Decompile a Simple Program with Ghidra

Decompiling Binaries with Ghidra

Ghidra is a free, open-source reverse engineering suite from the NSA. It provides disassembly, decompilation to C-like pseudocode, scripting, and cross-reference analysis that rivals commercial tools like IDA Pro.

Practical Workflow

Create a new project and import the binary
Run auto-analysis with default options
Navigate from _start through __libc_start_main to find main
Open the decompiler window alongside the listing view
Rename variables and add types as you understand the logic

The decompiler reconstructs control flow (if/else, loops, switch) even when original variable names are lost. For example, a factorial function shows a loop with multiplication regardless of whether the source called the variable i or n.

Limitations include heavily optimized code losing structure and obfuscated code confusing the analysis.

For This Exercise

You will document the Ghidra workflow for loading a binary and reading decompiler output. This exercise asks you to explain how to find the entry point and compare decompiled pseudocode with the original algorithm.

Improving Decompiler Output

Rename variables as you understand them: right-click and choose Rename Variable. Set correct types on function parameters to fix pointer arithmetic display. Add comments at confusing branches. Export decompiled C with File > Export Program for reporting. Heavily optimized code may inline functions and unroll loops, making the decompiler output harder to read than the original source.

Write a C program with a simple algorithm and document what Ghidra's decompiler output would look like conceptually.

Requirements:

Implement a simple algorithm such as factorial or string reverse
Print documentation of the Ghidra workflow: loading, auto-analysis, finding entry point
Describe what the decompiled pseudocode would look like for your algorithm
Compare the decompiled output conceptually to the original source
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Decompiling Binaries with Ghidra

Practical Workflow

Create a new project and import the binary
Run auto-analysis with default options
Navigate from _start through __libc_start_main to find main
Open the decompiler window alongside the listing view
Rename variables and add types as you understand the logic

Limitations include heavily optimized code losing structure and obfuscated code confusing the analysis.

For This Exercise

Improving Decompiler Output

Write a C program with a simple algorithm and document what Ghidra's decompiler output would look like conceptually.

Requirements:

Implement a simple algorithm such as factorial or string reverse
Print documentation of the Ghidra workflow: loading, auto-analysis, finding entry point
Describe what the decompiled pseudocode would look like for your algorithm
Compare the decompiled output conceptually to the original source
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Topic Overview

Decompiling Binaries with Ghidra

Practical Workflow

For This Exercise

Improving Decompiler Output

Implementation Task

Progressive Hints

Resources

Open Source

Decompile a Simple Program with Ghidra

Topic Overview

Decompiling Binaries with Ghidra

Practical Workflow

For This Exercise

Improving Decompiler Output

Implementation Task

Progressive Hints

Resources

Open Source