2

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

PrintToConsole Decompilation

The assembly for this function is:

PrintToConsole Assembly

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

Invalid Address Error

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code. I don't understand how Ghidra can pickup part of the name of the string, but won't then let me click through to it?

I also seem to be getting a lot of global variables names like this in the disassembly:

Global Variables with Unfamiliar Naming

And when I go to rename them, I get the following error:

Rename Failed Error

I have no idea if these two issues are related or not?

Any suggestions?

Thanks, James.

Improve this question
2
  • Ghidra didn't pick up the data segment correctly for this executable. I had to redefine it correctly, and then manually set the DS register value for each of the functions that require it. Setting the DS register manually seems to introduce the "uRAM" globals.
    – jttri777
    Commented May 14, 2023 at 22:33
  • By messing around with the memory maps, I've managed to solve the issue with the "uRAM" globals, they had been placed in a memory block that was separate to the data segment, meaning that the DS value was having no effect. Merging the blocks has now solved this issue, however I still don't seem to be able to double click on the string values in the decompilation.
    – jttri777
    Commented May 15, 2023 at 1:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.