# Ghidra Cheat Sheet

<page>

Key
Action <context>Context</context> | <key>Mods</key><plus>+</plus><key>Key</key> | Menu → Path
The action may only be available in the given context. ❖ indicates the context menu, i.e., right-click. The <key>Ctrl</key> key is replaced by the command <key>⌘</key> key on Macintosh.

Load Project/Program
New Project | <key>Ctrl</key>+<key>N</key> | File → New Project
Open Project | <key>Ctrl</key><plus>+</plus><key>O</key> | File → Open Project
Close Project<footref>1</footref> | <key>Ctrl</key><plus>+</plus><key>W</key> | File → Close Project
Save Project<footref>1</footref> | <key>Ctrl</key><plus>+</plus><key>S</key> | File → Save Project
Import File<footref>1</footref> | <key>I</key> | File → Import File
Export Program | <key>O</key> | File → Export Program
Open File System<footref>1</footref> | <key>Ctrl</key><plus>+</plus><key>I</key> | File → Open File System
<footnote>1</footnote> These actions are only available if there is an active project. Create or open a project first.

Help/Customize/Info
Ghidra Help <context>Hover on action</context> | <key>F1</key> | Help → Contents
About Ghidra | Help → About Ghidra
About Program | Help → About program name
Preferences | Edit → Tool Options
Set Key Binding <context>Hover on action</context> | <key>F4</key> |
Key Bindings | Edit → Tool Options → Key Bindings
Processor Manual | ❖ → Processor Manual

Markup
Undo | <key>Ctrl</key><plus>+</plus><key>Z</key> | Edit → Undo
Redo | <key>Ctrl</key><plus>+</plus><key>Shift</key><plus>+</plus><key>Z</key> | Edit → Redo
Save Program | <key>Ctrl</key><plus>+</plus><key>S</key> | File → Save program name
Disassemble | <key>D</key> | ❖ → Disassemble
Clear Code/Data | <key>C</key> | ❖ → Clear Code Bytes
Add Label <context>Address field</context> | <key>L</key> | ❖ → Add Label
Edit Label <context>Label field</context> | <key>L</key> | ❖ → Edit Label
Rename Function <context>Function name field</context> | <key>L</key> | ❖ → Function → Rename Function
Remove Label <context>Label field</context> | <key>Del</key> | ❖ → Remove Label
Remove Function <context>Function name field</context> | <key>Del</key> | ❖ → Function → Delete Function
Define Data | <key>T</key> | ❖ → Data → Choose Data Type
❖ → Data → type
Repeat Define Data | <key>Y</key> | ❖ → Data → Last Used: type
Rename Variable <context>Variable in decompiler</context> | <key>L</key> | ❖ → Rename Variable
Retype Variable <context>Variable in decompiler</context> | <key>Ctrl</key><plus>+</plus><key>L</key> | ❖ → Retype Variable

Cycle Integer Types | <key>B</key> | ❖ → Data → Cycle → <typename>byte</typename>, <typename>word</typename>, <typename>dword</typename>, <typename>qword</typename>
Cycle String Types | <key>'</key> | ❖ → Data → Cycle → <typename>char</typename>, <typename>string</typename>, <typename>unicode</typename>
Cycle Float Types | <key>F</key> | ❖ → Data → Cycle → <typename>float</typename>, <typename>double</typename>
Create Array<footref>2</footref> | <key>[</key> | ❖ → Data → Create Array
Create Pointer<footref>2</footref> | <key>P</key> | ❖ → Data → pointer
Create Structure <context>Selection of data</context> | <key>Shift</key><plus>+</plus><key>[</key> | ❖ → Data → Create Structure
New Structure <context>Data type container</context> | ❖ → New → Structure
Import C Header | File → Parse C Source
Cross References | ❖ → References → Show References to context
<footnote>2</footnote> When possible, arrays and pointers are created of the data type currently applied.

Miscellaneous
Select | Select → what
Program Differences | <key>2</key> | Tools → Program Differences
Rerun Script | <key>Ctrl</key><plus>+</plus><key>Shift</key><plus>+</plus><key>R</key> |
Assemble | <key>Ctrl</key><plus>+</plus><key>Shift</key><plus>+</plus><key>G</key> | ❖ → Patch Instruction

</page> <page>

Navigation
Go To | <key>G</key> | Navigation → Go To
Back | <key>Alt</key><plus>+</plus><key>←</key> |
Forward | <key>Alt</key><plus>+</plus><key>→</key> |
Toggle Direction | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>T</key> | Navigation → Toggle Code Unit Search Direction
Next Instruction | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>I</key> | Navigation → Next Instruction
Next Data | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>D</key> | Navigation → Next Data
Next Undefined | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>U</key> | Navigation → Next Undefined
Next Label | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>L</key> | Navigation → Next Label
Next Function | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>F</key> | Navigation → Next Function
<key>Ctrl</key><plus>+</plus><key>↓</key> | Navigation → Go To Next Function
Previous Function | <key>Ctrl</key><plus>+</plus><key>↑</key> | Navigation → Go To Previous Function
Next Non-function Instruction | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>N</key> | Navigation → Next Instruction Not In a Function
Next Different Byte Value | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>V</key> | Navigation → Next Different Byte Value
Next Bookmark | <key>Ctrl</key><plus>+</plus><key>Alt</key><plus>+</plus><key>B</key> | Navigation → Next Bookmark

Windows
Bookmarks | <key>Ctrl</key><plus>+</plus><key>B</key> | Window → Bookmarks
Byte Viewer | Window → Bytes: program name
Function Call Trees
Data Types | Window → Data Type Manager
Decompiler | <key>Ctrl</key><plus>+</plus><key>E</key> | Window → Decompile: function name
Function Graph | Window → Function Graph
Script Manager | Window → Script Manager
Memory Map | Window → Memory Map
Register Values | <key>V | Window → Register Manager
Symbol Table | Window → Symbol Table
Symbol References | Window → Symbol References
Symbol Tree | Window → Symbol Tree

Search
Search Memory | <key>S</key> | Search → Memory
Search Program Text | <key>Ctrl</key><plus>+</plus><key>Shift</key><plus>+</plus><key>E</key> | Search → Program Text

Search For ...

- Matching Instructions
- Address Tables
- Direct References
- Instruction Patterns
- Scalars
- Strings

Search → For what

# Ghidra Cheat Sheet

Ghidra is licensed under the Apache License, Version 2.0 (the "License"); Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

</page>