reverse-engineering-malware-with-ghidra

# Reverse Engineering Malware with Ghidra ## When to Use - Static and dynamic analysis have identified suspicious functionality that requires deeper code-level understanding - You need to reverse engineer C2 communication protocols, encryption algorithms, or custom obfuscation - Understanding the exact exploit mechanism or vulnerability targeted by a malware sample - Extracting hardcoded configuration data (C2 addresses, encryption keys, campaign IDs) embedded in compiled code - Developing precise YARA rules or detection signatures based on unique code patterns **Do not use** for initial triage of unknown samples; perform static analysis with PEStudio and behavioral analysis with Cuckoo first. ## Prerequisites - Ghidra 11.x installed (download from https://ghidra-sre.org/) with JDK 17+ - Analysis VM isolated from production network (Windows or Linux host) - Familiarity with x86/x64 assembly language and Windows API conventions - PDB symbol files for Windows system DLLs to improve decompilation accuracy - Ghidra scripts repository (ghidra_scripts) for automated analysis tasks - Secondary reference: IDA Free or Binary Ninja for cross-validation of analysis results ## Workflow ### Step 1: Create Project and Import Binary Set up a Ghidra project and import the malware sample: ``` 1. Launch Ghidra: ghidraRun (Linux) or ghidraRun.bat (Windows) 2. File -> New Project -> Non-Shared Project -> Select directory 3. File -> Import File -> Select malware binary 4. Ghidra auto-det...