# Static Disassembly

> Master static disassembly for malware analysis. Learn to use Ghidra and IDA Pro to translate machine code into readable assembly without executing the threat.

Canonical: https://codelivly.com/rooms/static-disassembly
Last updated: 2026-09-18

| | |
|---|---|
| Level | Intermediate |
| Category | Malware Analysis |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module explores the foundational technique of static disassembly in malware analysis. You will learn how to safely analyze compiled binaries without executing them by using industry-standard disassemblers like Ghidra, IDA Pro, and Binary Ninja. The curriculum covers navigating the disassembly interface, understanding Control Flow Graphs (CFGs), utilizing cross-references (X-refs) to trace data and code flow, and identifying key functions and API calls. By mastering static disassembly, you will be able to safely map out a malware's logic, uncover hidden capabilities, and prepare for advanced dynamic analysis and debugging.

## Lessons

1. What Is Disassembly and Why Does It Matter (30 min)
2. Navigating IDA Free / Ghidra (30 min)
3. Identifying Functions and Cross-References (30 min)
4. Recognizing Common Code Patterns (Loops, Conditionals, API Calls) (30 min)
5. Guided Lab: Disassembling and Annotating a Sample Binary (30 min)

## Related

- [Learning path: Reverse Engineering Fundamentals](https://codelivly.com/learning-paths/reverse-engineering-fundamentals)
- [All rooms](https://codelivly.com/rooms)