Scripting în Ghidra: Adnotarea apelurilor de sistem Linux

  • 5 minute de citit
  • 3 exemple de cod
  • 9 imagini

Disponibil și în English

Weekendul acesta m-am distrat să experimentez cu Ghidra. Să ai un instrument atât de puternic gratuit este cu adevărat o schimbare de joc.

Ca să încep să scriu scripturi în Ghidra, am descărcat ultima versiune de Eclipse for Java Developers Version: 2019-09 R (4.13.0), Ghidra și Open JDK. Cred că orice versiune de JDK 11+ va funcționa.

După ce descarci JDK-ul, extrage arhiva, mut-o undeva și modifică variabilele de mediu PATH și JAVA_HOME ca să indice spre ea:

export JAVA_HOME="/home/denis/jdk-13"export PATH="/home/denis/jdk-13/bin:$PATH"

Apoi, ar trebui să pornești Ghidra ca să asociezi JDK-ul cu ea, apoi să o închizi și să pornești Eclipse. În Eclipse, instalează extensia GhidraDev din arhiva aflată în ghidra_9.1-BETA_DEV/Extensions/Eclipse.

După instalarea GhidraDev, poți acum să creezi un nou proiect de Ghidra Scripts.

Asta e grozav, pentru că toate scripturile tale sunt stocate în ~/ghidra_scripts și legate de proiect. Dacă schimbi JDK-ul, poți șterge proiectul în siguranță și să-l recreezi fără să pierzi fișiere.

Dacă apeși Run sau Debug, Eclipse va cere să pornească o nouă instanță Ghidra sau Ghidra Headless. Dacă apeși Debug, poți seta breakpoint-uri în scripturile pe care vrei să le depanezi. Rulează scripturile deschizând Ghidra’s Script Manager și apăsând Run. Când codul ajunge la breakpoint-uri, execuția scriptului se oprește și îl poți depana în Eclipse.

Apoi poți relua scriptul, anula din Ghidra sau modifica scriptul fără să repornești Ghidra. Dacă apeși butonul stop, Ghidra se va închide. Am văzut niște ferestre pop-up care se plângeau că hot code replacement nu va funcționa când salvam un script. Le-am ignorat și a funcționat perfect.

Deschizând Ghidra Script Manager și dând click dreapta pe un script, apoi click pe Ghidra API Help, se va deschide un browser cu documentația pentru scripting.

Ca să-mi fac scriptul, am pornit de la InstructionSearchScript.java ca bază, am parcurs toate instrucțiunile, am salvat valoarea lui EAX, am căutat int 0x80 și am adăugat un plate comment cu numele apelului de sistem.

Scriptul final:

https://github.com/dnutiu/GhidraScripts/blob/master/CommentLinuxSysCall.java

Observă că systemCallNames.put(1, "sys_exit"); arată urât. Nu am folosit Java foarte mult și nu am găsit o modalitate bună de a inițializa map-uri într-o instrucțiune inline. Dacă ai o sugestie, scrie-o în comentarii.

Ca să obțin numele apelurilor de sistem, am folosit un tabel de referință de la Shell Storm și niște JavaScript ca să parsez tabelul.

table = document.getElementsByTagName("table")[0];tableRows = table.children[0].children;// pentru fiecare rând din tableRows, începând de la 1 ca să sărim peste antetfor (index = 1; index < tableRows.length; index++) {    rowData = tableRows[index].children;    syscallValue = rowData[0].innerText;    syscallName = rowData[1].innerText;    console.log(`systemCallNames.put(${syscallValue}, "${syscallName}");`)}
VM66:9 systemCallNames.put(0, "sys_read");VM66:9 systemCallNames.put(1, "sys_write");VM66:9 systemCallNames.put(2, "sys_open");VM66:9 systemCallNames.put(3, "sys_close");VM66:9 systemCallNames.put(4, "sys_stat");VM66:9 systemCallNames.put(5, "sys_fstat");VM66:9 systemCallNames.put(6, "sys_lstat");VM66:9 systemCallNames.put(7, "sys_poll");VM66:9 systemCallNames.put(8, "sys_lseek");VM66:9 systemCallNames.put(9, "sys_mmap");VM66:9 systemCallNames.put(10, "sys_mprotect");VM66:9 systemCallNames.put(11, "sys_munmap");VM66:9 systemCallNames.put(12, "sys_brk");VM66:9 systemCallNames.put(13, "sys_rt_sigaction");VM66:9 systemCallNames.put(14, "sys_rt_sigprocmask");VM66:9 systemCallNames.put(15, "sys_rt_sigreturn");VM66:9 systemCallNames.put(16, "sys_ioctl");VM66:9 systemCallNames.put(17, "sys_pread64");VM66:9 systemCallNames.put(18, "sys_pwrite64");VM66:9 systemCallNames.put(19, "sys_readv");VM66:9 systemCallNames.put(20, "sys_writev");VM66:9 systemCallNames.put(21, "sys_access");VM66:9 systemCallNames.put(22, "sys_pipe");VM66:9 systemCallNames.put(23, "sys_select");VM66:9 systemCallNames.put(24, "sys_sched_yield");VM66:9 systemCallNames.put(25, "sys_mremap");VM66:9 systemCallNames.put(26, "sys_msync");VM66:9 systemCallNames.put(27, "sys_mincore");VM66:9 systemCallNames.put(28, "sys_madvise");VM66:9 systemCallNames.put(29, "sys_shmget");VM66:9 systemCallNames.put(30, "sys_shmat");VM66:9 systemCallNames.put(31, "sys_shmctl");VM66:9 systemCallNames.put(32, "sys_dup");VM66:9 systemCallNames.put(33, "sys_dup2");VM66:9 systemCallNames.put(34, "sys_pause");VM66:9 systemCallNames.put(35, "sys_nanosleep");VM66:9 systemCallNames.put(36, "sys_getitimer");VM66:9 systemCallNames.put(37, "sys_alarm");VM66:9 systemCallNames.put(38, "sys_setitimer");VM66:9 systemCallNames.put(39, "sys_getpid");VM66:9 systemCallNames.put(40, "sys_sendfile");VM66:9 systemCallNames.put(41, "sys_socket");VM66:9 systemCallNames.put(42, "sys_connect");VM66:9 systemCallNames.put(43, "sys_accept");VM66:9 systemCallNames.put(44, "sys_sendto");VM66:9 systemCallNames.put(45, "sys_recvfrom");VM66:9 systemCallNames.put(46, "sys_sendmsg");VM66:9 systemCallNames.put(47, "sys_recvmsg");VM66:9 systemCallNames.put(48, "sys_shutdown");VM66:9 systemCallNames.put(49, "sys_bind");VM66:9 systemCallNames.put(50, "sys_listen");VM66:9 systemCallNames.put(51, "sys_getsockname");VM66:9 systemCallNames.put(52, "sys_getpeername");VM66:9 systemCallNames.put(53, "sys_socketpair");VM66:9 systemCallNames.put(54, "sys_setsockopt");VM66:9 systemCallNames.put(55, "sys_getsockopt");VM66:9 systemCallNames.put(56, "sys_clone");VM66:9 systemCallNames.put(57, "sys_fork");VM66:9 systemCallNames.put(58, "sys_vfork");VM66:9 systemCallNames.put(59, "sys_execve");VM66:9 systemCallNames.put(60, "sys_exit");VM66:9 systemCallNames.put(61, "sys_wait4");VM66:9 systemCallNames.put(62, "sys_kill");VM66:9 systemCallNames.put(63, "sys_uname");VM66:9 systemCallNames.put(64, "sys_semget");VM66:9 systemCallNames.put(65, "sys_semop");VM66:9 systemCallNames.put(66, "sys_semctl");VM66:9 systemCallNames.put(67, "sys_shmdt");VM66:9 systemCallNames.put(68, "sys_msgget");VM66:9 systemCallNames.put(69, "sys_msgsnd");VM66:9 systemCallNames.put(70, "sys_msgrcv");VM66:9 systemCallNames.put(71, "sys_msgctl");VM66:9 systemCallNames.put(72, "sys_fcntl");VM66:9 systemCallNames.put(73, "sys_flock");VM66:9 systemCallNames.put(74, "sys_fsync");VM66:9 systemCallNames.put(75, "sys_fdatasync");VM66:9 systemCallNames.put(76, "sys_truncate");VM66:9 systemCallNames.put(77, "sys_ftruncate");VM66:9 systemCallNames.put(78, "sys_getdents");VM66:9 systemCallNames.put(79, "sys_getcwd");VM66:9 systemCallNames.put(80, "sys_chdir");VM66:9 systemCallNames.put(81, "sys_fchdir");VM66:9 systemCallNames.put(82, "sys_rename");VM66:9 systemCallNames.put(83, "sys_mkdir");VM66:9 systemCallNames.put(84, "sys_rmdir");VM66:9 systemCallNames.put(85, "sys_creat");VM66:9 systemCallNames.put(86, "sys_link");VM66:9 systemCallNames.put(87, "sys_unlink");VM66:9 systemCallNames.put(88, "sys_symlink");VM66:9 systemCallNames.put(89, "sys_readlink");VM66:9 systemCallNames.put(90, "sys_chmod");VM66:9 systemCallNames.put(91, "sys_fchmod");VM66:9 systemCallNames.put(92, "sys_chown");VM66:9 systemCallNames.put(93, "sys_fchown");VM66:9 systemCallNames.put(94, "sys_lchown");VM66:9 systemCallNames.put(95, "sys_umask");VM66:9 systemCallNames.put(96, "sys_gettimeofday");VM66:9 systemCallNames.put(97, "sys_getrlimit");VM66:9 systemCallNames.put(98, "sys_getrusage");VM66:9 systemCallNames.put(99, "sys_sysinfo");VM66:9 systemCallNames.put(100, "sys_times");VM66:9 systemCallNames.put(101, "sys_ptrace");VM66:9 systemCallNames.put(102, "sys_getuid");VM66:9 systemCallNames.put(103, "sys_syslog");VM66:9 systemCallNames.put(104, "sys_getgid");VM66:9 systemCallNames.put(105, "sys_setuid");VM66:9 systemCallNames.put(106, "sys_setgid");VM66:9 systemCallNames.put(107, "sys_geteuid");VM66:9 systemCallNames.put(108, "sys_getegid");VM66:9 systemCallNames.put(109, "sys_setpgid");VM66:9 systemCallNames.put(110, "sys_getppid");VM66:9 systemCallNames.put(111, "sys_getpgrp");VM66:9 systemCallNames.put(112, "sys_setsid");VM66:9 systemCallNames.put(113, "sys_setreuid");VM66:9 systemCallNames.put(114, "sys_setregid");VM66:9 systemCallNames.put(115, "sys_getgroups");VM66:9 systemCallNames.put(116, "sys_setgroups");VM66:9 systemCallNames.put(117, "sys_setresuid");VM66:9 systemCallNames.put(118, "sys_getresuid");VM66:9 systemCallNames.put(119, "sys_setresgid");VM66:9 systemCallNames.put(120, "sys_getresgid");VM66:9 systemCallNames.put(121, "sys_getpgid");VM66:9 systemCallNames.put(122, "sys_setfsuid");VM66:9 systemCallNames.put(123, "sys_setfsgid");VM66:9 systemCallNames.put(124, "sys_getsid");VM66:9 systemCallNames.put(125, "sys_capget");VM66:9 systemCallNames.put(126, "sys_capset");VM66:9 systemCallNames.put(127, "sys_rt_sigpending");VM66:9 systemCallNames.put(128, "sys_rt_sigtimedwait");VM66:9 systemCallNames.put(129, "sys_rt_sigqueueinfo");VM66:9 systemCallNames.put(130, "sys_rt_sigsuspend");VM66:9 systemCallNames.put(131, "sys_sigaltstack");VM66:9 systemCallNames.put(132, "sys_utime");VM66:9 systemCallNames.put(133, "sys_mknod");VM66:9 systemCallNames.put(134, "sys_uselib");VM66:9 systemCallNames.put(135, "sys_personality");VM66:9 systemCallNames.put(136, "sys_ustat");VM66:9 systemCallNames.put(137, "sys_statfs");VM66:9 systemCallNames.put(138, "sys_fstatfs");VM66:9 systemCallNames.put(139, "sys_sysfs");VM66:9 systemCallNames.put(140, "sys_getpriority");VM66:9 systemCallNames.put(141, "sys_setpriority");VM66:9 systemCallNames.put(142, "sys_sched_setparam");VM66:9 systemCallNames.put(143, "sys_sched_getparam");VM66:9 systemCallNames.put(144, "sys_sched_setscheduler");VM66:9 systemCallNames.put(145, "sys_sched_getscheduler");VM66:9 systemCallNames.put(146, "sys_sched_get_priority_max");VM66:9 systemCallNames.put(147, "sys_sched_get_priority_min");VM66:9 systemCallNames.put(148, "sys_sched_rr_get_interval");VM66:9 systemCallNames.put(149, "sys_mlock");VM66:9 systemCallNames.put(150, "sys_munlock");VM66:9 systemCallNames.put(151, "sys_mlockall");VM66:9 systemCallNames.put(152, "sys_munlockall");VM66:9 systemCallNames.put(153, "sys_vhangup");VM66:9 systemCallNames.put(154, "sys_modify_ldt");VM66:9 systemCallNames.put(155, "sys_pivot_root");VM66:9 systemCallNames.put(156, "sys__sysctl");VM66:9 systemCallNames.put(157, "sys_prctl");VM66:9 systemCallNames.put(158, "sys_arch_prctl");VM66:9 systemCallNames.put(159, "sys_adjtimex");VM66:9 systemCallNames.put(160, "sys_setrlimit");VM66:9 systemCallNames.put(161, "sys_chroot");VM66:9 systemCallNames.put(162, "sys_sync");VM66:9 systemCallNames.put(163, "sys_acct");VM66:9 systemCallNames.put(164, "sys_settimeofday");VM66:9 systemCallNames.put(165, "sys_mount");VM66:9 systemCallNames.put(166, "sys_umount2");VM66:9 systemCallNames.put(167, "sys_swapon");VM66:9 systemCallNames.put(168, "sys_swapoff");VM66:9 systemCallNames.put(169, "sys_reboot");VM66:9 systemCallNames.put(170, "sys_sethostname");VM66:9 systemCallNames.put(171, "sys_setdomainname");VM66:9 systemCallNames.put(172, "sys_iopl");VM66:9 systemCallNames.put(173, "sys_ioperm");VM66:9 systemCallNames.put(174, "sys_create_module");VM66:9 systemCallNames.put(175, "sys_init_module");VM66:9 systemCallNames.put(176, "sys_delete_module");VM66:9 systemCallNames.put(177, "sys_get_kernel_syms");VM66:9 systemCallNames.put(178, "sys_query_module");VM66:9 systemCallNames.put(179, "sys_quotactl");VM66:9 systemCallNames.put(180, "sys_nfsservctl");VM66:9 systemCallNames.put(181, "sys_getpmsg");VM66:9 systemCallNames.put(182, "sys_putpmsg");VM66:9 systemCallNames.put(183, "sys_afs_syscall");VM66:9 systemCallNames.put(184, "sys_tuxcall");VM66:9 systemCallNames.put(185, "sys_security");VM66:9 systemCallNames.put(186, "sys_gettid");VM66:9 systemCallNames.put(187, "sys_readahead");VM66:9 systemCallNames.put(188, "sys_setxattr");VM66:9 systemCallNames.put(189, "sys_lsetxattr");VM66:9 systemCallNames.put(190, "sys_fsetxattr");VM66:9 systemCallNames.put(191, "sys_getxattr");VM66:9 systemCallNames.put(192, "sys_lgetxattr");VM66:9 systemCallNames.put(193, "sys_fgetxattr");VM66:9 systemCallNames.put(194, "sys_listxattr");VM66:9 systemCallNames.put(195, "sys_llistxattr");VM66:9 systemCallNames.put(196, "sys_flistxattr");VM66:9 systemCallNames.put(197, "sys_removexattr");VM66:9 systemCallNames.put(198, "sys_lremovexattr");VM66:9 systemCallNames.put(199, "sys_fremovexattr");VM66:9 systemCallNames.put(200, "sys_tkill");VM66:9 systemCallNames.put(201, "sys_time");VM66:9 systemCallNames.put(202, "sys_futex");VM66:9 systemCallNames.put(203, "sys_sched_setaffinity");VM66:9 systemCallNames.put(204, "sys_sched_getaffinity");VM66:9 systemCallNames.put(205, "sys_set_thread_area");VM66:9 systemCallNames.put(206, "sys_io_setup");VM66:9 systemCallNames.put(207, "sys_io_destroy");VM66:9 systemCallNames.put(208, "sys_io_getevents");VM66:9 systemCallNames.put(209, "sys_io_submit");VM66:9 systemCallNames.put(210, "sys_io_cancel");VM66:9 systemCallNames.put(211, "sys_get_thread_area");VM66:9 systemCallNames.put(212, "sys_lookup_dcookie");VM66:9 systemCallNames.put(213, "sys_epoll_create");VM66:9 systemCallNames.put(214, "sys_epoll_ctl_old");VM66:9 systemCallNames.put(215, "sys_epoll_wait_old");VM66:9 systemCallNames.put(216, "sys_remap_file_pages");VM66:9 systemCallNames.put(217, "sys_getdents64");VM66:9 systemCallNames.put(218, "sys_set_tid_address");VM66:9 systemCallNames.put(219, "sys_restart_syscall");VM66:9 systemCallNames.put(220, "sys_semtimedop");VM66:9 systemCallNames.put(221, "sys_fadvise64");VM66:9 systemCallNames.put(222, "sys_timer_create");VM66:9 systemCallNames.put(223, "sys_timer_settime");VM66:9 systemCallNames.put(224, "sys_timer_gettime");VM66:9 systemCallNames.put(225, "sys_timer_getoverrun");VM66:9 systemCallNames.put(226, "sys_timer_delete");VM66:9 systemCallNames.put(227, "sys_clock_settime");VM66:9 systemCallNames.put(228, "sys_clock_gettime");VM66:9 systemCallNames.put(229, "sys_clock_getres");VM66:9 systemCallNames.put(230, "sys_clock_nanosleep");VM66:9 systemCallNames.put(231, "sys_exit_group");VM66:9 systemCallNames.put(232, "sys_epoll_wait");VM66:9 systemCallNames.put(233, "sys_epoll_ctl");VM66:9 systemCallNames.put(234, "sys_tgkill");VM66:9 systemCallNames.put(235, "sys_utimes");VM66:9 systemCallNames.put(236, "sys_vserver");VM66:9 systemCallNames.put(237, "sys_mbind");VM66:9 systemCallNames.put(238, "sys_set_mempolicy");VM66:9 systemCallNames.put(239, "sys_get_mempolicy");VM66:9 systemCallNames.put(240, "sys_mq_open");VM66:9 systemCallNames.put(241, "sys_mq_unlink");VM66:9 systemCallNames.put(242, "sys_mq_timedsend");VM66:9 systemCallNames.put(243, "sys_mq_timedreceive");VM66:9 systemCallNames.put(244, "sys_mq_notify");VM66:9 systemCallNames.put(245, "sys_mq_getsetattr");VM66:9 systemCallNames.put(246, "sys_kexec_load");VM66:9 systemCallNames.put(247, "sys_waitid");VM66:9 systemCallNames.put(248, "sys_add_key");VM66:9 systemCallNames.put(249, "sys_request_key");VM66:9 systemCallNames.put(250, "sys_keyctl");VM66:9 systemCallNames.put(251, "sys_ioprio_set");VM66:9 systemCallNames.put(252, "sys_ioprio_get");VM66:9 systemCallNames.put(253, "sys_inotify_init");VM66:9 systemCallNames.put(254, "sys_inotify_add_watch");VM66:9 systemCallNames.put(255, "sys_inotify_rm_watch");VM66:9 systemCallNames.put(256, "sys_migrate_pages");VM66:9 systemCallNames.put(257, "sys_openat");VM66:9 systemCallNames.put(258, "sys_mkdirat");VM66:9 systemCallNames.put(259, "sys_mknodat");VM66:9 systemCallNames.put(260, "sys_fchownat");VM66:9 systemCallNames.put(261, "sys_futimesat");VM66:9 systemCallNames.put(262, "sys_newfstatat");VM66:9 systemCallNames.put(263, "sys_unlinkat");VM66:9 systemCallNames.put(264, "sys_renameat");VM66:9 systemCallNames.put(265, "sys_linkat");VM66:9 systemCallNames.put(266, "sys_symlinkat");VM66:9 systemCallNames.put(267, "sys_readlinkat");VM66:9 systemCallNames.put(268, "sys_fchmodat");VM66:9 systemCallNames.put(269, "sys_faccessat");VM66:9 systemCallNames.put(270, "sys_pselect6");VM66:9 systemCallNames.put(271, "sys_ppoll");VM66:9 systemCallNames.put(272, "sys_unshare");VM66:9 systemCallNames.put(273, "sys_set_robust_list");VM66:9 systemCallNames.put(274, "sys_get_robust_list");VM66:9 systemCallNames.put(275, "sys_splice");VM66:9 systemCallNames.put(276, "sys_tee");VM66:9 systemCallNames.put(277, "sys_sync_file_range");VM66:9 systemCallNames.put(278, "sys_vmsplice");VM66:9 systemCallNames.put(279, "sys_move_pages");VM66:9 systemCallNames.put(280, "sys_utimensat");VM66:9 systemCallNames.put(281, "sys_epoll_pwait");VM66:9 systemCallNames.put(282, "sys_signalfd");VM66:9 systemCallNames.put(283, "sys_timerfd_create");VM66:9 systemCallNames.put(284, "sys_eventfd");VM66:9 systemCallNames.put(285, "sys_fallocate");VM66:9 systemCallNames.put(286, "sys_timerfd_settime");VM66:9 systemCallNames.put(287, "sys_timerfd_gettime");VM66:9 systemCallNames.put(288, "sys_accept4");VM66:9 systemCallNames.put(289, "sys_signalfd4");VM66:9 systemCallNames.put(290, "sys_eventfd2");VM66:9 systemCallNames.put(291, "sys_epoll_create1");VM66:9 systemCallNames.put(292, "sys_dup3");VM66:9 systemCallNames.put(293, "sys_pipe2");VM66:9 systemCallNames.put(294, "sys_inotify_init1");VM66:9 systemCallNames.put(295, "sys_preadv");VM66:9 systemCallNames.put(296, "sys_pwritev");VM66:9 systemCallNames.put(297, "sys_rt_tgsigqueueinfo");VM66:9 systemCallNames.put(298, "sys_perf_event_open");VM66:9 systemCallNames.put(299, "sys_recvmmsg");VM66:9 systemCallNames.put(300, "sys_fanotify_init");VM66:9 systemCallNames.put(301, "sys_fanotify_mark");VM66:9 systemCallNames.put(302, "sys_prlimit64");VM66:9 systemCallNames.put(303, "sys_name_to_handle_at");VM66:9 systemCallNames.put(304, "sys_open_by_handle_at");VM66:9 systemCallNames.put(305, "sys_clock_adjtime");VM66:9 systemCallNames.put(306, "sys_syncfs");VM66:9 systemCallNames.put(307, "sys_sendmmsg");VM66:9 systemCallNames.put(308, "sys_setns");VM66:9 systemCallNames.put(309, "sys_getcpu");VM66:9 systemCallNames.put(310, "sys_process_vm_readv");VM66:9 systemCallNames.put(311, "sys_process_vm_writev");VM66:9 systemCallNames.put(312, "sys_kcmp");VM66:9 systemCallNames.put(313, "sys_finit_module");VM66:9 systemCallNames.put(314, "sys_sched_setattr");VM66:9 systemCallNames.put(315, "sys_sched_getattr");VM66:9 systemCallNames.put(316, "sys_renameat2");VM66:9 systemCallNames.put(317, "sys_seccomp");VM66:9 systemCallNames.put(318, "sys_getrandom");VM66:9 systemCallNames.put(319, "sys_memfd_create");VM66:9 systemCallNames.put(320, "sys_kexec_file_load");VM66:9 systemCallNames.put(321, "sys_bpf");VM66:9 systemCallNames.put(322, "stub_execveat");VM66:9 systemCallNames.put(323, "userfaultfd");VM66:9 systemCallNames.put(324, "membarrier");VM66:9 systemCallNames.put(325, "mlock2");VM66:9 systemCallNames.put(326, "copy_file_range");VM66:9 systemCallNames.put(327, "preadv2");VM66:9 systemCallNames.put(328, "pwritev2");

Rularea scriptului pe un binar va adnota apelurile de sistem pe care le găsește, adăugând un plate comment.

În concluzie, crearea primului meu script în Ghidra nu a fost chiar grea, iar odată ce mi-am dat seama cum să configurez Eclipse și să-l leg corect, experiența de dezvoltare a fost minunată. Sper că din ce în ce mai mulți oameni vor adopta Ghidra și vor contribui la ea. Unele training-uri și exerciții pentru Ghidra pot fi găsite în ghidra_9.1-BETA_DEV/docs.

Mulțumesc că ai citit și ai o zi minunată!