Today’s topic is how to install NSA Ghidra reverse engineering tool on CentOS 7 in 10 minutes. Reverse engineering of malware normally requires software that is priced out of the reach of folks that are trying to get into forensics or incident response; not anymore! NSA released the Ghidra reverse engineering tool at no cost for the end user. This is great news for people wanting to join the ranks of security analysts.
Installing Ghidra is pretty easy, it relies on Java 11.0.2 as the only real dependency. The first order of business is to make sure your machine is updated, you will need root privileges for this:
yum -y update
Then check the current Java version:
If the version is not 11.0.2 and does not include the developers kit then it will need to be updated. Visit the following link and grab the rpm for the java developers kit: https://www.oracle.com/technetwork/java/javase/downloads/jdk11-downloads-5066655.html
Perform a local install with the downloaded jdk rpm file by executing the following command as root:
yum localinstall jdk-11.0.2_linux-x64_bin.rpm
Configure the new java with the alternatives command:
alternatives --config java
Ghidra is a self contained installation that you just need to unpack. It does not need to be compiled and will run from any location as long as java is in your path. Installing Ghidra is as easy as downloading it and unzipping it in your home directory. Download it from https://ghidra-sre.org/
To unpack it just unzip it like so:
Running Ghidra is pretty simple, just cd into the directory and execute the ghidraRun script.
This will start Ghidra and you will initially be presented with a dialog box and will need to accept the users agreement. Next you will need to create a new project and import some malware for analysis.