Ghidra Software Reverse Engineering for Beginners: Analyze, identify, and avoid malicious code and potential threats in your networks and systems 9781800201842, 1800201842

Table of contents :
Ghidra Software Reverse Engineering for Beginners
Why subscribe?
Contributors
About the author
About the reviewer
Packt is searching for authors like you
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Code in Action
Download the color images
Conventions used
Get in touch
Reviews
Section 1: Introduction to Ghidra
Chapter 1: Getting Started with Ghidra
Technical requirements
WikiLeaks Vault 7
NSA release
Ghidra versus IDA and many other competitors
Ghidra overview
Installing Ghidra
Overview of Ghidra's features
Summary
Questions
Chapter 2: Automating RE Tasks with Ghidra Scripts
Technical requirements
Using and adapting existing scripts
The script class
Script development
Summary
Questions
Chapter 3: Ghidra Debug Mode
Technical requirements
Setting up the Ghidra development environment
Overviewing the software requirements
Installing the Java JDK
Installing the Eclipse IDE
Installing PyDev
Installing GhidraDev
Debugging the Ghidra code and Ghidra scripts
Debugging Ghidra scripts from Eclipse
Debugging any Ghidra component from Eclipse
Ghidra RCE vulnerability
Explaining the Ghidra RCE vulnerability
Exploiting the Ghidra RCE vulnerability
Fixing the Ghidra RCE vulnerability
Looking for vulnerable computers
Summary
Questions
Further reading
Chapter 4: Using Ghidra Extensions
Technical requirements
Installing existing Ghidra extensions
Analyzing the code of the Sample Table Provider plugin
Understanding the Ghidra extension skeleton
Analyzers
Filesystems
Plugins
Exporters
Loaders
Developing a Ghidra extension
Summary
Questions
Further reading
Section 2: Reverse Engineering
Chapter 5: Reversing Malware Using Ghidra
Technical requirements
Setting up the environment
Looking for malware indicators
Looking for strings
Intelligence information and external sources
Checking import functions
Dissecting interesting malware sample parts
The entry point function
Analyzing the 0x00453340 function
Analyzing the 0x00453C10 function
Analyzing the 0x0046EA60 function
Analyzing the 0x0046BEB0 function
Analyzing the 0x0046E3A0 function
By analyzing this function, we notice that the pipe is used for some kind of synchronization. The CreateThread API function receives as parameters the function to execute as a thread and an argument to pass to the function; so, when a thread creation appears, we have to analyze a new function – in this case, lpStartAddress_00449049:
Analyzing the 0x004559B0 function
Analyzing the 0x004554E0 function
Analyzing the 0x0046C860 function
Analyzing the 0x0046A100 function
Summary
Questions
Further reading
Chapter 6: Scripting Malware Analysis
Technical requirements
Using the Ghidra scripting API
Writing scripts using the Java programming language
Writing scripts using the Python programming language
Deobfuscating malware samples using scripts
The delta offset
Translating API hashes to addresses
Deobfuscating the hash table using Ghidra scripting
Improving the scripting results
Summary
Questions
Further reading
Chapter 7: Using Ghidra Headless Analyzer
Technical requirements
Why use headless mode?
Creating and populating projects
Performing analysis on imported or existing binaries
Running non-GUI scripts in a project
Summary
Questions
Further reading
Chapter 8: Auditing Program Binaries
Technical requirements
Understanding memory corruption vulnerabilities
Understanding the stack
Stack-based buffer overflow
Understanding the heap
Heap-based buffer overflow
Format strings
Finding vulnerabilities using Ghidra
Exploiting a simple stack-based buffer overflow
Summary
Questions
Further reading
Chapter 9: Scripting Binary Audits
Technical requirements
Looking for vulnerable functions
Retrieving unsafe C/C++ functions from the symbols table
Decompiling the program using scripting
Looking for sscanf callers
Enumerating caller functions
Analyzing the caller function using PCode
PCode versus assembly language
Retrieving PCode and analyzing it
Using the same PCode-based script in multiple architectures
Summary
Questions
Further reading
Section 3: Extending Ghidra
Chapter 10: Developing Ghidra Plugins
Technical requirements
Overview of existing plugins
Plugins included with the Ghidra distribution
Third-party plugins
The Ghidra plugin skeleton
The plugin documentation
Writing the plugin code
The provider for a plugin
Developing a Ghidra plugin
Documenting the plugin
Implementing the plugin class
Implementing the provider
Summary
Questions
Further reading
Chapter 11: Incorporating New Binary Formats
Technical requirements
Understanding the difference between raw binaries and formatted binaries
Understanding raw binaries
Understanding formatted binaries
Developing a Ghidra loader
The old-style DOS executable (MZ) parser
The old-style DOS executable (MZ) loader
Understanding filesystem loaders
FileSystem Resource Locator
Summary
Questions
Further reading
Chapter 12: Analyzing Processor Modules
Technical requirements
Understanding the existing Ghidra processor modules
Overviewing the Ghidra processor module skeleton
Setting up the processor module development environment
Creating a processor module skeleton
Developing Ghidra processors
Documenting processors
Identifying functions and code using patterns
Specifying the language and its variants
Summary
Questions
Further reading
Chapter 13: Contributing to the Ghidra Community
Technical requirements
Overviewing the Ghidra project
The Ghidra community
Exploring contributions
Understanding legal aspects
Submitting a bug report
Suggesting new features
Submitting questions
Submitting a pull request to the Ghidra project
Summary
Questions
Further reading
Chapter 14: Extending Ghidra for Advanced Reverse Engineering
Technical requirements
Learning the basics of advanced reverse engineering
Learning about symbolic execution
Learning about SMT solvers
Learning about concolic execution
Using Ghidra for advanced reverse engineering
Adding symbolic execution capabilities to Ghidra with AngryGhidra
Converting from PCode into LLVM with pcode-to-llvm
Summary
Questions
Further reading
Assessments
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
Chapter 14
Other Books You May Enjoy
Leave a review - let other readers know what you think