1

Greetings ladies & gentlemen,

I am but a novice at both Ghidra and Reverse Engineering in general. Forgive me if you think this question is dumb or obvious to answer :)

While attempting to solve a CTF RE challenge using Ghidra, the disassembler gave me the following output for one of the function's stack frame:

enter image description here

Correspondingly, the decompiler displays the following:

enter image description here

From both the assembly and pseudo-C output I assumed that the function takes in 2 parameters param_1 param_2 and has 6 local variables, one of which is rather peculiar - in_stack_0000000c. This variable is indeed used by the binary and it looks a local variable, but I didn't really understand why Ghidra labeled it in such format (comparing to the common format local_<num_of_bytes>) and why it wasn't displayed in the disassembler, so I tried googling for information on the format in_stack_ but to no avail.

Another weird thing is in the Listing View, I could see some operations using Stack[0xc] which somewhat resemble the mentioned variable. However, I also do not know which variable Stack[0xc] was referring to, since it looks like a function parameter reference yet this function's parameter stops at Stack[0x8].

After some time, while reading The Ghidra Book, I discovered that one could right-click the label Stack[0xc], and scroll down to Function for stack-related options. I then select Analyze Stack, and wha-lah, the Listing View now displays an additional function parameter param_3, and it was at the address Stack[0xc] points to. in_stack_0000000c is also labeled as param_3. The snippet of the option is shown below:

enter image description here

I've also tried searching for answers both within the book and on the Internet but have yet to succeed. So my question is, what does this option Analyze Stack actually do? And how did it dramatically change the analysis output as so?

1 Answer 1

1

How well Analyze Stack works on any particular function in a program is based on:

  • The calling convention selected for the given function, and,
  • How well that calling convention actually models the way that function uses the stack, passes and returns parameters, stores local variables, etc.

Ghidra's definitions for the above are defined in the .cspec (compiler specification) files that can be found in the directories below ghidra/processors/. These can be modified to suit, but that's a topic too complex to discuss here in brief.

Unless you're working with code that was built for Windows, Linux, or MacOS, using a well-known compiler like gcc or the Apple or Microsoft compilers and associated libraries, the corresponding .cspec may or may not allow for Analyze Stack to be of much use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.