The first time most people open Ghidra, they close it within ten minutes. The interface looks like something from a 1990s aerospace project — multiple floating windows, panels everywhere, terminology from academic computer science.
Let me save you that panic. For ECU firmware analysis, you only need five windows. Everything else you can ignore for months.
1. Program Trees
This shows the memory segments of the firmware — flash regions, RAM, data sections. For a Bosch EDC17 file, you’ll see the code sections (usually starting around 0x80000000 in TriCore address space) and the data sections. This is your orientation. Before you read a single instruction, you need to know where you are in memory.
2. Symbol Tree
Ghidra auto-analyzes the binary and names functions it can identify — things like FUN_80001234. As you work, you rename these based on what you figure out they do. The Symbol Tree is your growing map of the firmware. At the start it looks like noise. After a few sessions of analysis, it becomes your index.
3. Listing (Disassembly)
This is the core. Raw assembly instructions, addresses on the left, TriCore mnemonics in the middle, auto-generated comments on the right. This is where you spend 80% of your time. Navigating here, reading here, cross-referencing here.
4. Decompiler
Ghidra’s decompiler translates assembly into pseudo-C. It’s not perfect — variable names are generic, some logic gets mangled — but it dramatically accelerates reading unfamiliar code sections. When I hit a complex function in assembly, I switch to the Decompiler view first to get the structural logic, then go back to Listing to verify the details.
5. References window
When you find something interesting — a map address, a constant, a function — you need to know where else in the firmware it appears. The References window shows every location that reads from or writes to a given address. This is how you trace data flow. You find a calibration value in memory, then find every function that uses it.
That’s it. Five windows. The rest of the interface is useful later — the byte viewer, the function call graph, the patch diffing tools — but those five are how you actually do ECU work in Ghidra.
The interface stops being intimidating roughly two hours into Ghidra Fundamental, Chapter 2. We walk through each window with an actual firmware file loaded, not a tutorial binary.