E-Books →Ghidra Software Reverse–Engineering for Beginners

Key FeaturesMake the most of Ghidra on different platforms such as Linux, Windows, and macOSUnlock the potential of plug-ins and extensions for disassembly, assembly, decompilation, and scriptingLearn advanced concepts like binary diffing, debugging, unpacking real-world malware samples, and reverse engineering ransomware
Book Description
Written by David Álvarez Pérez, a senior malware analyst at Gen Digital Inc., and Ravikant Tiwari, a senior security researcher at Microsoft, with expertise in malware and threat detection, this book is a complete guide to using Ghidra for examining malware, making patches, and customizing its features for your cybersecurity needs.
This updated edition walks you through implementing Ghidra's capabilities and automating reverse-engineering tasks with its plugins. You'll learn how to set up an environment for practical malware analysis, use Ghidra in headless mode, and leverage Ghidra scripting to automate vulnerability detection in executable binaries. Advanced topics such as creating Ghidra plugins, adding new binary formats, analyzing processor modules, and contributing to the Ghidra project are thoroughly covered too.
This edition also simplifies complex concepts such as remote and kernel debugging and binary diffing, and their practical uses, especially in malware analysis. From unpacking malware to analyzing modern ransomware, you'll acquire the skills necessary for handling real-world cybersecurity challenges.
By the end of this Ghidra book, you'll be adept at avoiding potential vulnerabilities in code, extending Ghidra for advanced reverse-engineering, and applying your skills to strengthen your cybersecurity strategies.
What you will learnDevelop and integrate your own Ghidra extensionsDiscover how to use Ghidra in headless modeExtend Ghidra for advanced reverse-engineeringPerform binary differencing for use cases such as patch and vulnerability analysisPerform debugging locally and in a remote environmentApply your skills to real-world malware analysis scenarios including ransomware analysis and unpacking malwareAutomate vulnerability detection in executable binaries using Ghidra scripting
Who this book is for
This book is for software engineers, security researchers, and professionals working in software development and testing who want to deepen their expertise in reverse engineering and cybersecurity. Aspiring malware analysts and vulnerability researchers will also benefit greatly. Prior experience with Java or Python and a foundational understanding of programming is recommended.
Table of ContentsGetting Started with GhidraAutomating RE Tasks with Ghidra ScriptsGhidra Debug ModeUsing Ghidra ExtensionsReversing Malware Using GhidraScripting Malware AnalysisUsing Ghidra's Headless AnalyzerBinary DiffingAuditing Program BinariesScripting Binary AuditsDeveloping Ghidra PluginsIncorporating New Binary FormatsAnalyzing Processor ModulesContributing to the Ghidra CommunityExtending Ghidra for Advanced Reverse-EngineeringDebuggingUnpacking in-the-Wild MalwareReverse-Engineering Ransomware