CRS-GHD-04
Ghidra binary reverse engineering: native header inspection, decompilation, and supply-chain triage
Compiled vendor agents, native library extensions, and proprietary command-line utilities arrive without source files, yet still execute with full access to process memory and network sockets. Ghidra provides an open-source disassembly and decompilation workbench covering x86-64, ARM64, and embedded instruction sets. It lifts raw machine bytes into intermediate P-code and readable C functions without ever executing the binary.
1. ELF64 segment anatomy and Ghidra p-code decompilation pipeline
ELF64 segments feed symbol tables and .rodata string cross-references into the Ghidra P-code lifter, reconstructing C control-flow graphs offline.2. Reading binary headers, imported sinks, and decompiled control flow
Static binary inspection always takes place inside a non-networked virtual machine where execute permissions are stripped immediately via chmod a-x. Next, the analyst records the SHA-256 digest and inspects program headers with readelf -h -l -W on disk. That header check confirms non-executable stack flags (NX), position-independent code (PIE), and read-only relocations (RELRO).
Once imported into a Ghidra project, the Symbol Tree and Defined Strings windows expose external library imports alongside constant literals stored in the .rodata section. Following cross-references (XREFs) from imports such as system, popen, execve, connect, or dlopen leads directly to the exact functions capable of spawning shells or opening hidden network channels.
Ghidra lifts processor-specific opcodes into a processor-independent register transfer language called P-code, enabling its Decompiler to reconstruct high-level variable types, loops, and conditional branches. Inspecting the Function Graph and renamed parameters exposes hardcoded bypasses, unsafe copies (strcpy, sprintf), and hidden beacons before deployment.
| Command, Display Filter, or Primitive | Observed Technical Artifact | Operational Interpretation |
|---|---|---|
chmod a-x sample.bin && sha256sum sample.bin | Non-executable file mode and immutable 256-bit artifact digest | Prevents accidental execution during analysis and anchors chain-of-custody records |
readelf -W -h -l -d sample.bin | ELF entry point, segment permissions (GNU_STACK), and dynamic library dependencies | Verifies non-executable stack protection, RELRO hardening, and linked shared objects |
nm -D sample.bin | Dynamic symbol table of imported and exported C library functions | Highlights high-risk command execution, memory copy, and raw socket primitives immediately |
Ghidra: Window -> Defined Strings + XREFs | Cross-referenced map from .rodata string constants to calling code addresses | Traces network addresses, environment variable names, and embedded tokens directly to the handling routine |
analyzeHeadless /tmp/proj LabProj -import sample.bin | Automated command-line Ghidra import and disassembly without opening a graphical window | Integrates repeatable static binary triage into air-gapped build and supply-chain gates |
3. Headless triage practicum and supply-chain verification
In the practicum below, the engineer inspects a compiled native plugin inside an offline Linux analysis virtual machine. Symbol table checks and headless Ghidra disassembly inventory every routine calling shell or network primitives.
# 1. Disarm execution permissions and record cryptographic SHA-256 digest
chmod a-x ./plugin_connector.so && sha256sum ./plugin_connector.so
# 2. Check ELF program headers (verify GNU_STACK is RW, never RWE) and dynamic imports
readelf -W -l ./plugin_connector.so | grep -E "GNU_STACK|GNU_RELRO"
nm -D ./plugin_connector.so | grep -E "system|popen|execve|socket|connect|strcpy|gets"
# 3. Run offline Ghidra headless import and post-analysis script in an isolated VM
/opt/ghidra/support/analyzeHeadless /tmp/ghidra_work TriageRepo \
-import ./plugin_connector.so -readOnlyStatic binary reverse engineering closes the visibility gap for compiled third-party dependencies and native model extensions, complementing runtime action gates. Within the INDRA encyclopedia, supply-chain classes AI-SUP-09 and DEV-CIC-07 address poisoned artifacts, while every open companion package on /en/packages/ ships as auditable source and wheel archives with full SHA-256 digests.
4. Engineering reference notes for module CRS-GHD-04
Difference between static binary analysis in Ghidra and dynamic debugging with gdb
Static analysis in Ghidra disassembles and decompiles instructions from disk without ever running the binary on the processor, eliminating the risk of triggering a destructive payload or outbound callback during initial triage.
Significance of p-code intermediate representation inside the Ghidra decompiler
By translating machine instructions from x86-64, ARM64, or RISC-V into a single unified set of P-code operations, Ghidra applies consistent data-flow analysis and C pseudo-code reconstruction across server, desktop, and embedded binaries.
Analyzing stripped ELF binaries in Ghidra when local symbol names have been removed
Even when internal function names are stripped, dynamic shared libraries must retain exported entry points and imported libc symbols in .dynsym, allowing analysts to anchor control-flow recovery from external PLT calls and .rodata strings.
Security role of full RELRO and non-executable GNU_STACK headers during binary acceptance
A non-executable GNU_STACK prevents injected stack data from running as machine code, while Full RELRO marks the Global Offset Table (GOT) read-only after startup so memory corruption bugs cannot overwrite function pointers.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.