## Static Analysis with Ghidra

**Ghidra** is the NSA's gift to the community. It is a powerful, free Disassembler/Decompiler.

### The Interface
1.  **Program Tree**: Sections of the file (.text, .data, .rsrc).
2.  **Listing View**: The Assembly code (linear view).
3.  **Decompiler View**: The C-like pseudo-code. **(This is where you live)**.
4.  **Symbol Tree**: List of Functions and Imports.

### The Workflow
1.  **Import**: Drag and Drop the malware.
2.  **Analyze**: Run the auto-analysis (identifies functions, strings).
3.  **Search Strings**: Find "http". Double click it.
4.  **X-Ref (Cross Reference)**: Right-Click the string -> "References".
    *   This shows *where in the code* that string is used.
    *   Clicking it takes you to the `Main()` function that calls the C2.
5.  **Rename**: Ghidra names variables `DAT_12345` or `FUN_401000`.
    *   Your job is to read the logic.
    *   "This function takes a URL and downloads a file." -> Press `L`. Rename to `Download_File`.
    *   "This variable holds the IP." -> Rename to `C2_IP`.
    *   Slowly, the code becomes readable.

### Graph View
Visualizes the flow control.
*   Boxes are blocks of code.
*   Arrows are Jumps (Green for Yes, Red for No).
*   If you see a complex knot of arrows, it's a loop.