Opening a binary in Ghidra and finding main

02What the tool is for

In an actual Ghidra project, importing a binary establishes the bytes to analyze and the chosen machine-language interpretation. Analysis can identify functions, references and candidate types. The decompiler window follows the selected function and uses labels and types applied during analysis. Changing a label changes the analysis presentation, not the original source file.

A symbol is a name associated with a location, such as a function name retained in a binary. Stripping can remove some names, so failure to find a main symbol does not prove that a program lacks a main function. The operating-system entry location and the C main function are distinct. No project is open here, so no symbol or address has been found.

The navigation card describes a candidate tool setup, not a required installation. It states its Ghidra/JDK documentation snapshot and architecture limits. A live import, matched binary, analysis settings and decompiler export remain missing. Use the source/sketch comparison to practice reading while keeping those practical gaps explicit.

Ghidra navigation card. Not a screenshot. You do not need Ghidra for this page.

From Getting Started, effective as of Ghidra 12.2 and subject to change:
Linux is a supported platform.
The stated software requirement is a Java 25 64-bit JDK.
Install by extracting the distribution. Do not extract it on top of an existing copy.
GUI launch is ghidraRun from the install directory.
An official public release includes native binaries for Linux x86-64.
Linux ARM 64-bit is listed as needing user-built native components. Building them is not part of this lesson.

From the Decompiler window help:
The window shows one function at a time.
It follows the current address in the Code Browser.
Decompilation is done on the fly and picks up labels, data types, and comments the user has applied.

Finding main, without a project:
If a later owned project shows a function named main, that name is a symbol in that file.
A missing name does not prove where main is.
The program entry and the C function named main are different ideas.
The GDB manual says that for C the main procedure is named main.
This course has no Ghidra project, so no symbol was looked up.

/* Original teaching source. Not compiled. */
int mark(int x) {
    if (x == 7) {
        return 1;
    }
    return 0;
}

Author sketch of a decompiler-style view.
Not produced by Ghidra. Not the original source. Not a disassembly.

int recovered(int value) {
    if (value == 7) {
        return 1;
    }
    return 0;
}

Compare this sketch with compare.c.
The source function is named mark and its parameter is named x.
This sketch uses recovered and value.
The decision has the same shape. The text is not the source file.
No address from a Ghidra listing belongs on this card.

03Compare the sketch with the source

Use the two downloads. The question asks a yes-or-no about a guarantee. This activity asks for a name that differs.

1. Place the mark function and the recovered function in your notes.
2. Underline one name that differs. Check: mark versus recovered, or x versus value.
3. Write the shared decision in one line: equal to 7 returns 1, and the other path returns 0.
4. Stop. Do not open Ghidra and do not invent an address to make the sketch look official.

04Optional challenge

Suppose a later project let you rename recovered back to mark. Explain why that rename would be an analysis label, and why it still would not create the missing binary. About ten minutes.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

A decompiler window reconstructs a high-level C-like representation from a program.
It is not a recovery guarantee for original names or exact original source text.
A function must first be located in an actual imported/analyzed project.

Source: int lower(int amount) { if (amount == 6) return 1; return 0; }
Author sketch: int function_1(int value) { return value == 6; }
For this model, a true comparison produces 1 and false produces 0.
Both lines are hand-written, not Ghidra output. No binary or project is supplied.

06Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: describe reconstruction accurately; compare names, control structure and predicted values independently; identify the missing project and avoid attributing the hand-written sketch to a tool.