You're reading from Ghidra Software Reverse Engineering for Beginners Analyze, identify, and avoid malicious code and potential threats in your networks and systems

Product type Paperback

Published in Jan 2021

Publisher Packt

ISBN-13 9781800207974

Length 322 pages

Edition 1st Edition

Tools

Ghidra

Concepts

Cybersecurity

Author (1):

David Álvarez Pérez

Preface

1. Section 1: Introduction to Ghidra

2. Chapter 1: Getting Started with Ghidra FREE CHAPTER

3. Chapter 2: Automating RE Tasks with Ghidra Scripts

4. Chapter 3: Ghidra Debug Mode

5. Chapter 4: Using Ghidra Extensions

6. Section 2: Reverse Engineering

7. Chapter 5: Reversing Malware Using Ghidra

8. Chapter 6: Scripting Malware Analysis

9. Chapter 7: Using Ghidra Headless Analyzer

10. Chapter 8: Auditing Program Binaries

11. Chapter 9: Scripting Binary Audits

12. Section 3: Extending Ghidra

13. Chapter 10: Developing Ghidra Plugins

14. Chapter 11: Incorporating New Binary Formats

15. Chapter 12: Analyzing Processor Modules

16. Chapter 13: Contributing to the Ghidra Community

17. Chapter 14: Extending Ghidra for Advanced Reverse Engineering

18. Assessments

19. Other Books You May Enjoy

Using the Ghidra scripting API

The Ghidra scripting API is divided into the Flat API (ghidra.app.decompiler.flatapi) and the rest of the functions (http://ghidra.re/ghidra_docs/api/overview-tree.html), which are more complex.

The Flat API is a simplified version of the Ghidra API, and it allows you, in summary, to perform the following actions:

These functions allow you to work with memory addresses: addEntryPoint, addInstructionXref, createAddressSet, getAddressFactory, and removeEntryPoint.
Use these functions to perform code analysis: analyze, analyzeAll, analyzeChanges, analyzeAll, and analyzeChanges.
Use the following function to clear the code listing: clearListing.
The following functions allow you to declare data: createAsciiString, createAsciiString, createBookmark, createByte, createChar, createData, createDouble, createDWord, createDwords, createEquate, createUnicodeString, removeData, removeDataAt, removeEquate, removeEquate, and removeEquates.