon, and Shmoocon.

    Dr. Kara Nance is a private security consultant. She has been a professor of computer science for many years. She has served on the Honeynet Project Board of Directors and has given numerous talks at conferences around the world. She enjoys building Ghidra extensions and regularly provides Ghidra training

    Excerpt. © Reprinted by permission. All rights reserved.

    INTRODUCTION

    Our goal in writing this book is to provide a resource that introduces Ghidra to both current and future reverse engineers. In the hands of a skilled reverse engineer, Ghidra streamlines the analysis process and allows users to customize and extend its capabilities to suit their individual needs and improve their workflows. Ghidra is also very accessible to new reverse engineers, particularly with its included decompiler that can help them more clearly understand the relationships between high-level language and disassembly listings as they begin exploring the world of binary analysis.

    Writing a book about Ghidra is a challenging undertaking. Ghidra is a complex open source reverse engineering tool suite that is continually evolving. Our words describe a moving target, as the Ghidra community continues to improve and extend its capabilities. As with many new open source projects, Ghidra has begun its public life with a rapid string of evolutionary releases. A primary goal while writing this book has been to ensure that as Ghidra evolves, the book’s content continues to provide readers with a wide and deep foundation of knowledge to understand and effectively utilize current and future Ghidra versions to address their reverse engineering challenges. As much as possible, we have tried to keep the book version-agnostic. Fortunately, new releases of Ghidra are well-documented, with detailed listings of changes that provide version-specific guidance should you encounter any differences between the book and your version of Ghidra.

    About This Book

    This book is the first comprehensive book about Ghidra. It is intended to be an all-encompassing resource for reverse engineering with Ghidra. It provides introductory content to bring new explorers to the reverse engineering world, advanced content to extend the worldview of experienced reverse engineers, and examples for rookie and veteran Ghidra developers alike to continue to extend Ghidra’s extensive capabilities and become contributors to the Ghidra community.

    Who Should Read This Book?

    This book is intended for aspiring and experienced software reverse engineers. If you don’t already have reverse engineering experience, that’s okay, as the early chapters provide the background material necessary to introduce you to reverse engineering and enable you to explore and analyze binaries with Ghidra. Experienced reverse engineers who want to add Ghidra to their toolkits might choose to move quickly through the first two parts to gain a basic understanding of Ghidra and then jump to specific chapters of interest. Experienced Ghidra users and developers may choose to focus on the later chapters so that they can create new Ghidra extensions and can apply their experience and knowledge to contribute new content to the Ghidra project.

    What’s in This Book?

    The book is divided into five parts. Part I introduces disassembly, reverse engineering, and the Ghidra project. Part II covers basic Ghidra usage. Part III demonstrates ways you can customize and automate Ghidra to make it work for you. Part IV takes a deeper dive into explaining specific types of Ghidra modules and supporting concepts. Part V demonstrates how Ghidra can be applied to some real-world situations a reverse engineer is likely to encounter.

    Part I: Introduction

    Chapter 1: Introduction to Disassembly
    This introductory chapter walks you through the theory and practice of disassembly and discusses some of the pros and cons associated with the two common disassembly algorithms.

    Chapter 2: Reversing and Disassembly Tools
    This chapter discusses the major categories of tools available for reverse engineering and disassembly.

    Chapter 3: Meet Ghidra
    Here you get to meet Ghidra and learn a little bit about its origin and how you can obtain and start using this free open source tool suite.

    Part II: Basic Ghidra Usage

    Chapter 4: Getting Started with Ghidra
    Your journey with Ghidra begins in this chapter. You’ll get your first glimpse of Ghidra in action as you create a project, analyze a file, and begin to understand the Ghidra graphical user interface (GUI).

    Chapter 5: Ghidra Data Displays
    Here you’ll be introduced to the CodeBrowser, Ghidra’s main tool for file analysis. You’ll also explore the primary CodeBrowser display windows.

    Chapter 6: Making Sense of a Ghidra Disassembly
    This chapter explores the concepts that are fundamental to understanding and navigating Ghidra disassemblies.

    Chapter 7: Disassembly Manipulation
    In this chapter, you’ll learn to supplement Ghidra’s analysis and manipulate a Ghidra disassembly as part of your own analysis process.

    Chapter 8: Data Types and Data Structures
    In this chapter, you will learn how to manipulate and define simple and complex data structures found within compiled programs.

    Chapter 9: Cross-References
    This chapter provides a detailed look at cross-references, how they support graphing, and the critical role they play in understanding a program’s behavior.

    Chapter 10: Graphs
    This chapter introduces you to Ghidra’s graphing capabilities and the use of graphs as binary analysis tools.

    Part III: Making Ghidra Work for You

    Chapter 11: Collaborative SRE
    This chapter presents a unique capability within Ghidra—using Ghidra as a collaborative tool. You will learn how to configure a Ghidra server and share projects with other analysts.

    Chapter 12: Customizing Ghidra
    Here you begin to see how you can customize Ghidra by configuring projects and tools to support your individual analysis workflows.

    Chapter 13: Extending Ghidra’s Worldview
    This chapter teaches you how to generate and apply library signatures and other specialized content so that Ghidra can recognize new binary constructs.

    Chapter 14: Basic Ghidra Scripting
    In this chapter, you’ll be introduced to the basic Ghidra scripting capabilities in Python and Java using Ghidra’s inline editor.

    Chapter 15: Eclipse and GhidraDev
    This chapter takes your Ghidra scripting to a whole new level by integrating Eclipse into Ghidra and exploring the powerful scripting capabilities that this combination provides, including a worked example of building a new analyzer.

    Chapter 16: Ghidra in Headless Mode
    You’ll be introduced to the use of Ghidra in headless mode, where no GUI is required. You will quickly understand the advantage of this mode for common large-scale repetitive tasks.

    Part IV: A Deeper Dive

    Chapter 17: Ghidra Loaders
    Here you’ll take a deep dive into how Ghidra imports and loads files. You will have the opportunity to build new loaders to handle previously unrecognized file types.

    Chapter 18: Ghidra Processors
    This chapter introduces you to Ghidra’s SLEIGH language for defining processor architectures. You will explore the process for adding new processors and instructions to Ghidra.

    Chapter 19: The Ghidra Decompiler
    Here you’ll be provided with a closer look at one of Ghidra’s most popular features: the Ghidra Decompiler. You will see how it works behind the scenes and how it can contribute to your analysis process.

    Chapter 20: Compiler Variations
    This chapter helps you understand the variations you can expect to see in code compiled using different compilers and targeting different platforms.

    Part V: Real-World Application

    Chapter 21: Obfuscated Code Analysis
    You’ll learn how to use Ghidra to analyze obfuscated code in a static context so that the code doesn’t need to be executed.

    Chapter 22: Patching Binaries
    This chapter teaches you some methods for using Ghidra to patch binaries during analysis, both within Ghidra itself and to create new patched versions of the original binaries.

    Chapter 23: Binary Differencing and Version Tracking
    This final chapter provides an overview of the Ghidra features that allow you to identify differences between two binaries as well as a brief introduction to Ghidra’s advanced version tracking capabilities.

    Appendix: Ghidra for IDA Users
    If you are an experienced IDA user, this appendix will provide you with tips and tricks for mapping IDA terminology and usage to similar functionality in Ghidra.

    "About this title" may belong to another edition of this title.

    Buy Used

    Condition: Good
    May show signs of wear, highlighting...
    View this item

    US$ 2.64 shipping within U.S.A.

    Destination, rates & speeds

    Search results for The Ghidra Book: The Definitive Guide

    Seller Image

    Eagle, Chris; Nance, Kara
    Published by No Starch Press, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    Used Softcover

    Seller: GreatBookPrices, Columbia, MD, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: good. May show signs of wear, highlighting, writing, and previous use. This item may be a former library book with typical markings. No guarantee on products that contain supplements Your satisfaction is 100% guaranteed. Twenty-five year bookseller with shipments to over fifty million happy customers. Seller Inventory # 40972677-5

    Contact seller

    Buy Used

    US$ 39.01
    Convert currency
    Shipping: US$ 2.64
    Within U.S.A.
    Destination, rates & speeds

    Quantity: 4 available

    Add to basket

    Stock Image

    Eagle, Chris, Nance, Kara
    Published by No Starch Press, Incorporated, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    Used Softcover

    Seller: Better World Books, Mishawaka, IN, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: Good. Used book that is in clean, average condition without any missing pages. Seller Inventory # 52808707-6

    Contact seller

    Buy Used

    US$ 41.66
    Convert currency
    Shipping: FREE
    Within U.S.A.
    Destination, rates & speeds

    Quantity: 1 available

    Add to basket

    Seller Image

    Eagle, Chris; Nance, Kara
    Published by No Starch Press, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    Used Softcover

    Seller: GreatBookPrices, Columbia, MD, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: As New. Unread book in perfect condition. Seller Inventory # 40972677

    Contact seller

    Buy Used

    US$ 40.55
    Convert currency
    Shipping: US$ 2.64
    Within U.S.A.
    Destination, rates & speeds

    Quantity: Over 20 available

    Add to basket

    Stock Image

    Nance,Kara
    Published by Penguin Random House
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    Used

    Seller: INDOO, Avenel, NJ, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: As New. Unread copy in mint condition. Seller Inventory # RH9781718501027

    Contact seller

    Buy Used

    US$ 43.20
    Convert currency
    Shipping: FREE
    Within U.S.A.
    Destination, rates & speeds

    Quantity: Over 20 available

    Add to basket

    Seller Image

    Eagle, Chris; Nance, Kara
    Published by No Starch Press, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    New Softcover

    Seller: GreatBookPrices, Columbia, MD, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: New. Seller Inventory # 40972677-n

    Contact seller

    Buy New

    US$ 40.57
    Convert currency
    Shipping: US$ 2.64
    Within U.S.A.
    Destination, rates & speeds

    Quantity: Over 20 available

    Add to basket

    Stock Image

    Chris Eagle|Kara Nance
    Published by Penguin Random House
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    New

    Seller: INDOO, Avenel, NJ, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: New. Seller Inventory # 9781718501027

    Contact seller

    Buy New

    US$ 43.22
    Convert currency
    Shipping: FREE
    Within U.S.A.
    Destination, rates & speeds

    Quantity: Over 20 available

    Add to basket

    Seller Image

    Kara Nance
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    New Paperback

    Seller: Grand Eagle Retail, Mason, OH, U.S.A.

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Paperback. Condition: new. Paperback. A guide to using the Ghidra software reverse engineering tool suite.A guide to using the Ghidra software reverse engineering tool suite.The result of more than a decade of research and development within the NSA, the Ghidra platform was developed to address some of the agency's most challenging reverse-engineering problems. With the open-source release of this formerly restricted tool suite, one of the world's most capable disassemblers and intuitive decompilers is now in the hands of cybersecurity defenders everywhere -- and The Ghidra Book is the one and only guide you need to master it.In addition to discussing RE techniques useful in analyzing software and malware of all kinds, the book thoroughly introduces Ghidra's components, features, and unique capacity for group collaboration. You'll learn how to-Navigate a disassemblyUse Ghidra's built-in decompiler to expedite analysisAnalyze obfuscated binariesExtend Ghidra to recognize new data typesBuild new Ghidra analyzers and loadersAdd support for new processors and instruction setsScript Ghidra tasks to automate workflowsSet up and use a collaborative reverse engineering environmentDesigned for beginner and advanced users alike, The Ghidra Book will effectively prepare you to meet the needs and challenges of RE, so you can analyze files like a pro. A guide to using the Ghidra software reverse engineering tool suite. Shipping may be from multiple locations in the US or from the UK, depending on stock availability. Seller Inventory # 9781718501027

    Contact seller

    Buy New

    US$ 51.49
    Convert currency
    Shipping: FREE
    Within U.S.A.
    Destination, rates & speeds

    Quantity: 1 available

    Add to basket

    Stock Image

    Eagle, Chris; Nance, Kara
    Published by No Starch Press, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    New Softcover

    Seller: Books Puddle, New York, NY, U.S.A.

    Seller rating 4 out of 5 stars 4-star rating, Learn more about seller ratings

    Condition: New. pp. 640. Seller Inventory # 26376886666

    Contact seller

    Buy New

    US$ 49.90
    Convert currency
    Shipping: US$ 3.99
    Within U.S.A.
    Destination, rates & speeds

    Quantity: 3 available

    Add to basket

    Stock Image

    Eagle, Chris
    Published by No Starch Press, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    Used Softcover

    Seller: medimops, Berlin, Germany

    Seller rating 5 out of 5 stars 5-star rating, Learn more about seller ratings

    Condition: very good. Gut/Very good: Buch bzw. Schutzumschlag mit wenigen Gebrauchsspuren an Einband, Schutzumschlag oder Seiten. / Describes a book or dust jacket that does show some signs of wear on either the binding, dust jacket or pages. Seller Inventory # M01718501021-V

    Contact seller

    Buy Used

    US$ 46.74
    Convert currency
    Shipping: US$ 11.61
    From Germany to U.S.A.
    Destination, rates & speeds

    Quantity: 1 available

    Add to basket

    Seller Image

    Chris Eagle, Kara Nance
    Published by No Starch Press,US, US, 2020
    ISBN 10: 1718501021 ISBN 13: 9781718501027
    New Paperback

    Seller: Rarewaves USA, OSWEGO, IL, U.S.A.

    Seller rating 4 out of 5 stars 4-star rating, Learn more about seller ratings

    Paperback. Condition: New. The Ghidra Book teaches readers how to use Ghidra to answer the hardest problems about software behavior. It is a tutorial about Ghidra's features that includes examples and instructions on how to use and modify the open source software to make it meet the needs of any individual or organisation. Seller Inventory # LU-9781718501027

    Contact seller

    Buy New

    US$ 61.39
    Convert currency
    Shipping: FREE
    Within U.S.A.
    Destination, rates & speeds

    Quantity: Over 20 available

    Add to basket

    There are 23 more copies of this book

    View all search results for this book