Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.

What is currently open: format, architecture, function count.

Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.

Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.

Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.

Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.

Everything that references an address.

Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.

Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.

Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.