0% found this document useful (0 votes)
2K views2 pages

Ghidra Cheat Sheet

This document provides keyboard shortcuts and menu options for navigating and interacting with data in the Ghidra software reverse engineering tool. It lists actions like opening and saving projects, navigating code and data, defining variable types, searching, and viewing different windows like the decompiler, function call graph, and memory map. The shortcuts described include common modifier keys like Ctrl, Alt, and Shift combined with other keys to trigger commands in the Ghidra user interface.
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
2K views2 pages

Ghidra Cheat Sheet

This document provides keyboard shortcuts and menu options for navigating and interacting with data in the Ghidra software reverse engineering tool. It lists actions like opening and saving projects, navigating code and data, defining variable types, searching, and viewing different windows like the decompiler, function call graph, and memory map. The shortcuts described include common modifier keys like Ctrl, Alt, and Shift combined with other keys to trigger commands in the Ghidra user interface.
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Key Markup Cycle ❖ → Data → Cycle

Integer B → byte, word, dword,


Action Mods + Key Menu → Path Ctrl + Z Edit → Undo
Context Undo Types qword
The action may only be available in the Cycle ❖ → Data → Cycle
Ctrl + Shift + Z Edit → Redo
given context. Redo String ' → char, string,
❖ indicates the context menu, i.e., right- File → Save Types unicode
click. Save Ctrl + S program Cycle
❖ → Data → Cycle
The Ctrl key is replaced by the command Program name Float F
→ float, double
Types
⌘ key on Macintosh. Disassemble D
❖→
Disassemble Create ❖ → Data → Create
[
Clear ❖ → Clear Array2 Array
Load Project/Program C
Code/Data Code Bytes Create
File → New P ❖ → Data → pointer
New Project Ctrl + N
❖ → Add Pointer2
Project Add Label L
Address field Label Create
File → Open ❖ → Data → Create
Open Project Ctrl + O Structure Shift + [
Project Edit Label L
❖ → Edit Selection of Structure
File → Close Label field Label data
Close Project1 Ctrl + W Project
Rename ❖→ New Structure ❖ → New →
File → Save Function L
Function → Data type container Structure
Save Project1 Ctrl + S Project Function name Rename File → Parse C
field Function Import C Header
File → Import Source
Import File1 I
File ❖→
Remove ❖ → References →
Export File → Export Label Del Remove Cross References Show References to
O
Program Program Label field Label context
Open File File → Open File Remove ❖→ 2 When possible, arrays and
pointers are
Ctrl + I
System1 System Function Del
Function → created of the data type currently applied.
1 Function name Delete
These actions are only available if there is field Function
an active project. Create or open a project Miscellaneous
first. ❖ → Data Select →
→ Choose Select
what
Help/Customize/Info Define Data T Data Type
Tools →
❖ → Data Program
Ghidra Help F1 Help → Contents 2 Program
→ type Differences
Hover on action Differences
About Ghidra Help → About Ghidra Repeat ❖ → Data
Help → About program Y → Last Rerun Ctrl + Shift + R
About Program Define Data
name Used: type Script
Preferences Edit → Tool Options Rename ❖→ Assemble Ctrl + Shift + G
❖ → Patch
Variable L Rename Instruction
Set Key Variable in
Binding F4 decompiler
Variable
Hover on action
Retype
Edit → Tool Options → Variable ❖ → Retype
Key Bindings Ctrl + L
🔧Key Bindings Variable in Variable
decompiler
Processor
❖ → Processor Manual
Manual
Navigation Windows
Navigation Window →
Go To G Ctrl + B
→ Go To Bookmarks Bookmarks
Alt + ←
Window →
Back Bytes: program
Byte Viewer
name
Alt + →
Forward
Navigation Function Call Trees
→ Toggle Window → Data
Ctrl + Alt + T Code Unit Data Types Type Manager
Toggle
Direction Search Window →
Direction Ctrl + E Decompile:
Decompiler
Navigation function name
Next Ctrl + Alt + I → Next Window →
Instruction Instruction Function Graph Function Graph
Navigation Window →
Ctrl + Alt + D → Next Script Manager
Next Data Script Manager
Data
Window →
Navigation Memory Map Memory Map
Next Ctrl + Alt + U → Next
Undefined Window →
Undefined
Register V Register
Navigation Values Manager
Next Ctrl + Alt + L → Next
Label Window →
Ghidra Cheat
Label
Symbol Table Symbol Table
Navigation
Window →
Ctrl + Alt + F → Next

Next
Function
Navigation
Symbol References Symbol
References Sheet
Function Window →
→ Go To
Ctrl + ↓ Symbol Tree Symbol Tree
Next
Function
Navigation Search
Previous → Go To Search Search →
Ctrl + ↑ S
Function Previous Memory Memory
Function Search →
Search
Navigation Ctrl + Shift + E Program
Program Text
Next → Next Text
Ctrl + Alt + N Instruction Search For ...
Non-function
Not In a Matching Instructions
Instruction
Function Address Tables Search →
Direct References For what
Navigation Instruction Patterns
Next → Next Scalars
Ctrl + Alt + V Strings
Different Byte Different
Value Byte Value
Ghidra is licensed under the Apache License, Version 2.0 (the
Navigation "License"); Unless required by applicable law or agreed to in
writing, software distributed under the License is distributed on an
Next Ctrl + Alt + B → Next "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
Bookmark OF ANY KIND, either express or implied. See the License for the
Bookmark specific language governing permissions and limitations under the
License.

You might also like