\n\nThis page has been machine-translated from the original page.
\n
This is a memo of my Ghidra environment setup for CTF.
\nFor the Ghidra installation itself, I will skip it since the official Ghidra Installation Guide covers it adequately.
\nReference: Ghidra Installation Guide
\n\nIn the current default Ghidra settings, renaming a variable from the decompiler window can cause all matching register references in the Listing window to be renamed at once, which is very inconvenient.
\nLikewise, Stack entries in the Listing window are automatically replaced with local variable names, making it difficult to intuitively understand stack positions at a glance.
\nTo address this, go to [Edit] > [Tool Options] > [Listing Fields] > [Operands Field] and disable both “Markup Register Variable References” and “Markup Stack Variable References”.
\nFor UI theme settings and customization tips, see the following article:
\nReference: Tips on Customizing Ghidra UI Themes
\nMy base configuration follows the Ghidra Practical Guide for Reverse Engineering.
\nFirst, set the Listing Binary window row spacing to 1.
\nFrom [Edit] > [Tool Options] in Code Browser, go to [Listing Fields] > [Bytes Field] and change [Maximum Lines To Display] to 1.
\nHere is the Before and After:
\n↓Before
\n↓After
\nConfigure these however you like.
\nPersonally, I have set up a shortcut for the Function Graph window, which I use frequently.
\nFrom [Edit] > [Tool Options] in Code Browser, select [Decompiler] and change the settings to show comments that are hidden by default.
\nAdd columns to the XRef window accessible from the Listing window.
\nAdding the Function Name column is especially useful.
\nSpecify the path and source for symbol files.
\nFirst, install Eclipse in order to build Ghidra extensions.
\nOn both Windows and Linux, download and run the installer from the link below.
\nReference: Eclipse Downloads | The Eclipse Foundation
\nI selected Java Developers at the top of the list and installed it.
\nThis installs the extension in Eclipse and adds the [GhidraDev] tab to the top menu bar.
\nInstall on Ghidra 10.2.x.
\nReference: GitHub - TorgoTorgo/ghidra-findcrypt: Ghidra analysis plugin to locate cryptographic constants
\nNote that Ghidra 10.3.x can cause template mismatch issues with other plugins such as gotools.
\nNext, configure Ghidra Scripts.
\nAdding scripts to Ghidra is very easy: open Bundle Manager from the Script Manager and add the folder where your scripts are located.
\npwndra is a collection of CTF-oriented Ghidra Scripts.
\nDownload the release from the repository below, extract it, and add it to Ghidra.
\nReference: 0xb0bb/pwndra: A collection of pwn/CTF related utilities for Ghidra
\nDownload the files from the repository below and extract them into Ghidra.
\nReference: AllsafeCyberSecurity/ghidra_scripts: Ghidra scripts for malware analysis
\nGhidra supports a Jython-based Python2 interpreter by default.
\nHowever, since I wanted to use Python3 as much as possible, I integrated a Python3 interpreter with Ghidra using the Ghidrathon extension published as OSS by MANDIANT.
\nRefer to the following for installation instructions:
\nReference: mandiant/Ghidrathon: The FLARE team’s open-source extension to add Python 3 scripting to Ghidra.
\nNote that the required build tool versions vary depending on the Ghidrathon version.
\n# Download Gradle 7.3 or later from https://gradle.org/releases/ and add it to PATH\nexport PATH=/<path to gradle>/gradle-7.6/bin:$PATH\n\n# Set JAVA_HOME to the same JDK version used by Ghidra\nexport JAVA_HOME=<path to JDK 17>\n\n# Build\ngit clone https://github.com/mandiant/ghidrathon\ncd ghidrathon\ngradle -PGHIDRA_INSTALL_DIR=<full path to Ghidra>Once the build is complete, the extension file is created in the dist directory inside the Ghidrathon source directory. Import this file into Ghidra.
Now open [Window] > [Ghidrathon] to launch an interpreter that uses Python3.
\nLet’s also set up Ghidrathon on Windows.
\nAs with Linux, download gradle version 7.x and add it to PATH.
\nAlso, set JAVA_HOME to the folder of the same Java version used by Ghidra.
\nWith this in place, run the following commands in PowerShell to build the extension:
\ngit clone https://github.com/mandiant/ghidrathon\ncd ghidrathon\ngradle -PGHIDRA_INSTALL_DIR=<full path to Ghidra>After that, install the extension in Ghidra as you would on Linux, and you are done.
","fields":{"slug":"/ghidra-my-env-setup-en","tagSlugs":["/tag/reversing-en/","/tag/ghidra-en/","/tag/備忘録/","/tag/english/"]},"frontmatter":{"date":"2022-03-15","description":"","tags":["Reversing (en)","Ghidra (en)","備忘録","English"],"title":"Ghidra Environment Setup Notes for CTF","socialImage":{"publicURL":"/static/faaaedfa665aedb5e7d96f2db78d4f94/ghidra-my-env-setup.png"}}}},"pageContext":{"slug":"/ghidra-my-env-setup-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}