2

I have several questions about IDA and Ghidra (for MIPS and ARM):

  1. Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its implementation is in a library, and not to open a new instance of IDA or add the library in a new tab inside Ghidra

  2. Is there any good tutorial on reversing c++ for MIPS/ARM?

  3. Are there any plugin you recommend for Ghidra or IDA for MIPS/ARM ? all that I see is for x86 (not plugin for analyzing malware, plugins for analyzing firmware)

Improve this question

1 Answer 1

Reset to default
6

I can only properly answer your first question:

I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)

If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by:

  1. Opening the regular Import File... dialog
  2. Clicking Options inside that dialog
  3. Tick Load External Libraries
  4. [Optional] Click Edit Paths to select the paths that will be searched for your libraries
  5. Confirm all the dialogs with Ok.

Ghidra will now import your binary and all libraries needed by it. They will automatically be linked, which means that your imports in your main binary are resolved and you can jump to the library code via the GUI when looking at an external function call in your main binary.

I am not sure if this violates your "not to open a new instance of IDA or add the library in a new tab inside Ghidra" requirement, because this will open a new tab, in your Codebrowser's Listing window.

Improve this answer
8
  • Can this be done after a binary is imported?
    – multithr3at3d
    Commented Apr 12, 2020 at 16:45
  • I have tried what you say and from some reason it load additional libraries but not all what my binary needs.( i gave the ghidra a path to directory contains all libs from firmware)
    – Logan
    Commented Apr 12, 2020 at 19:47
  • @multithr3at3d I don't think you can do it that easily, but you can definitely add them manually via Windows -> External Programs and then run the FixupELFExternalSymbolsScript Script. With some scripting it shouldn't be that hard to automate searching for the library names in some path, adding the found ones, linking them like the External Programs window and then running FixupELFExternalSymbolsScript
    – Florian Magin
    Commented Apr 13, 2020 at 9:08
  • @Daniel Dan Not sure what the issue is with that. Does it work if you add them manually and run the FixupELFExternalSymbolsScript?
    – Florian Magin
    Commented Apr 13, 2020 at 9:11
  • @FlorianMagin . If i try to add them manually i get the following error: "IllegalArgumentException - name is invalid: java.lang.IllegalArgumentException: name is invalid:" . Do you have ideas ?
    – Logan
    Commented Apr 19, 2020 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.