COMPUTER VIRUSES AND MALWARE
SECTION 1: INTRODUCTION TO GHIDRA GETTING STARTED WITH GHIDRA TECHNICAL REQUIREMENTS WIKILEAKS VAULT NSA RELEASE GHIDRA VERSUS IDA AND MANY OTHER COMPETITORS GHIDRA OVERVIEW INSTALLING GHIDRA OVERVIEW OF GHIDRA'S FEATURES SUMMARY QUESTIONS AUTOMATING RE TASKS WITH GHIDRA SCRIPTS TECHNICAL REQUIREMENTS USING AND ADAPTING EXISTING SCRIPTS THE SCRIPT CLASS SCRIPT DEVELOPMENT GHIDRA DEBUG MODE TECHNICAL REQUIREMENTS SETTING UP THE GHIDRA DEVELOPMENT ENVIRONMENT OVERVIEWING THE SOFTWARE REQUIREMENTS INSTALLING THE JAVA JDK INSTALLING THE ECLIPSE IDE INSTALLING GHIDRADEV DEBUGGING THE GHIDRA CODE AND GHIDRA SCRIPTS DEBUGGING GHIDRA SCRIPTS FROM ECLIPSE DEBUGGING ANY GHIDRA COMPONENT FROM ECLIPSE GHIDRA RCE VULNERABILITY EXPLAINING THE GHIDRA RCE VULNERABILITY EXPLOITING THE GHIDRA RCE VULNERABILITY FIXING THE GHIDRA RCE VULNERABILITY LOOKING FOR VULNERABLE COMPUTERS FURTHER READING USING GHIDRA EXTENSIONS TECHNICAL REQUIREMENTS INSTALLING EXISTING GHIDRA EXTENSIONS ANALYZING THE CODE OF THE SAMPLE TABLE PROVIDER PLUGIN UNDERSTANDING THE GHIDRA EXTENSION SKELETON ANALYZERS FILESYSTEMS PLUGINS EXPORTERS LOADERS DEVELOPING A GHIDRA EXTENSION SECTION 2: REVERSE ENGINEERING REVERSING MALWARE USING GHIDRA TECHNICAL REQUIREMENTS SETTING UP THE ENVIRONMENT LOOKING FOR MALWARE INDICATORS LOOKING FOR STRINGS INTELLIGENCE INFORMATION AND EXTERNAL SOURCES CHECKING IMPORT FUNCTIONS DISSECTING INTERESTING MALWARE SAMPLE PARTS THE ENTRY POINT FUNCTION ANALYZING THE 0X00453340 FUNCTION ANALYZING THE 0X00453C10 FUNCTION ANALYZING THE 0X0046EA60 FUNCTION ANALYZING THE 0X0046BEB0 FUNCTION ANALYZING THE 0X0046E3A0 FUNCTION ANALYZING THE 0X004559B0 FUNCTION ANALYZING THE 0X004554E0 FUNCTION ANALYZING THE 0X0046C860 FUNCTION ANALYZING THE 0X0046A100 FUNCTION SCRIPTING MALWARE ANALYSIS TECHNICAL REQUIREMENTS USING THE GHIDRA SCRIPTING API WRITING SCRIPTS USING THE JAVA PROGRAMMING LANGUAGE WRITING SCRIPTS USING THE PYTHON PROGRAMMING LANGUAGE DEOBFUSCATING MALWARE SAMPLES USING SCRIPTS THE DELTA OFFSET TRANSLATING API HASHES TO ADDRESSES DEOBFUSCATING THE HASH TABLE USING GHIDRA SCRIPTING IMPROVING THE SCRIPTING RESULTS USING GHIDRA HEADLESS ANALYZER TECHNICAL REQUIREMENTS WHY USE HEADLESS MODE? CREATING AND POPULATING PROJECTS PERFORMING ANALYSIS ON IMPORTED OR EXISTING BINARIES RUNNING NON-GUI SCRIPTS IN A PROJECT AUDITING PROGRAM BINARIES TECHNICAL REQUIREMENTS UNDERSTANDING MEMORY CORRUPTION VULNERABILITIES UNDERSTANDING THE STACK STACK-BASED BUFFER OVERFLOW UNDERSTANDING THE HEAP HEAP-BASED BUFFER OVERFLOW FORMAT STRINGS FINDING VULNERABILITIES USING GHIDRA EXPLOITING A SIMPLE STACK-BASED BUFFER OVERFLOW SCRIPTING BINARY AUDITS TECHNICAL REQUIREMENTS LOOKING FOR VULNERABLE FUNCTIONS RETRIEVING UNSAFE C/C++ FUNCTIONS FROM THE SYMBOLS TABLE DECOMPILING THE PROGRAM USING SCRIPTING LOOKING FOR SSCANF CALLERS ENUMERATING CALLER FUNCTIONS ANALYZING THE CALLER FUNCTION USING PCODE PCODE VERSUS ASSEMBLY LANGUAGE RETRIEVING PCODE AND ANALYZING IT USING THE SAME PCODE-BASED SCRIPT IN MULTIPLE ARCHITECTURES SECTION 3: EXTENDING GHIDRA DEVELOPING GHIDRA PLUGINS TECHNICAL REQUIREMENTS OVERVIEW OF EXISTING PLUGINS PLUGINS INCLUDED WITH THE GHIDRA DISTRIBUTION THIRD-PARTY PLUGINS THE GHIDRA PLUGIN SKELETON THE PLUGIN DOCUMENTATION WRITING THE PLUGIN CODE THE PROVIDER FOR A PLUGIN DEVELOPING A GHIDRA PLUGIN DOCUMENTING THE PLUGIN IMPLEMENTING THE PLUGIN CLASS IMPLEMENTING THE PROVIDER INCORPORATING NEW BINARY FORMATS TECHNICAL REQUIREMENTS UNDERSTANDING THE DIFFERENCE BETWEEN RAW BINARIES AND FORMATTED BINARIES UNDERSTANDING RAW BINARIES UNDERSTANDING FORMATTED BINARIES DEVELOPING A GHIDRA LOADER THE OLD-STYLE DOS EXECUTABLE (MZ) PARSER THE OLD-STYLE DOS EXECUTABLE (MZ) LOADER UNDERSTANDING FILESYSTEM LOADERS FILESYSTEM RESOURCE LOCATOR ANALYZING PROCESSOR MODULES TECHNICAL REQUIREMENTS UNDERSTANDING THE EXISTING GHIDRA PROCESSOR MODULES OVERVIEWING THE GHIDRA PROCESSOR MODULE SKELETON SETTING UP THE PROCESSOR MODULE DEVELOPMENT ENVIRONMENT CREATING A PROCESSOR MODULE SKELETON DEVELOPING GHIDRA PROCESSORS DOCUMENTING PROCESSORS IDENTIFYING FUNCTIONS AND CODE USING PATTERNS CONTRIBUTING TO THE GHIDRA COMMUNITY TECHNICAL REQUIREMENTS OVERVIEWING THE GHIDRA PROJECT THE GHIDRA COMMUNITY EXPLORING CONTRIBUTIONS UNDERSTANDING LEGAL ASPECTS SUBMITTING A BUG REPORT SUGGESTING NEW FEATURES SUBMITTING QUESTIONS SUBMITTING A PULL REQUEST TO THE GHIDRA PROJECT EXTENDING GHIDRA FOR ADVANCED REVERSE ENGINEERING TECHNICAL REQUIREMENTS LEARNING THE BASICS OF ADVANCED REVERSE ENGINEERING LEARNING ABOUT SYMBOLIC EXECUTION LEARNING ABOUT SMT SOLVERS LEARNING ABOUT CONCOLIC EXECUTION USING GHIDRA FOR ADVANCED REVERSE ENGINEERING ADDING SYMBOLIC EXECUTION CAPABILITIES TO GHIDRA WITH ANGRYGHIDRA CONVERTING FROM PCODE INTO LLVM WITH PCODE-TO-LLVM ASSESSMENTS