Lion Cipher Lab
Reverse-engineer a binary with Ghidra
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Triage answers "is this file safe?" from the outside. Reverse engineering answers the deeper question a defender eventually has to face: "what does this program actually do?" It is how analysts tear apart malware to find what it steals and where it phones home, how researchers hunt for vulnerabilities in closed-source software, and how anyone understands a program when the source code isn't available. Ghidra puts a genuinely professional tool - a software reverse engineering suite the NSA built and released free and open source - within reach of a beginner. Learning the core loop once…
What you'll learn
- reverse engineering basics
- installing Ghidra and a JDK
- compiling a C program with gcc
- importing and auto-analyzing a binary
- reading a function list
- using the decompiler
- spotting a hardcoded secret
- the isolate-and-authorize safety rules
Steps in this lab
- What reverse engineering is, in plain terms
- The two rules that make this safe - and legal
- Install a JDK - Ghidra needs it to run
- Install Ghidra
- Write and compile the tiny program you'll analyze
- Import the binary and let Ghidra analyze it
- Read the function list, then find the secret in the decompiler
- What you just learned - and where it goes next