Decompile a Simple Program with Ghidra

Topic Overview

Decompiling Binaries with Ghidra

Ghidra is a free, open-source reverse engineering suite from the NSA. It provides disassembly, decompilation to C-like pseudocode, scripting, and cross-reference analysis that rivals commercial tools like IDA Pro.

Practical Workflow

1. Create a new project and import the binary
2. Run auto-analysis with default options
3. Navigate from _start through __libc_start_main to find main
4. Open the decompiler window alongside the listing view
5. Rename variables and add types as you understand the logic

The decompiler reconstructs control flow (if/else, loops, switch) even when original variable names are lost. For example, a factorial function shows a loop with multiplication regardless of whether the source called the variable i or n.

Limitations include heavily optimized code losing structure and obfuscated code confusing the analysis.

For This Exercise

You will document the Ghidra workflow for loading a binary and reading decompiler output. This exercise asks you to explain how to find the entry point and compare decompiled pseudocode with the original algorithm.

Improving Decompiler Output

Rename variables as you understand them: right-click and choose Rename Variable. Set correct types on function parameters to fix pointer arithmetic display. Add comments at confusing branches. Export decompiled C with File > Export Program for reporting. Heavily optimized code may inline functions and unroll loops, making the decompiler output harder to read than the original source.

Your Task

Ghidra decompiled an unknown function into this pseudocode, with names recovered and the logic intact. Evaluate it for each input:

cCopy
Loading…

Odd numbers are added, and even numbers are added squared. Use a 64-bit accumulator (long long): near n = 10000 the sum exceeds 32 bits.

Input

T, then T integers n with 0 <= n <= 10000.

Output

One line per query: FUN_00401096(10) = 245.