ghidra

technology/applications/development/Ghidra.md

@@ -2,7 +2,40 @@
 obj: application
 website: https://ghidra-sre.org
 repo: https://github.com/NationalSecurityAgency/ghidra
+rev: 2024-04-15
 ---
 
 # Ghidra
-#wip #🐇 #notnow 
+Ghidra is a powerful open-source software reverse engineering (SRE) suite developed by the National Security Agency (NSA) that enables users to analyze compiled code to understand its functionality, vulnerabilities, and inner workings.
+
+## Features of Ghidra
+### 1. **Decompiler**
+   - Ghidra includes a sophisticated decompiler that translates machine code into human-readable C-like code, aiding in the understanding of complex binaries.
+   - The decompiler's output is annotated with comments and variable names, making it easier to analyze and comprehend the code logic.
+
+### 2. **Disassembler**
+   - Ghidra features a robust disassembler capable of analyzing binary executables for multiple architectures, including x86, ARM, MIPS, and more.
+   - The disassembler provides detailed instruction-level analysis, allowing users to navigate and understand the assembly code of the target binary.
+
+### 3. **Scripting Support**
+   - Ghidra offers scripting support through its built-in scripting engine, allowing users to automate repetitive tasks and extend the functionality of the tool.
+   - Users can write scripts in languages such as [Python](../../dev/programming/languages/Python.md), Java, and JavaScript to perform custom analysis, data manipulation, and code generation.
+
+### 4. **Collaborative Analysis**
+   - Ghidra supports collaborative analysis through its project sharing and version control features.
+   - Teams of analysts can work together on the same project, sharing annotations, comments, and analysis results in real-time.
+
+### 5. **Debugging Tools**
+   - Ghidra provides debugging capabilities for analyzing and debugging binary executables, including breakpoints, stepping, and memory inspection.
+   - Users can debug both native and emulated code, making it suitable for analyzing complex malware and exploits.
+
+### 6. **Extensibility**
+   - Ghidra's architecture is designed for extensibility, allowing users to create custom plugins and extensions to enhance its functionality.
+   - The Ghidra community actively develops and shares plugins for tasks such as file format support, code analysis, and vulnerability research.
+
+## Use Cases of Ghidra
+Ghidra can be used for various reverse engineering tasks, including:
+- **Malware Analysis**: Analyzing and understanding the behavior of malware samples to identify malicious functionality and develop detection signatures.
+- **Vulnerability Research**: Identifying security vulnerabilities in software by analyzing compiled binaries and understanding their inner workings.
+- **Binary Auditing**: Reviewing third-party software for security flaws and compliance with security best practices.
+- **Firmware Analysis**: Analyzing firmware images to understand device functionality, identify vulnerabilities, and develop custom firmware modifications.