Advanced malware reverse engineering with Ghidra*

Introduction to Ghidra

– Ghidra overview
– Building Ghidra on Windows, macOS, Linux

Analysis workflow

– Introduction to the Metasploit sample
– Settings overview, configuring familiar controls
– Basic analysis workflow
– Using Data Type Manager to import type libraries

– Using Ghidra’s parser to import C headers

– Applying structure pointers

Working with types and pointers

– Working with linked lists and adjusting shifted pointers

– Analyzing code that uses PE header structures

– Introduction to scripting

Scripting API hashing

– Analyzing an API hashing algorithm with Ghidra

– Implementing an API hash analysis script in Python and Java

Library identification

– Introduction to the Mettle sample

– Using a library (.so file) to create a function identification database

– Using Ghidra’s headless mode to create a function identification database from an archive (.a) file

Structures and function pointers


– Introduction to the Calypso sample
– Studying capabilities related to structure pointers, such as automatic recognition of structure fields

– Tips and tricks for working with function pointers, such as applying API function signatures for them

Decompiler scripting

– Ghidra’s decompiler internals overview

– Advanced-level scripting: coding a stack string analysis script using knowledge of decompiler internals

Coding an analyzer 

– Learning to expand Ghidra’s capabilities using the Eclipse IDE

– Coding an API hash analysis extension for Ghidra