Intermediate Ghidra

STUDENT GUIDE

How to Use Slides

Use Arrow keys to go to next/previous slide
Double click page number to edit/jump to specific page
"withNotes" slide deck contains detailed notes below slides and can be used as a tutorial.
Click "Pop-up" to launch presentation slides
Should display correctly in modern versions of all browsers.
Microsoft Edge displays incorrectly at first. To fix, go to Edge options (...) and click zoom once.

Installing Ghidra

To install Ghidra unzip the Ghidra installation file:

ghidra_<version>_<release>_<date>.zip

<version> is the version number of the release
<release> is the name of the release
<date> is the date the release was built

Platforms Supported:

Microsoft Windows 7 or 10 (64-bit)
Linux (64-bit, CentOS 7 is preferred)
macOS (OS X) 10.8.3+ (Mountain Lion or later)

Notes:

Exercise Files

Referenced exercise files are located in ghidra_<version>/docs/GhidraClass/ExerciseFiles

If an exercise file is not specifically listed then do the exercise with your choice of program.

Notes:

Course Objectives

By the end of this course you will be able to:

Use some of the more advanced Ghidra features including creating data types, memory map, multi-user projects, comparing programs, and version tracking
Setup Ghidra development environment and write Ghidra scripts
Run Ghidra in headless mode

Notes:

Course Topics

Creating data types
Memory Map
Multi-user projects
Comparing programs
Version tracking

Scripting Development
Running Ghidra in headless mode
Optional topics if time allows

Notes:

Advanced Data Types
Creating Structures and Arrays

Create data in Listing first, then make a structure or array from it

Create structure or array first then apply it

Right mouse menu –> Data->Create Array
Right mouse menu –> Data->Create Structure
Data Type Manager -> Create Structure

NOTE: If you edit structure later, the edits will take effect in all places where that structure has been defined.

Notes:

There are two ways to create your own structures. You can create structures from the Listing or From the Data Type Manager.
If creating a structure from the Listing:

You can create data in the Listing before or after creating the structure
Make selection then choose Data->Create Structure
If you already had data created, the field types in the Structure Editor will be pre-populated – you just have to edit the field names
If you didn't have data created you need to fill in the field types and names in the editor

If creating a structure from the Data Type Manager:

In the <program name> folder, right click and choose New->Create Structure

Creating your own Arrays

You can create data in the Listing before or after creating the array. If you are creating an array from the Listing, make a selection, then choose Data -> Create Array

Exercise 1
Create and Apply Structure

Import and analyze docs\GhidraClass\ExerciseFiles\WinhelloCPP\winhelloCPP.exe
Go to address 0040e4a8 and make a label "topErrorNumber"
Go to address 0040e4ac and make a label "topPtrErrorMsg"
Create a structure that contains the following elements:

Int - named errorNumber
Char * - named ptrErrorMsg

Make a selection from 0040e4a8 to 40e55f and clear the data that is there
Apply your structure to this selection with one apply action. This should make all the structures in the selection at once.

Notes:

Advanced Data Types

Creating Enums
Function Definitions

Notes

Enums:

Users can create their own Enums data types by choosing New->Enum... from the Data Type Manager right mouse menu.
Users can create Enum data types by selecting a group of Enums in the Data Type Manager and selecting Create Enum From Selection.

Function Definitions:

Users can create a function definition data type for function signatures they might want apply again in a new program for a particular named function. To do this, click on a function signature and choose Function->Create Function Definition from the Listing right mouse menu.
Users can create function definitions for their whole program by choosing Capture Function Data Types from the Data Type Manager right mouse menu.
In new program, apply function signature by right mousing on appropriate folder in Data Type Manager and choosing Apply Function Data Types

Advanced Data Types

Shared Data Archives
Advanced Data Options
C parser

Notes

Shared Data Archives:
There are two types of Shared Data Archives called File archives and Project archives.

File Archives:

This archive is stored on the file system and accessible by anyone with access to the file system.
To create a File Archive, pull down on the black triangle in the Data Type manager and choose New File Archive.

Project Archives:

This archive is stored within a Ghidra project and is accessible by anyone with access to that project.
To create a Project Archive, pull down on the black triangle in the Data Type manager and choose New Project Archive.

Advanced Data Options:

Users can change the settings on a single data item or on any applied data of a particular type using the Data->Settings or Data-Default Settings actions on the Listing right mouse menu.

C parser:

Users can create data types by parsing header files. To do this, use the File->Parse C Source action.
It is sometimes tricky to get the options setup correctly in this feature. Please contact the Ghidra team if you have troubles.

Exercise 2
Create and Apply Enum

In winhelloCPP.exe

1. Create an new Enum named MyEnum with values 0-3 with corresponding names Enum0, Enum1, Enum2, and Enum3. Find a scalar operand reference with one of these values and use the Set Equate action to apply one of your Enums to it. (NOTE: If you cannot find a scalar use Search->Program Text to help you)
2. Create an ENUM named ExceptionNumbers out of the already defined _FPE_ enums, using the Create Enum from Selection feature. Edit the Enum and make it size 4. Apply the ExceptionNumbers Enum to the appropriate variable in the __XcptFilter function in both the Listing and the decompiler.

Notes:

Memory Map

The Memory Map
Allows users to add, delete, move, split, merge, or expand memory blocks in their program.
Default memory blocks may be uninitialized or initialized using specified data
Other memory block types include byte-mapped and bit-mapped
Any memory block may be created as an overlay
Allows users to rename memory blocks
Allows users to change the image base of their program
Allows users to edit settings on individual memory blocks

Read/Write/Execute
Volatile/non-volatile
Initialized/non-initialized (default blocks only)

Notes:

Program Differences

Users can find differences between two programs
Users can apply differences from one program to another
Users can customize how their differences are applied

Notes:

To open the Program Differences Tool, go to Tools->Program Differences and choose a program to compare against the currently opened program in the Code Browser.

Next, choose what types of program differences you want to see: bytes, bookmarks, labels, comments, etc.

Notice that the program you are comparing shows up to the right of the current program. There are extra icons added to the tool that allow you to navigate to the next difference, view what is different about a particular item, apply differences, or ignore differences.

You can decide how differences are applied for each kind of item. Most let you ignore, replace, or merge the difference.

If you want to select all differences, choose Select All Differences from the right mouse menu.

Exercise 3
Program Differences

Import winhelloCPP.exe again and call it winhelloCPP2.exe
Pick a new kind of analyzer when you auto-analyze it.
Use the Program Differences Tool to view and apply some of the differences between the two programs.

Notes:

Shared Project

Setup server

Edit Server.conf file to decide how users will authenticate and other options
Install service
Start service
Add users to the server

Setup project

Create new shared project
Add users to project (subgroup of server users)
Import and initial analysis of binaries
Add to version control so others can get access to it
Others do a check out to get access

Shared Project actions

Changes should be checked in so others can see them
Others do an update to see the changes
Conflicts get merged one at a time

Notes

As a user, you can run Ghidra in Shared Project mode which allows users to collaborate with other users when using Ghidra to understand and markup a binary.
Server Setup:

Done once by whoever will administer the server
Users can set up Ghidra servers anywhere there is shared access amongst the users they want to share with
Go to C:\ghidra_<version>\server\svrREADME.html file for server setup instructions
Edit the server.conf file to setup server per the readme file
Install the server using svrInstall
Once server is up and running add people allowed to create shared projects on the server by using the \server\svrAdmin -add command in a cmd window.

Shared Projects:

Person Starting a New Project

Create a new Ghidra Project using File->New Project and choose "Shared Project" and do the following in New Project Wizard:

Type in server name or IP and use default port in most cases
Authenticate with method chosen in server.conf file -- server administrator should communicate this.
Create a new Repository
Give subgroup of people access to your project. You can give them admin, read/write, or read-only access.
Choose storage location for your local version of project

Others joining project

Create a new Ghidra Project using File->New Project and choose "Shared Project" and do the following in New Project Wizard:

Type in server name or IP and use default port in most cases
Authenticate with method chosen in server.conf file -- server administrator or project owner should communicate this.
Join existing Repository
Choose storage location for your local version of project

Checksum Tool

The Checksum Tool allows users to generate a variety of checksums on either the whole program or a selection.
Results are shown in various formats.

Decimal
Hex
1's Complement
2's Complement

Notes:
To open the Checksum Tool, go to Tools->Generate Checksum.

Version Tracking

Version Tracking is the process of identifying matching functions or data in a new version of a binary.
See VersionTracking.html or VersionTracking_withNotes.html to follow along with the Version Tracking instruction to follow along with the Version Tracking instruction.

Notes:
The VersionTracking.ppt slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Scripting

Ghidra allows users to extend its functionality. One way to do this is to develop scripts
See Scripting.html to follow along with the Scripting instruction

Notes:
The Scripting slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Headless Analyzer

Analysis and all non-GUI Ghidra scripts can be run without running the Ghidra tool
See HeadlessAnalyzer.html or HeadlessAnalyzer_withNotes.html to follow along with the Headless Analyzer instruction

Notes:
The HeadlessAnalyzer slides are located in your ghidra_<version>\docs\GhidraClass\Intermediate directory.

Course Summary

You now should be able to:

Use the more advanced Ghidra features including intermediate code analysis and decompiler, advanced data types and program tree, memory map, multi-user projects, comparing programs, and version tracking
Setup the Ghidra development environment
Write basic Ghidra scripts
Run Ghidra in headless mode

Notes: