# Ghidra Analysis Workflow

## Initial Setup

1. **Create a new project** - File > New Project > Non-Shared Project
2. **Import the binary** - File > Import File, select the malware sample
3. **Auto-analysis** - Accept default analyzers; enable "Aggressive Instruction Finder" for packed samples

## Analysis Steps

### Step 1: Entry Point Review
- Navigate to the entry point via `Navigation > Go To > Entry Point`
- For DLLs, check `DllMain` and exported functions
- For executables, identify `main()` or `WinMain()`

### Step 2: Import Table Analysis
- Window > Symbol Table, filter by "EXTERNAL"
- Focus on suspicious API categories:
  - **Process manipulation**: CreateProcess, WriteProcessMemory, VirtualAllocEx
  - **Registry**: RegSetValueEx, RegCreateKey
  - **Networking**: WSAStartup, connect, send, recv, InternetOpen
  - **File operations**: CreateFile, WriteFile, DeleteFile
  - **Anti-debug**: IsDebuggerPresent, CheckRemoteDebuggerPresent

### Step 3: String Analysis
- Window > Defined Strings
- Search for URLs, IP addresses, file paths, registry keys
- Look for Base64 strings, encoded commands, format strings

### Step 4: Function Analysis
- Sort functions by size to find large, complex routines
- Look for functions with many cross-references (hub functions)
- Identify wrapper functions around API calls

### Step 5: Control Flow
- Use Function Graph view for visual control flow
- Identify loops (potential crypto, encoding, C2 polling)
- Map out conditional branches (anti-analysis checks)

### Step 6: Data Flow
- Track register and variable usage through functions
- Identify function parameters and return values
- Follow pointer chains to identify data structures

## Ghidra Keyboard Shortcuts

| Action | Shortcut |
|--------|----------|
| Go to address | G |
| Find references to | Ctrl+Shift+F |
| Rename symbol | L |
| Set comment | ; |
| Decompile | Ctrl+E |
| Undo | Ctrl+Z |
| Search memory | S |
| Function graph | Space |
| Listing view | Space |

## Tips for Malware Analysis

- **Rename functions** as you identify their purpose
- **Add comments** at decision points and API calls
- **Create bookmarks** for important locations
- **Use the Decompiler** alongside disassembly for clarity
- **Apply data types** to structures when identified
- **Use scripting** for repetitive tasks (Python or Java)