Ghidra#
Ghidra is the NSA’s open-source software reverse engineering framework. The operator uses it to recover pseudocode from proprietary binaries for malware analysis and vulnerability research.
Project / program#
Action |
Shortcut |
Menu |
|---|---|---|
New Project |
|
File, New Project |
Open Project |
|
File, Open Project |
Close Project |
|
File, Close Project |
Save Project |
|
File, Save Project |
Import File |
|
File, Import File |
Export Program |
|
File, Export Program |
Open File System |
|
File, Open File System |
Markup#
Action |
Shortcut |
|---|---|
Undo |
|
Redo |
|
Save Program |
|
Disassemble |
|
Clear Code / Data |
|
Add Label / Edit Label |
|
Rename Function |
|
Remove Label / Function |
|
Define Data |
|
Repeat Define Data |
|
Rename Variable (decompiler) |
|
Retype Variable (decompiler) |
|
Cycle Integer Types (byte, word, dword, qword) |
|
Cycle String Types (char, string, unicode) |
|
Cycle Float Types (float, double) |
|
Create Array |
|
Create Pointer |
|
Create Structure (from selection) |
|
Windows#
Window |
Shortcut |
|---|---|
Bookmarks |
|
Decompiler |
|
Register Values |
|
Search#
Action |
Shortcut |
|---|---|
Search Memory |
|
Search Program Text |
|
Misc#
Action |
Shortcut |
|---|---|
Program Differences |
|
Rerun Script |
|
Assemble |
|