Skip to main content
added 116 characters in body
Source Link

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

PrintToConsole Decompilation

The assembly for this function is:

PrintToConsole Assembly

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

Invalid Address Error

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code. I don't understand how Ghidra can pickup part of the name of the string, but won't then let me click through to it?

I also seem to be getting a lot of global variables names like this in the disassembly:

Global Variables with Unfamiliar Naming

And when I go to rename them, I get the following error:

Rename Failed Error

I have no idea if these two issues are related or not?

Any suggestions?

Thanks, James.

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

PrintToConsole Decompilation

The assembly for this function is:

PrintToConsole Assembly

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

Invalid Address Error

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code.

I also seem to be getting a lot of global variables names like this in the disassembly:

Global Variables with Unfamiliar Naming

And when I go to rename them, I get the following error:

Rename Failed Error

I have no idea if these two issues are related or not?

Any suggestions?

Thanks, James.

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

PrintToConsole Decompilation

The assembly for this function is:

PrintToConsole Assembly

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

Invalid Address Error

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code. I don't understand how Ghidra can pickup part of the name of the string, but won't then let me click through to it?

I also seem to be getting a lot of global variables names like this in the disassembly:

Global Variables with Unfamiliar Naming

And when I go to rename them, I get the following error:

Rename Failed Error

I have no idea if these two issues are related or not?

Any suggestions?

Thanks, James.

Source Link

Ghidra Strings and Global Renaming Issue

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

PrintToConsole Decompilation

The assembly for this function is:

PrintToConsole Assembly

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

Invalid Address Error

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code.

I also seem to be getting a lot of global variables names like this in the disassembly:

Global Variables with Unfamiliar Naming

And when I go to rename them, I get the following error:

Rename Failed Error

I have no idea if these two issues are related or not?

Any suggestions?

Thanks, James.