2

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will show them ?

As well as, there are many windows function that Ghidra does not recognize them and so it does not show function paraments(I am working on windows machine), even though I download the PDB file for the current file I check (Again, in IDA pro it shows the paraments without any problems), any ideas ?

Improve this question

1 Answer 1

Reset to default
1

I think (part of) the problem is that Ghidra doesn't ship with data type libraries for the Windows API by default, while IDA Pro does. You can download the relevant Ghidra DataType archives for example here https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo

Improve this answer
3
  • Thanks ! @Florian Magin. Do you know how to solve the the function pointer problem ?
    – rom
    Commented Jun 19, 2022 at 7:27
  • Did you try the datatype archives? I can imagine that this problem should also disappear if there the signature of some function contains the information that one argument is a function pointer (that itself has a signature again). It's important to note that you need to add the data type archive and then run the full auto analysis (again) so all analysis steps can utilize this information. If the problem is something more concrete, please extend your initial question with details. I am also not familiar with how exactly Ghidra handles PDBs
    – Florian Magin
    Commented Jun 21, 2022 at 10:00
  • @FlorianMagin this would be a great addition for the ghidra tag wiki. If you have more of these and feel like sharing, please edit them in. Thanks.
    – 0xC0000022L ♦
    Commented Nov 16, 2022 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.