Quickstart Guide

Get started with Ghidra by creating a project, importing a binary, and performing your first analysis

Overview

This quickstart guide will walk you through the essential steps of using Ghidra:

1. Launching Ghidra
2. Creating a new project
3. Importing a binary file
4. Running analysis
5. Navigating the CodeBrowser interface

This guide assumes you have already installed Ghidra and JDK 21. If not, please refer to the Installation Guide first.

Step 1: Launch Ghidra

1. Open Terminal or Command Prompt

   Navigate to your Ghidra installation directory:

   cd <GhidraInstallDir>
   
2. Run the Launch Script

   # Linux/macOS
   ./ghidraRun
   
   # Windows
   ghidraRun.bat
   

   The Ghidra Project Manager window will appear after a brief initialization period.

Step 2: Create a New Project

1. Start Project Creation

   In the Ghidra Project Manager window:

   • Click File → New Project
   • Or press Ctrl+N (Windows/Linux) or Cmd+N (macOS)
2. Choose Project Type

   Select Non-Shared Project and click Next

   Non-Shared projects are stored locally on your machine. Shared projects use a Ghidra Server for team collaboration.

3. Configure Project Settings

   • Project Directory: Choose where to store your project files
   • Project Name: Enter a name (e.g., “MyFirstProject”)
   • Click Finish

Step 3: Import a Binary

1. Start Import Process

   In the Project Manager window:

   • Click File → Import File
   • Or press I
   • Or drag and drop a file into the project window
2. Select Binary File

   Choose an executable file to analyze:

   • Windows: .exe, .dll, .sys
   • Linux: ELF executables
   • macOS: Mach-O executables
   • Or any raw binary file

   Click Select File To Import

3. Review Import Summary

   Ghidra will automatically detect the file format. Review the import details:

   • Format (PE, ELF, Mach-O, etc.)
   • Language (processor architecture)
   • Compiler (if detected)

   Click OK to proceed

4. Import Results

   After import completes, click OK on the import results dialog

   Your binary now appears in the project file listing

Linux Example

# Import a system binary
ls /bin/ls  # Verify file exists
# Then import /bin/ls through Ghidra GUI

Step 4: Open in CodeBrowser and Analyze

1. Open CodeBrowser

   Double-click the imported file in the project listing

   The Ghidra CodeBrowser tool will open

2. Start Analysis

   You’ll be prompted: “Would you like to analyze [filename] now?”

   • Click Yes
   • Or click No to analyze later via Analysis → Auto Analyze
3. Configure Analysis Options

   The Analysis Options dialog appears with recommended analyzers pre-selected:

   Common analyzers include:

   • Decompiler Parameter ID
   • Function Start Search
   • Stack
   • Reference
   • Data Reference
   • Disassemble Entry Points
   • Subroutine References

   For your first analysis, the default options are fine. Click Analyze to proceed.

4. Wait for Analysis to Complete

   Analysis progress is shown in the bottom-right corner

   • Small binaries: seconds to minutes
   • Large binaries: several minutes to hours

   You can work with the binary during analysis, but some features may be limited

Step 5: Navigate the CodeBrowser Interface

The CodeBrowser is divided into several key windows:

Main Windows

Listing Window

Center-left: Shows disassembly with addresses, bytes, mnemonics, and operands

• Assembly instructions
• Function boundaries
• Comments and labels

Decompiler Window

Center-right: Shows decompiled C-like pseudocode

• High-level code representation
• Variable names and types
• Control flow structures

Program Trees

Top-left: Hierarchical view of program structure

• Memory blocks
• Imports/Exports
• Functions

Symbol Tree

Bottom-left: Lists all symbols, functions, and labels

• Navigate to functions
• Find global variables
• View imports/exports

Navigation Basics

1. Navigate to Entry Point

   The entry point is typically displayed automatically after analysis

   Or navigate manually:

   • Press G (Go To)
   • Enter entry or an address
   • Click OK
2. Follow Code References

   Click on a function call or data reference:

   • Double-click to jump to the target
   • Right-click for more options
   • Use Back arrow to return (or Alt+Left)
3. View Function Graph

   To see a visual representation of the current function:

   • Press Ctrl+F or click the graph icon
   • Displays control flow as a graph with basic blocks
4. Search for Strings

   Find interesting strings in the binary:

   • Go to Search → For Strings
   • Review the strings window
   • Double-click a string to see where it’s referenced

Essential Keyboard Shortcuts

Shortcut	Action
G	Go to address/symbol
L	Rename label/function
C	Clear code
D	Disassemble
F	Create function
;	Add comment (pre or post)
Ctrl+F	Show function graph
Ctrl+Shift+E	Edit function signature
X	Show cross-references

Basic Analysis Workflow Example

1. Find the Main Function

   1. Look in the Symbol Tree under Functions
   2. Search for main, _main, or WinMain
   3. Double-click to navigate to the function
2. Examine the Decompiler Output

   Review the decompiled pseudocode:

   • Understand the function’s logic
   • Identify interesting function calls
   • Note data references
3. Rename Variables and Functions

   Make the code more readable:

   • Click on a variable or function name
   • Press L to rename
   • Enter a descriptive name
   • Press Enter
4. Add Comments

   Document your findings:

   • Position cursor at an instruction
   • Press ; for pre-comment or Shift+; for post-comment
   • Type your comment
   • Press Enter
5. Follow Interesting Calls

   Investigate function calls:

   • Double-click on a function call
   • Analyze the called function
   • Use Back to return
6. Check Cross-References

   See where code or data is used:

   • Click on a function or variable
   • Press X to view cross-references
   • Navigate to interesting references

Always save your work! Press Ctrl+S or click File → Save regularly to preserve your analysis, comments, and renamed symbols.

Running Scripts

Ghidra includes powerful scripting capabilities:

1. Open Script Manager

   Click Window → Script Manager or press F11

2. Browse Available Scripts

   Ghidra includes hundreds of pre-built scripts:

   • Search by name or description
   • Organized by category
3. Run a Script

   Select a script and click the green Run button

   Scripts can automate tasks like:

   • Finding patterns
   • Applying labels
   • Exporting data
   • Custom analysis

Next Steps

Now that you’ve completed your first analysis, explore more advanced features:

• Function Comparison: Compare functions across binaries
• Data Type Manager: Create custom structures and types
• Debugging: Use the integrated debugger for dynamic analysis
• BSim: Find similar functions across multiple binaries
• Custom Scripts: Write your own Python or Java scripts
• Version Tracking: Track changes between binary versions

For comprehensive documentation, tutorials, and reference materials, check the docs directory in your Ghidra installation or access Help → Topics within Ghidra.

Additional Resources

• Cheat Sheet: <GhidraInstallDir>/docs/CheatSheet.html
• Ghidra Class Materials: <GhidraInstallDir>/docs/GhidraClass/
• API Documentation: <GhidraInstallDir>/docs/GhidraAPI_javadoc.zip
• Community: GitHub Discussions