Ghidra Cheat Sheet

Navigation

Key	Action
`G`	Go to address or symbol
`Enter` / double-click	Follow reference
`Alt+←` / `Alt+→`	Navigate history back/forward
`Ctrl+Shift+F`	Find references to cursor
`Ctrl+Shift+E`	Find references from cursor
`Ctrl+F`	Search within current view
`Ctrl+Shift+S`	Search all programs (multi-binary)
`Ctrl+L`	Go to label by name
`.` (period)	Go to cursor address in other view

Views & Windows

Menu path	Window
Window → Decompiler	Decompiler panel
Window → Function Graph	Graph view
Window → Symbol Tree	Imports / Exports / Functions
Window → Data Type Manager	Struct / type browser
Window → Program Tree	Sections view
Window → References	Xref results
Window → Bytes	Hex dump
Window → Python	Python/Jython REPL
Window → Script Manager	Browse & run scripts
Window → Memory Map	Segment layout
Window → Call Trees	Call graph
Window → Function Call Graph	Callers / callees graph
Window → Entropy	Packed section detection

Naming & Comments

Key	Action
`L`	Rename label, function, or variable
`;`	Add / edit comment (opens dialog for all types)
`Ctrl+Z`	Undo
`Ctrl+Y`	Redo

Comment types (all via ; dialog):

Type	Appears
EOL	End of the instruction line
Pre	Line(s) above instruction
Post	Line(s) below instruction
Plate	Large banner above function
Repeatable	At instruction and at every xref

Code & Data Definition

Key	Action
`D`	Disassemble at cursor
`C`	Clear (undefine)
`B`	Cycle data size: byte → word → dword → qword
`"`	Cycle string type: ascii → unicode → …
`F`	Create function at cursor (when on code)
`F`	Cycle float type (when on data)
`E`	Edit function signature
`T`	Apply struct / data type
`Ctrl+Z`	Undo any of the above

Define array: right-click → Data → Create Array

Cross-References (Xrefs)

Action	How
Xrefs to cursor	`Ctrl+Shift+F` or right-click → References → Show References To
Xrefs from cursor	`Ctrl+Shift+E`
Xrefs to selected field	right-click field → References → Show References To Address
Incoming calls	Window → Function Call Graph
Show all callers	Window → Call Trees (Calls To)

In the decompiler: right-click a variable or call → Find References

Search

Action	How
Search for address / symbol	`G`
Search listing text	`Ctrl+F`
Search memory (bytes / string / regex)	Search → Memory (`S`)
Search for direct references	Search → Direct References
Search for instruction patterns	Search → For Instruction Patterns
Scan all strings	Window → Defined Strings
Scan all constants	Search → For Scalars

Decompiler

Key	Action
`L`	Rename variable or function
`Ctrl+L`	Retype variable (set C type)
`F`	Edit function signature
`;`	Add comment at current line
`Ctrl+Z`	Undo
`Ctrl+F`	Find in decompiler output
`Ctrl+E`	Edit label at cursor
right-click → Override Signature	Override calling convention / args
right-click → Auto Fill…	Propagate types from known structs
right-click → Commit Params/Return	Push decompiler-inferred types to DB

Decompiler sync: clicking in listing highlights matching decompiler line and vice versa — always keep both panels open.

Function Graph

Key / Action	Effect
`Space` (listing)	Open Function Graph window
`+` / `-`	Zoom in / out
`Ctrl+Shift+E`	Fit graph to window
`V`	Toggle full-screen graph
drag background	Pan
scroll	Zoom
click node	Jump listing + decompiler to block
right-click edge	Navigate branch

Edge colors: green = taken (true), red = not-taken (false), blue = unconditional

Structs & Data Types

Action	How
Browse types	Window → Data Type Manager
Apply type at cursor	`T`, then pick from manager
Create new struct	Data Type Manager → right-click archive → New → Structure
Import C headers	File → Parse C Source (CParser plugin)
Import from PDB	File → Load PDB File
Retype decompiler variable	right-click var → Retype Variable
Retype function parameter	right-click param → Retype Parameter
Map struct onto memory	right-click memory → Data → [struct name]

Version Tracking (Binary Diffing)

Step	Action
Open	Tools → Version Tracking
New session	File → New Session → pick source + destination programs
Run correlators	Apply built-in correlators (Exact Function/Data match first)
Review matches	Matches panel → accept / reject
Apply markup	Accepted matches → Apply Markup (copies names, comments, types)

Useful for: tracking patches, comparing malware variants, propagating analysis across a family.

Headless / Batch Analysis

# Analyze and import into project
analyzeHeadless /path/to/project MyProject \
  -import target.exe \
  -postScript PrintASCII.java

# Run script on already-imported binary
analyzeHeadless /path/to/project MyProject \
  -process target.exe \
  -postScript ExportFunctions.py

# Import many files
analyzeHeadless /path/to/project MyProject \
  -import /samples/*.exe \
  -recursive

# Export decompiled C to file
analyzeHeadless /path/to/project MyProject \
  -process target.exe \
  -postScript DecompileAllFunctions.java output_dir/

analyzeHeadless lives in $GHIDRA_HOME/support/.

PyGhidra / Jython Quickstart

# --- Jython (Script Manager, runs inside Ghidra) ---
from ghidra.program.model.listing import *

prog = currentProgram
fm   = prog.getFunctionManager()
listing = prog.getListing()

# Iterate all functions
for f in fm.getFunctions(True):
    print(f.getName(), f.getEntryPoint())

# Get instruction at address
addr = toAddr(0x00401000)
insn = listing.getInstructionAt(addr)
print(insn.getMnemonicString())

# Rename a function
f = fm.getFunctionAt(addr)
f.setName("my_decrypt", SourceType.USER_DEFINED)

# Iterate xrefs to address
refs = getReferencesTo(addr)
for r in refs:
    print(r.getFromAddress(), r.getReferenceType())

# Add comment
setEOLComment(addr, "interesting!")

# --- PyGhidra (CPython3, outside Ghidra) ---
import pyghidra
with pyghidra.open_program("target.exe") as flat_api:
    for f in flat_api.currentProgram.getFunctionManager()\
             .getFunctions(True):
        print(f.getName())

Useful Extensions & Scripts

Tool	Purpose
Kaiju	Function hashing, malware triage, CERT/CC
BinDiff	Binary diffing (also has Ghidra plugin)
Quark-Engine	Android malware scoring
ret-sync	Sync Ghidra with debugger (x64dbg, WinDbg, gdb)
ghidra-firmware-utils	UEFI / firmware loaders
GhidraDec	RetDec alternative decompiler
Script Manager built-ins	`FindReferencesToHighlight`, `DecompileAllFunctions`, `ExportFunctionInfoScript`, `RecoverClassesFromRTTIScript`

Install extensions: File → Install Extensions (zip file from GitHub releases).

Calling Conventions (x86-64)

Convention	Arg registers	Callee-saved	Return
System V AMD64 (Linux)	rdi, rsi, rdx, rcx, r8, r9	rbx, rbp, r12–r15	rax (rdx)
Microsoft x64 (Windows)	rcx, rdx, r8, r9	rbx, rbp, rdi, rsi, r12–r15	rax
x86 stdcall	stack (right→left)	ebx, esi, edi, ebp	eax
x86 cdecl	stack (right→left), caller cleans	ebx, esi, edi, ebp	eax

Ghidra infers calling conventions from analysis. Override via Edit Function Signature → Calling Convention when it guesses wrong.

Memory Segments Quick Reference

Segment	Typical contents
`.text` / `CODE`	Executable instructions
`.data`	Initialized globals
`.bss`	Uninitialized globals
`.rdata` / `.rodata`	Read-only data, strings, vtables
`.idata` / `EXTERNAL`	Import table (Ghidra calls it EXTERNAL)
`.edata`	Export table
`STACK`	Local variables (per frame)
`HEAP`	Dynamic allocations (runtime)

IDA → Ghidra Rosetta

Concept	IDA	Ghidra
Rename	`N`	`L`
Decompile	`F5`	always-on right pane
Toggle graph	`Space`	Window → Function Graph
Xrefs to	`X`	`Ctrl+Shift+F`
Go to address	`G`	`G`
Comment	`:` / `;`	`;` (type dialog)
Undefine	`U`	`C` (clear)
Define function	`P`	`F`
Set type	`Y`	`Ctrl+L` / right-click Retype
Database file	`.idb` / `.i64`	`.gpr` + project dir
Scripting	IDAPython	Jython / PyGhidra
Signature library	FLIRT `.sig`	FunctionID `.fidb`
Named structs	Structures window	Data Type Manager