I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the figure are giving me some trouble understanding the algorithm of the code.

  1. There are too much undefined variables. I don't know their datatypes. But as param_1 is a character array, I assume that local_58 will also be a character array of size 40 (from memcpy function call). So, local_30 will also be a character array of size 40(from memcpy function call). Am I right here?

  2. I assume the 2nd marked snippet is telling the value of local_30. If i am correct local_30 has a value of 00001100 00000111 10101010 10011000 11100011. Please correct me here if I am wrong.

  3. FUN_00400c3 is taking the local_58 and doing some operations. Along with local_58, the FUN function is also taking an integer and a unsigned long long int as 2nd and 3rd parameter. The 3rd parameter has a very large value. So, I am not sure whether ghidra is giving a correct value or a garbage one.

Ghidra decompile output

  • Don't look only at the decompilated code created by Ghidra, it may be wrong and misleading, if you don't fully understand the decompilated function just follow it in assembly code. – morsisko Jun 20 '20 at 14:04
  • Hi, actually i am not good with assembly language. That's why I am looking into the decompiled version. – Sumana Bagchi Jun 20 '20 at 14:21
  • 3
    So this is good moment to get better at assembly. I think that by looking only at the decompilation output it is impossible to tell if it is correct or not. – morsisko Jun 20 '20 at 14:53
  • For your first point: undefined is the variable type (like int, char...) It mostly means that Ghidra couldn't find the type, and not that the variable is undefined. Variable type is a property of C code and not of the assembly - in assembly and CPU there are only memory locations. – macro_controller Jun 21 '20 at 7:27
  • Hey I am also working at same code will you mind colab with me on mail or some other option. – Security Beast Jun 24 '20 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.