0

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't really any sort of section table to tell which areas are initialized.

Now I have an actual RAM dump, so I want to replace the nonsense data with it. (I'm not worried about also replacing valid data, since it should be identical.) However I can't find a way to do this without deleting all the information (references/labels/functions/etc) in the existing block, essentialy undoing all my work.

I can import the dump and put it at the correct address, but only as an overlay, which seems to put it in a different namespace or something (::80000000 instead of 80000000) where none of the existing information applies. I don't see any way to replace the block's content while keeping the information.

1
  • Can you use the API to write bytes directly to memory without wiping the existing information? Feels hacky, but might be a good enough workaround – Florian Magin Feb 23 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.