0

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other.

Based on asking others and thinking about it myself, I have come up with the following:

  • Symbols - if they exist
  • Library references could serve as hints, if they can be identified
  • String references (i.e., both pieces of code refer to the same constant string)
  • Trying to find the same opcode sequence - is there any easy way to do this, where I could do something like cut the assembly from IDA and tell Ghidra to find the same sequence of instructions?

What else is there? Are there any automated tools for this? If there are no symbols, what is the "best" way?

I am assuming that it is useful to be able to use both tools on the same target. Perhaps I am wrong.

Improve this question

2 Answers 2

Reset to default
2

If you have the same binary then this should be straightforward. The approaches you came up with are all typical and useful for trying to correlate code from similar binaries and are then handled by dedicated tools/plugins (like BinDiff, Diaphora, or Ghidra's Version tracking)

If the binary has a fixed location in the address space, then both IDA and Ghidra should load them at this address and the address of the assembly code you are interested in should just be the same in IDA and Ghidra. If the binary is position independent then IDA and Ghidra might load them at different addresses by default, but this can be set to the same address during the initial import. Then the addresses for each instruction or data should be the same in IDA and Ghidra.

Improve this answer
3
  • Wow, that's all? That sounds easy.
    – Paul
    May 24, 2022 at 20:30
  • Is there any easy analogue for gdb?
    – Paul
    May 24, 2022 at 20:32
  • Same idea with GDB. Either there is a fixed base address that the binary has to be loaded at anyway, then the addresses should just be the same in GDB. But I don't remember how to set the base address with GDB in case of a position independent executable, so maybe the workaround to that has to be using the base address of GDB in IDA/Ghidra.
    – Florian Magin
    May 25, 2022 at 9:12
0

It looks like maybe this would work?

How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)

IIUC you find the base address in each tool, and then assume that the offset should be the same in both tools.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.