Скачать или смотреть Day70 | Ghidra

🧠 What Ghidra Is

Ghidra is a software reverse engineering (SRE) framework that can decompile, disassemble, and analyze executable files.
It supports multiple operating systems (Windows, Linux, macOS) and works with many architectures like x86, ARM, PowerPC, and MIPS.

⚙️ Key Uses of Ghidra

🧩 1. Malware Analysis

💻 2. Reverse Engineering Applications

🔐 3. Vulnerability Research


🧰 4. Digital Forensics


🎓 5. Education & Training

---

💡 Popular Features

Decompiler: Converts machine code to readable pseudo-C.

Disassembler: Converts binary code to assembly language.

Scripting support: Automate analysis using Python or Java.

Cross-platform GUI: Works on Windows, Linux, and macOS.

Collaboration mode: Multiple users can work on the same project.

⚔️ Example Use Case

A cybersecurity analyst receives a suspicious Windows .exe file.
They open it in Ghidra, decompile it, and find code that:

Connects to a remote server,

Logs keystrokes, and

Exfiltrates data.

The analyst identifies it as a keylogger trojan and reports the malicious IP addresses.