Ghidra analysis workflow

A good reverse-engineering workflow moves from broad orientation to focused hypotheses: identify entry points, map important strings/functions, then trace control and data flow.

• Rename functions as you understand them.
• Add comments describing evidence, not guesses.
• Use cross-references to find callers and users of data.
• Validate decompiler output against assembly when behavior matters.