Reverse › Module 5 › Lesson 2
Ghidra Literacy
Ghidra decompiler and project workflow — analyze crackmes on $RE_LAB, export notes not commercial patches.
Visual · re_ghidra_literacy
Ghidra literacy. $RE_LAB only. Original Cyberlium.
Opening
Ghidra turns bytes into pseudocode — rename, retype, and annotate on authorized targets only.
Ghidra is a free NSA RE suite: import binary, analyze, disassemble, decompile to C-like pseudocode. Rename functions (check_password), set types, add bookmarks, export listings. Projects live on $RE_LAB VM — not mixed with pirated commercial trees on host. Cyberlium teaches Ghidra literacy for CTF and crackmes. You will NOT distribute Ghidra scripts that patch paid software licenses. Next: IDA/Binary Ninja Named.
1. Import and analyze workflow
New project → import YOUR toy binary → analyze with default options → open CodeBrowser. Entry appears in Symbol Tree; Decompile window shows pseudocode for selected function.
Accept default analysis on $RE_LAB crackmes; note sha256 in project notes field.
Command guide
Try these commands — Import and analyze workflow
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, objdump. Reference sites: Ghidra (https://ghidra.re/); Ghidra docs (https://ghidra.re/courses/GhidraClass/); objdump (https://man7.org/linux/man-pages/man1/objdump.1.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rename, retype, comment
Rename nonsense FUN_ labels to meaningful names matching source if toy binary. Retype char* for string args. Comments document CMP/JMP gates — not crack steps for commercial apps.
Export decompilation snippet to chmod 600 text for writeup — methodology, not one-click patch file.
3. Ghidra literacy boundaries
Forbidden: Ghidra scripts for mass commercial cracking, sharing patched binaries from Ghidra exports, or analyzing employer IP without written authorization.
Ship: Ghidra workflow checklist — import, analyze, rename three symbols, one comment on gate. Next: IDA/Binary Ninja Named.
4. What you ship: Ghidra workflow checklist for $RE_LAB
Import/analyze/rename/comment steps on YOUR toy. $RE_LAB project path. NEVER commercial patch exports. chmod 600.
5. What you record before the next lesson
Date. Ghidra checklist. $RE_LAB named. File t23-m05-l02-ghidra-literacy.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Export patched commercial exe from Ghidra. Skip project notes on target sha256.
Right
Write Ghidra workflow checklist for $RE_LAB toy. Next: IDA/Binary Ninja Named.
Mission: document YOUR Ghidra workflow
1) List import → analyze → rename → comment steps. 2) Name three symbols you will rename on YOUR toy. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Decompiler pseudocode bridges asm and source thinking.
Knowledge Check
APPLY: Ghidra literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Ghidra Decompile window shows C-like pseudocode.
True or False
Knowledge Check
APPLY: Renaming FUN_ labels helps by:
Multiple choice