Now.
It's about time we got down to actually using Ghidra.
The remainder of this course is dedicated to various features of Ghidra and how you can leverage them
to best meet your reverse engineering needs.
In this section, we will begin covering the options you are presented with.
So when launching Ghidra.
And then we describe what happens when you open a single binary file for analysis.
Finally, we present a quick overview of the user interface to lay the groundwork for the remaining
chapters.
And here, anytime you launch ghidra here.
So we will first run the Ghidra here.
So anytime you launch Ghidra, you will be greatly briefly greeted briefly by a splash screen that displays
a little logo build information.
The Ghidra and Java version numbers and the licensing information.
If you wish to truly read the splash screen to learn more about your version so you can display it at
any time by clicking on help and about Ghidra from the Ghidra project window.
And once the splash screen clears, zero displays the Ghidra project window behind the tip of the date
dialog and you can scroll through the tips by clicking the next tip button.
But if you prefer not to see the tips, feel free to uncheck the show tips on startup like this.
And here, if you uncheck the box and you find yourself missing the top of the Tip of the Day dialog,
you can easily restore it through the Ghidra help menu right here.
Tip of the day.
Click on that and that's it.
Here we will select on the show tips on Startup and click on Close.
And if you close the Tip of the Day dialog or uncheck the box and restart the jitter, you will be presented
with a project window.
The Ghidra uses a project environment to allow you to manage and control the tools and data associated
with the file or group of files as you are working with them.
This initial interaction focuses on single file as component of Non-shared project, so more complex
project capabilities are will be discussed in next sections and lectures of our course.
So if this is your first time launching Ghidra, you will need to create a project.
If you have launched previously, the active project will be the one you used most recently choosing
file.
Here, you can reopen this alloted specify characteristics of the new project and here you can.
The first step is creating a project to choose between a non-shared project and shared project.
In this lecture, we will begin with a Non-shared project.
With that choice out of the way, you will be present that with this dialog here.
Right?
So once you have entered the project location information and after the project name in this case we
will use Typhoon zero one and click on finish here.
And once you have entered the project location and project name, click on Finish to complete the project
creation process.
And here this will return the project window with a newly created project selected here, as you can
see here.
And to do any useful work, you will need to add at least one file to your project so you can open a
file either by choosing new file like here or like right clicking on it.
Or.
File here.
Import file.
This year.
And browsing to the file you wish to import, or by dragging and dropping file directly into this project
window here.
In this case, our file is deleted.
So here let's actually first we will create a just a basic C plus plus file C plus plus program, and
we will compile it so it will show the hello world.
We will just simple C plus plus program here.
So main.cpp here.
Yes.
And open it with some notepad and here we will include include studio dot h here and after that we will
integer main here.
After that we will print f.
Hello world.
And that's it.
And after that.
Sorry.
After that.
Well, it will return zero and that's it.
And here, let's go to CMD and compile our project.
Is c.
G c compiler installed?
Yes.
So we will go to CD desktop and GCC main.cpp or here main dot exe here and there.
As you can see here.
Let's run this exit and as you can see, we printed Hello world on the screen.
But this is just a basic simple C plus plus program.
And here we have this main dot exe here.
We will drag and drop this to Jira in Jira.
But instead of this, we can also just use the press E button.
E keyboard.
E on the keyboard.
I in the keyboard and we can select the main dot x and after selecting this we will select file to import.
And that is it.
And here when you import something, ghidra generates a list of potential.
File types and provides these in the format Picklist.
Or at the top of the dialog here and clicking the information button to the right of the.
Dialog will provide you with a list of supported formats here which are which we will describe in next
lecture.
Here we have input format here.
Let's actually can here Dalvik executable and so on.
So here.
And the format Picklist provides the subset of data loaders that are best suited for dealing with a
selected file.
For this example, the two options are provided in the format Picklist.
The first is portable executable P.
Or old style dos executable and raw binary.
The raw binary option will always be present present in your since it's just default for loading files
that it does not recognize.
This provides the lowest level option for loading any file.
So when offered the choice of several loaders, it's not a bad strategy to accept the default selections
unless poses specific information that contradicts Jesus determination.
So the language field here.
So we will just not touch the format here because selected it for us and here in this language field
allows you to specify which processor model should be used during the disassembly process.
A Ghidra language compiler specification can consist of a processor type and in endian specification
L a B here a bitterness value here.
Like 1632 and 64, a processor variant and the compiler ID here.
So we have several options to check here.
But as you can see, it's Uncheckable because Chitra already checked for it for us and the destination
folder field lets you select a project folder in which the newly imported file will be displayed and
the default is to display the top level project folder.
But the sub folders can be added to organize imported programs with the within the project so you can
select the extension buttons to the right of the.
Uh, so the right of the language and destination folder fields to we've other options for each.
So you can also edit the text in the program name field.
And don't be confused by the change in terminology.
The program name is a name that Ghidra uses to refer to the important binary within the project, including
for display in the project window.
So it defaults to the name of the imported file, but it could be changed to something more descriptive
like simple Hello world.
Print here and you can like you can also do it for malware from target computer and so on.
In addition to the four fields shown in this dialog, you can access other options to control the loading
process via options button here.
Here.
So these options are dependent on the selected format and processor.
The options for, for example.
Mean that the AP file six a x86 are shown here here and with the default option selected right so while
moving ahead with the default options is generally a good approach, you may choose other options as
you gain experience here.
For example, apply processor defined labels and your processor defined labels.
We have the load system libraries from disk.
We can also edit paths here.
Your project library search folder and so on, which we will just click on the cancel here.
We will not touch anything on it and the import options here are used again.
Finer control over the file loading process.
So these options are not applicable to all input file types, and in most cases you can rely on the
default selections here and additional information about options is available in ghidra help also.
So when you're happy with your loading options and click okay to close the dialogs and you're presented
with the input results summary window here.
We will see right here.
And that's this is this is called import results summary.
So this import result summary, this provides you an opportunity to review the selected import options
along with the basic information that the loader has extracted from your chosen file and in this importing
files here.
Or here we have additional information that isn't reflected on input results, which you will learn
in next lectures.
And after that we will.
We can click.
Okay.
So that's it.
We imported the Excel file at times.
Here we the raw binary will be the only entry in the format Picklist.
So for example, we can create some.
New text folder and that exit here.
Beard, Codex and.
Here.
We will edit with Notepad and we will just write some codes here, which this is obviously not a program,
but we will import the ghidra and let's see what will happen again.
We will use the shortcut and weird code dot x and here, as you can see here, at times, as I said,
raw binary will be the only entry in the format picklist.
So this is the way of telling you that none of its loaders recognize the choosen file.
Examples of situations that may call for the use of the raw binary loader include the analysis of a
custom firmware images and exploit payloads that may have been extracted from the network package captures
or log files.
Or.
This is just a raw, weird code that we write at some characters in it.
It doesn't represent anything on the operating system side, and in these cases, Ghidra cannot recognize
any file header information to guide the loading process.
So it's up to you to step in and perform tasks that loaders often do automatically, like specifying
a processor, the bit size and in some cases a particular compiler.
For example, if you know the binary contains x86 code, many choices are available in the language
dialog here.
And often some research and occasionally some trial and error is required to narrow your language choices
to something that will work for your binary.
Any information you can obtain about the device the file was designed to run on will be useful.
If you are confident that the file is not intended for a Windows system, you should select GCC or default
here.
In this case, it actually is not for any system because we just made it file from the characters.
Right.
And.
If the binary file contains no hidden information, Ghidra can work with it.
So Ghidra also will recognize the memory layout of the file.
So if you know the base address file offset or length of the file, you can enter those values
in into the corresponding loader option fields as shown here.
And.
Here we have also text filter options again and so on.
Now in next lecture we will analyze filters with.