You don’t need a computer science degree. You don’t need to already know assembly. You need curiosity and the patience to stare at strange things until they start making sense.
Before You Start
Most Ghidra tutorials do one of two things.
They either dump every single panel and button on you in the first five minutes you end up memorizing UI locations and understanding nothing. Or they skip straight to “load this firmware, find this function, done” you get the answer but not the thinking.
This series is different.
I wrote every part while figuring it out myself. Every time I got confused and I got confused a lot I documented it. Because that confusion is the actual learning. A polished tutorial that hides the confusion is lying to you about what reverse engineering actually feels like.
We start from the very first question: what even is this binary file, and how does Ghidra know what to do with it? Then we go deeper. x86 assembly. ARM. Bare-metal STM32 firmware where there is no main() and no operating system. Real router firmware with real vulnerabilities. Windows PE binaries. And finally Ghidra’s advanced features that most people never find.
There is one more thing I need to say. AI tools are everywhere and they are useful. But if you use them to explain every line of disassembly before you have tried to understand it yourself, you will build a dependency that never turns into skill. You will be copy-pasting output forever and calling it reversing. This series is designed to make you dangerous on your own. Use AI to verify not to replace your thinking.
By the end, you will not just know how to use Ghidra. You will know how to think when you are staring at an unknown binary with no labels, no source code, and no one to ask.
Let’s go.
How to Use This Index
- Parts are released progressively. If a part has no link, it has not been published yet.
- Work through phases in order. Each phase builds on the last.
Satellite Articles appear throughout standalone pieces you should read at the marked moment. Not numbered in the series but required reading.- Every part links to the official Ghidra documentation or architecture reference it uses.
- Stuck? Re-read the previous part before moving forward.
- Bookmark this page it is your home base.
Series Overview
| Phase | Theme | Parts |
|---|---|---|
 Phase 1 |
Ghidra From Zero Installation, Interface, First Binary | 1 – 6 |
 Phase 2 |
Reading Disassembly x86 in Depth | 7 – 14 |
 Phase 3 |
ARM Architecture, ELF, Bare-Metal, STM32 | 15 – 26 |
 Phase 4 |
Windows PE Switching Worlds | 27 – 33 |
 Phase 5 |
Real IoT Firmware MIPS, Extraction, Vulnerabilities | 34 – 44 |
 Phase 6 |
Ghidra’s Hidden Power Scripts, Plugins, Automation | 45 – 52 |
 Phase 7 |
Advanced Topics Obfuscation, Emulation, Research | 53 – 60 |
Phase 1 - Ghidra From Zero
Before you load a binary, you need to understand what you are actually doing.
Most people skip this and dive straight in. Don’t. The confusion in Phase 2 almost always traces back to something skipped here. We install Ghidra, learn every window, load our first binary, and understand what auto-analysis actually did not just that it happened.
| # | Title | Status |
|---|---|---|
| Part 1 | What Is Ghidra and Why Should I Care? |  What Is Ghidra? A Beginner’s Guide to Reverse Engineering and Firmware Analysis |
| Part 2 | Installing Ghidra Java, Download, First Launch | (coming soon) |
| Part 3 | The CodeBrowser Every Window Explained | (coming soon) |
| Part 4 | Importing Your First Binary What Ghidra Detects and How | (coming soon) |
| Part 5 | Finding Your Way Around Strings, XREFs, Navigation | (coming soon) |
| Part 6 | Ghidra Projects Saving, Exporting, and Organizing Analysis | (coming soon) |
Phase 2 - Reading Disassembly: x86 in Depth
Navigation was Phase 1. Comprehension is Phase 2.
You can find main(). Now you need to understand it. This phase teaches you to read what Ghidra shows registers, instructions, the stack, the decompiler, data types, control flow, and how to modify binaries. We stay on x86 because it is the most documented architecture for learning. Phase 3 breaks everything, so we build strong foundations here.
| # | Title | Status |
|---|---|---|
| Part 7 | x86 Registers and the CPU Model What Ghidra Shows You | (coming soon) |
| Part 8 | The Stack How Functions Use Memory | (coming soon) |
| Part 9 | Reading Instructions The 20 You Will See Everywhere | (coming soon) |
| Part 10 | The Decompiler Power and Lies | (coming soon) |
| Part 11 | Data Types, Pointers, and Structures in Ghidra | (coming soon) |
| Part 12 | Control Flow Conditions, Loops, and the Function Graph | (coming soon) |
| Part 13 | Cross-References Following Data and Code Relationships | (coming soon) |
| Part 14 | Patching Binaries in Ghidra Modify, Export, Run | (coming soon) |
Phase 3 - ARM: Architecture, ELF, Bare-Metal, STM32
Everything you learned in Phase 2 still applies. It just looks completely different.
ARM is what runs most IoT devices cameras, routers, embedded controllers. When you load ARM firmware for the first time, main() might not exist. Registers have different names. There is something called Thumb mode that will silently destroy your disassembly if you don’t know about it. And in bare-metal firmware there is no OS, no standard library, and the hardware itself becomes part of what you analyze. This is the largest phase because ARM is the most important architecture for IoT security work.
| # | Title | Status |
|---|---|---|
| Part 15 | ARM Architecture for Reverse Engineers The Mental Model | (coming soon) |
| Part 16 | ARM Instruction Set What Changes From x86 | (coming soon) |
| Part 17 | Loading ARM ELF in Ghidra Import, Analysis, First Look | (coming soon) |
| Part 18 | Thumb Mode Why Addresses End in +1 and What It Means | (coming soon) |
| Part 19 | Bare-Metal ARM No main(), No OS, No Rules | (coming soon) |
| Part 20 | Loading a .bin File in Ghidra Manual Configuration | (coming soon) |
| Part 21 | STM32 Memory Architecture Flash, RAM, Peripherals in Ghidra | (coming soon) |
| Part 22 | SVD Files Making Peripheral Registers Readable | (coming soon) |
| Part 23 | Interrupt Handlers and the Vector Table in Depth | (coming soon) |
| Part 24 | HAL and CMSIS Patterns Reading Firmware Libraries | (coming soon) |
| Part 25 | Reading a Complete STM32 Firmware Full Workflow | (coming soon) |
| Part 26 | ARM Calling Convention Variations and Edge Cases | (coming soon) |
Phase 4 - Windows PE: Switching Worlds
The binary format changes. Your reverse engineering instinct does not.
Everything from Phase 2 transfers. What changes is the binary container format, the Windows OS layer, different calling conventions, and the import table model. PE analysis is essential for Windows malware, Windows-based embedded systems, and any time you encounter a .exe or .dll you need to understand.
| # | Title | Status |
|---|---|---|
| Part 27 | PE Format Reading a Windows Binary Header | (coming soon) |
| Part 28 | Loading PE in Ghidra What Auto-Analysis Finds | (coming soon) |
| Part 29 | Windows x64 Calling Convention | (coming soon) |
| Part 30 | Import Table Deep Dive Reading Intent From Imports | (coming soon) |
| Part 31 | x86 vs x64 in Ghidra What Changes in the Listing | (coming soon) |
| Part 32 | Anti-Analysis in PE Binaries Packing, Obfuscation, String Encryption | (coming soon) |
| Part 33 | Capstone: Reverse a Complete Windows Crackme | (coming soon) |
Phase 5 - Real IoT Firmware: MIPS, Extraction, Vulnerabilities
No more training wheels. This is what it actually looks like.
Real router firmware. No source code. MIPS or ARM. A filesystem you have to extract yourself. Stack overflows, command injections, hardcoded credentials the same vulnerability classes that become CVEs. The difference between this phase and everything before it is that there is no answer key. You find what you find.
| # | Title | Status |
|---|---|---|
| Part 34 | IoT Firmware Basics What You Are Actually Analyzing | (coming soon) |
| Part 35 | Extracting Firmware Filesystems Squashfs, JFFS2, Cramfs | (coming soon) |
| Part 36 | MIPS Architecture in Ghidra | (coming soon) |
| Part 37 | QEMU Running IoT Binaries Without the Hardware | (coming soon) |
| Part 38 | Finding Dangerous Functions The Sink Analysis Approach | (coming soon) |
| Part 39 | Stack Overflow in Real Router Firmware Complete Analysis | (coming soon) |
| Part 40 | Command Injection in CGI Binaries | (coming soon) |
| Part 41 | Hardcoded Credentials and Backdoors Finding Them in Firmware | (coming soon) |
| Part 42 | Firmware Version Diffing Finding What a Patch Fixed | (coming soon) |
| Part 43 | Memory Corruption in IoT Exploitation Concepts | (coming soon) |
| Part 44 | Full IoT Firmware Analysis Workflow End to End | (coming soon) |
Phase 6 Ghidra’s Hidden Power: Scripts, Plugins, Automation
Most people use 20% of Ghidra. This phase is the other 80%.
Scripting. Advanced decompiler techniques. Bulk firmware analysis. Plugins that transform what Ghidra can do. Memory emulation. Collaborative analysis with a team. Version tracking for 1-day research. These are the features that separate someone who opened Ghidra once from someone who actually does research with it.
| # | Title | Status |
|---|---|---|
| Part 45 | Ghidra Scripting Python and Java Automation | (coming soon) |
| Part 46 | Advanced Scripting Bulk Firmware Analysis | (coming soon) |
| Part 47 | Finding Offsets What Exploit Developers Need | (coming soon) |
| Part 48 | Version Tracking Deep Dive Advanced Diffing | (coming soon) |
| Part 49 | Plugins and Extensions The Essential Toolkit | (coming soon) |
| Part 50 | Decompiler Deep Dive Making It Work Better | (coming soon) |
| Part 51 | Collaborative Analysis Ghidra Server | (coming soon) |
| Part 52 | Memory Simulation and Emulation in Ghidra | (coming soon) |
Phase 7 - Advanced Topics
The topics that appear in serious firmware analysis and real security research.
This phase covers obfuscation techniques and how to beat them, encrypted firmware, UEFI analysis, Android native libraries, custom binary protocols, and the full vulnerability research workflow from finding a bug to filing a CVE. We also close the loop the final part brings back the Mirai botnet we analyzed in an earlier series, but this time through Ghidra’s eyes.
| # | Title | Status |
|---|---|---|
| Part 53 | Obfuscation Techniques and How to Beat Them | (coming soon) |
| Part 54 | Encrypted Firmware Approaching Encrypted Targets | (coming soon) |
| Part 55 | UEFI and BIOS Firmware Analysis in Ghidra | (coming soon) |
| Part 56 | Android Native Libraries .so Files in Ghidra | (coming soon) |
| Part 57 | Custom Protocols and Binary Parsers | (coming soon) |
| Part 58 | Vulnerability Research Workflow From Firmware to CVE | (coming soon) |
| Part 59 | Ghidra for IoT Malware Analysis Mirai Revisited | (coming soon) |
| Part 60 | Where to Go From Here The Full RE Landscape | (coming soon) |
Satellite Articles
These are standalone pieces linked at the right moment throughout the series. They are not numbered parts but they are required reading when referenced.
| Title | Read Before | Status |
|---|---|---|
What is an ELF File? Magic Bytes, Headers, and e_machine |
Phase 1, Part 4 | (coming soon) |
| Unknown Binary How to Identify Any File Format From Raw Bytes | Phase 1, Part 4 | (coming soon) |
| x86 Assembly Quick Reference for Ghidra Users | Phase 2, Part 7 | (coming soon) |
| ARM vs x86 A Reverse Engineer’s Comparison | Phase 3, Part 15 | (coming soon) |
| Cross-Compiling for ARM on Linux Complete Setup | Phase 3, Part 15 | (coming soon) |
| What is Thumb and Thumb-2 Mode? | Phase 3, Part 18 | (coming soon) |
| ARM Memory Architecture Cortex-M to Application Processors | Phase 3, Part 19 | (coming soon) |
| STM32 for Security Researchers Before You Open Ghidra | Phase 3, Part 19 | (coming soon) |
| What is a PE File? Windows Binary Headers Explained | Phase 4, Part 27 | (coming soon) |
| IoT Filesystem Formats Squashfs, JFFS2, Cramfs | Phase 5, Part 34 | (coming soon) |
| MIPS for IoT Reverse Engineers Complete Reference | Phase 5, Part 36 | (coming soon) |
| QEMU for IoT Research Running ARM and MIPS Without Hardware | Phase 5, Part 37 | (coming soon) |