0Pricing
Cyber Security Academy · Lesson

Ghidra: Navigating and Annotating Binaries

Import a binary, navigate disassembly and decompiled code, rename variables, and add comments.

Ghidra: Navigating and Annotating Binaries is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Ghidra?

Ghidra is a free, open-source reverse engineering tool developed by the NSA and released publicly in 2019. It supports disassembly, decompilation, scripting, and collaborative analysis across Linux, macOS, and Windows.

Loading a Binary

Opening a binary in Ghidra:

  1. Create a new project
  2. Import file (File → Import File)
  3. Auto-analysis runs — let it complete (recognizes functions, strings, data types)
  4. CodeBrowser opens showing disassembly and decompiler views

The Ghidra Interface

Key Ghidra windows:

  • Program Trees — sections (.text, .data, .plt)
  • Symbol Tree — functions, labels, imports, exports
  • Listing — disassembly view
  • Decompiler — pseudo-C reconstruction
  • Functions — list of all identified functions

Navigating to Entry Point

Start analysis at the program entry point or main():

  • Press G to "Go To" an address or symbol
  • Search for "main" in Symbol Tree
  • Double-click any function to navigate to it

Reading the Decompiler Output

Ghidra's decompiler produces pseudo-C that is easier to read than assembly. It won't be perfect — variable names are generic (param_1, local_10), control flow may look odd — but it reveals the logic clearly enough to understand what code does.

Renaming Variables and Functions

Annotation improves readability:

  • Right-click a variable → Rename (or press L)
  • Right-click a function → Rename Function
  • Add comments with ; (end-of-line) or /*...*/ style

Renaming builds up context as you understand more of the binary.

Identifying Strings

Strings are invaluable for understanding purpose:

  • Window → Defined Strings shows all string constants
  • Click a string to jump to its use in code
  • Error messages, file paths, URLs, and registry keys reveal functionality

Cross-References (XREFs)

XREFs show where a function or variable is called/used. Press X on any symbol to see all references. This is critical for finding where user input enters a function or where security checks occur.

Scripting with Ghidra

Ghidra has a Python/Java scripting API:

# Python script to find all calls to strcpy:
from ghidra.program.model.symbol import RefType
for ref in currentProgram.getReferenceManager().getReferencesTo(toAddr(0x401234)):
    print(ref.getFromAddress())

Analyzing Malware with Ghidra

For malware analysis:

  • Identify anti-analysis tricks (anti-debug, code obfuscation)
  • Find network communication functions (socket, connect, WinInet)
  • Locate crypto functions (look for AES S-box constants: 0x63, 0x7c...)
  • Extract C2 URLs from decrypted strings

Ghidra vs IDA Pro

Ghidra vs IDA Pro:

  • Ghidra: free, open source, scriptable, good decompiler
  • IDA Pro: industry standard, faster analysis, better plugin ecosystem, expensive ($$$)
  • For most tasks, Ghidra is fully capable; IDA for professional malware analysis labs

Quick Check: Ghidra

Which Ghidra feature shows all locations in the binary that call or reference a specific function or variable?

Lesson Recap

Ghidra is a free NSA-developed RE tool with disassembly, decompilation, and scripting. Key workflows: load binary, run auto-analysis, navigate to main(), use decompiler for logic, rename variables, use XREFs to trace data flow, search strings for context. Annotation builds understanding iteratively. Scripting automates repetitive analysis tasks.

Frequently asked questions

Is the “Ghidra: Navigating and Annotating Binaries” lesson free?

Yes — the full text of “Ghidra: Navigating and Annotating Binaries” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Ghidra: Navigating and Annotating Binaries”?

Import a binary, navigate disassembly and decompiled code, rename variables, and add comments. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Ghidra: Navigating and Annotating Binaries” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Ghidra: Navigating and Annotating Binaries
  2. x86/x64 Assembly Essentials for Reversers
  3. Dynamic Analysis with GDB and pwndbg
  4. Deobfuscation and Anti-Analysis Tricks
← Back to Cyber Security Academy