# Intermediate Ghidra

STUDENT GUIDE

How to Use Slides

- Use Arrow keys to go to next/previous slide
- Double click page number to edit/jump to specific page
- "withNotes" slide deck contains detailed notes below slides and can be used as a tutorial.
- Click "Pop-up" to launch presentation slides
- Should display correctly in modern versions of all browsers.
- Microsoft Edge displays incorrectly at first. To fix, go to Edge options (...) and click zoom once.

Installing Ghidra

- To install Ghidra unzip the Ghidra installation file:

- ghidra_<version>_<release>_<date>.zip

- <version> is the version number of the release
- <release> is the name of the release
- <date> is the date the release was built

- Platforms Supported:

- Microsoft Windows 7 or 10 (64-bit)
- Linux (64-bit, CentOS 7 is preferred)
- macOS (OS X) 10.8.3+ (Mountain Lion or later)

Notes:

Exercise Files

- Referenced exercise files are located in ghidra_<version>/docs/GhidraClass/ExerciseFiles
- If an exercise file is not specifically listed then do the exercise with your choice of program.

Notes:

Course Objectives

- By the end of this course you will be able to:

- Use some of the more advanced Ghidra features including creating data types, memory map, multi-user projects, comparing programs, and version tracking
- Setup Ghidra development environment and write Ghidra scripts
- Run Ghidra in headless mode

Notes:

Course Topics

Creating data types Memory Map Multi-user projects Comparing programs Version tracking | Scripting Development Running Ghidra in headless mode Optional topics if time allows

Notes:

Advanced Data Types
Creating Structures and Arrays

- Create data in Listing first, then make a structure or array from it
OR
- Create structure or array first then apply it

- Right mouse menu –> Data->Create Array
- Right mouse menu –> Data->Create Structure
- Data Type Manager -> Create Structure

NOTE: If you edit structure later, the edits will take effect in all places where that structure has been defined.

Notes:

- There are two ways to create your own structures. You can create structures from the Listing or From the Data Type Manager.
- If creating a structure from the Listing:

- You can create data in the Listing before or after creating the structure
- Make selection then choose Data->Create Structure
- If you already had data created, the field types in the Structure Editor will be pre-populated – you just have to edit the field names
- If you didn't have data created you need to fill in the field types and names in the editor

- If creating a structure from the Data Type Manager:

- In the <program name> folder, right click and choose New->Create Structure

- Creating your own Arrays

- You can create data in the Listing before or after creating the array. If you are creating an array from the Listing, make a selection, then choose Data -> Create Array

Exercise 1
Create and Apply Structure

- Import and analyze docs\GhidraClass\ExerciseFiles\WinhelloCPP\winhelloCPP.exe
- Go to address 0040e4a8 and make a label "topErrorNumber"
- Go to address 0040e4ac and make a label "topPtrErrorMsg"
- Create a structure that contains the following elements:

- Int - named errorNumber
- Char * - named ptrErrorMsg

- Make a selection from 0040e4a8 to 40e55f and clear the data that is there
- Apply your structure to this selection with one apply action. This should make all the structures in the selection at once.

Notes:

Advanced Data Types

- Creating Enums
- Function Definitions

Notes

- Enums:

- Users can create their own Enums data types by choosing New->Enum... from the Data Type Manager right mouse menu.
- Users can create Enum data types by selecting a group of Enums in the Data Type Manager and selecting Create Enum From Selection.

- Function Definitions:

- Users can create a function definition data type for function signatures they might want apply again in a new program for a particular named function. To do this, click on a function signature and choose Function->Create Function Definition from the Listing right mouse menu.
- Users can create function definitions for their whole program by choosing Capture Function Data Types from the Data Type Manager right mouse menu.
- In new program, apply function signature by right mousing on appropriate folder in Data Type Manager and choosing Apply Function Data Types

Advanced Data Types

- Shared Data Archives
- Advanced Data Options
- C parser

Notes

- Shared Data Archives:
  There are two types of Shared Data Archives called File archives and Project archives.

- File Archives:

- This archive is stored on the file system and accessible by anyone with access to the file system.
- To create a File Archive, pull down on the black triangle in the Data Type manager and choose New File Archive.

- Project Archives:

- This archive is stored within a Ghidra project and is accessible by anyone with access to that project.
- To create a Project Archive, pull down on the black triangle in the Data Type manager and choose New File Archive.

- Advanced Data Options:

- Users can change the settings on a single data item or on any applied data of a particular type using the Data->Settings or Data-Default Settings actions on the Listing right mouse menu.

- C parser:

- Users can create data types by parsing header files. To do this, use the File->Parse C Source action.
- It is sometimes tricky to get the options setup correctly in this feature. Please contact the Ghidra team if you have troubles.

Exercise 2
Create and Apply Enum

- In winhelloCPP.exe

- 1. Create an new Enum named MyEnum with values 0-3 with corresponding names Enum0, Enum1, Enum2, and Enum3. Find a scalar operand reference with one of these values and use the Set Equate action to apply one of your Enums to it. (NOTE: If you cannot find a scalar use Search->Program Text to help you)
- 2. Create an ENUM named ExceptionNumbers out of the already defined _FPE_ enums, using the Create Enum from Selection feature. Edit the Enum and make it size 4. Apply the ExceptionNumbers Enum to the appropriate variable in the __XcptFilter function in both the Listing and the decompiler.

Notes:

Memory Map

- The Memory Map
- Allows users to add, delete, move, split, merge, or expand memory blocks in their program.
- Memory Blocks can be byte-mapped, bit-mapped (if supported by processor) or overlays
- Allows users to rename memory blocks
- Allows users to change the image base of their program
- Allows users to edit settings on individual memory blocks

- Read/Write/Execute
- Volatile/non-volatile
- Initialized/non-initialized

Notes:

Program Differences

- Users can find differences between two programs
- Users can apply differences from one program to another
- Users can customize how their differences are applied

Notes:

- To open the Program Differences Tool, go to Tools->Program Differences and choose a program to compare against the currently opened program in the Code Browser.
- Next, choose what types of program differences you want to see: bytes, bookmarks, labels, comments, etc.
- Notice that the program you are comparing shows up to the right of the current program. There are extra icons added to the tool that allow you to navigate to the next difference, view what is different about a particular item, apply differences, or ignore differences.
- You can decide how differences are applied for each kind of item. Most let you ignore, replace, or merge the difference.
- If you want to select all differences, choose Select All Differences from the right mouse menu.

Exercise 3
Program Differences

- Import winhelloCPP.exe again and call it winhelloCPP2.exe
- Pick a new kind of analyzer when you auto-analyze it.
- Use the Program Differences Tool to view and apply some of the differences between the two programs.

Notes:

Shared Project

- Setup server

- Edit Server.conf file to decide how users will authenticate and other options
- Install service
- Start service
- Add users to the server

- Setup project

- Create new shared project
- Add users to project (subgroup of server users)
- Import and initial analysis of binaries
- Add to version control so others can get access to it
- Others do a check out to get access

- Shared Project actions

- Changes should be checked in so others can see them
- Others do an update to see the changes
- Conflicts get merged one at a time

Notes

- As a user, you can run Ghidra in Shared Project mode which allows users to collaborate with other users when using Ghidra to understand and markup a binary.
- Server Setup:

- Done once by whoever will administer the server
- Users can set up Ghidra servers anywhere there is shared access amongst the users they want to share with
- Go to C:\ghidra_<version>\server\svrREADME.html file for server setup instructions
- Edit the server.conf file to setup server per the readme file
- Install the server using svrInstall
- Once server is up and running add people allowed to create shared projects on the server by using the \server\svrAdmin -add command in a cmd window.

- Shared Projects:

- Person Starting a New Project

- Create a new Ghidra Project using File->New Project and choose "Shared Project" and do the following in New Project Wizard:

- Type in server name or IP and use default port in most cases
- Authenticate with method chosen in server.conf file -- server administrator should communicate this.
- Create a new Repository
- Give subgroup of people access to your project. You can give them admin, read/write, or read-only access.
- Choose storage location for your local version of project

- Others joining project

- Create a new Ghidra Project using File->New Project and choose "Shared Project" and do the following in New Project Wizard:

- Type in server name or IP and use default port in most cases
- Authenticate with method chosen in server.conf file -- server administrator or project owner should communicate this.
- Join existing Repository
- Choose storage location for your local version of project

Checksum Tool

- The Checksum Tool allows users to generate a variety of checksums on either the whole program or a selection.
- Results are shown in various formats.

- Decimal
- Hex
- 1's Complement
- 2's Complement

Notes:
To open the Checksum Tool, go to Tools->Generate Checksum.

Version Tracking

- Version Tracking is the process of identifying matching functions or data in a new version of a binary.
- See VersionTracking.html or VersionTracking_withNotes.html to follow along with the Version Tracking instruction to follow along with the Version Tracking instruction.

Notes:
The VersionTracking.ppt slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Scripting

- Ghidra allows users to extend its functionality. One way to do this is to develop scripts
- See Scripting.html to follow along with the Scripting instruction

Notes:
The Scripting slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Headless Analyzer

- Analysis and all non-GUI Ghidra scripts can be run without running the Ghidra tool
- See HeadlessAnalyzer.html or HeadlessAnalyzer_withNotes.html to follow along with the Headless Analyzer instruction

Notes:
The HeadlessAnalyzer slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Course Summary

- You now should be able to:

- Use the more advanced Ghidra features including intermediate code analysis and decompiler, advanced data types and program tree, memory map, multi-user projects, comparing programs, and version tracking
- Setup the Ghidra development environment
- Write basic Ghidra scripts
- Run Ghidra in headless mode

Notes: