3

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it does with windows calls, e.g: fopen,printf, etc.

1 Answer 1

1

If I understand the question correctly, this is what should be done in order for Ghidra to have access to external libraries.

For the following C code:

#include <stdio.h>

int main()
{
    printf("Hello World");
    return 1;
}

Compile the code with your favorite compiler, I choose clang. With the compiler front-end, clang code.c -o code that will produce an executable.

In Ghidra create a new project and import the executable file to Ghidra either by dragging the file to the Project or in the menu choose "file" and press "Import File" (Press I in the keyboard) and choose the executable file.

After importing the executable file Ghidra will show you a Dialog:

Ghidra Import Dialog

In the Dialog click on Options and a new window will appear:

enter image description here

Tick "Load External Libraries" and press "OK" twice. Ghidra will locate and import the necessary external libraries to your project.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.