Lion Cipher Lab
Read a binary's strings and imports in Ghidra to infer what it does
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Before anyone decompiles a suspicious binary function by function, they do something far faster: they read its strings and its import table and form a hypothesis in minutes. That triage is the highest-value-per-minute skill in malware analysis, because a program's imports quietly confess its capabilities — a binary that pulls in InternetOpenUrlA can talk to the network; one that pulls in VirtualAllocEx, WriteProcessMemory and CreateRemoteThread together is almost certainly injecting code into another process; one that writes a Run key is persisting. You can often say 'this looks like a…
What you'll learn
- reading a Ghidra Strings window and interpreting URLs, registry paths, mutexes and user-agents
- reading the import table and mapping Windows APIs to capabilities
- recognising the process-injection API cluster (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread)
- cross-referencing a string to the function that uses it
- building a capability hypothesis from static artifacts without running the binary
- judgment: when static triage is the right first move and when packing defeats it
- treating a suspiciously empty import table as a red flag
Steps in this lab
- What this drill is — triage before decompilation
- WHEN static triage is the right first move — and the safety envelope
- How you'd produce these views (and why we hand them to you here)
- Read the Strings window
- Read the import table — the highest-signal artifact
- The import cluster that screams the loudest: process injection
- Cross-reference a string to the function that uses it
- Build the capability hypothesis — from static artifacts alone
- The limits — and how a pro closes them