3

I am studying binary lifting and the impacts of intermediate language representations. I have a binary that is an x86 PE file with a stripped header. I have many of these files so I need a more sample agnostic processs. I need to exfiltrate all code detected by Ghidra and its relevant PCODE to do my comparison.

I used Binary Ninja to pull apart the same binary and I am struggling to get Ghidra to output anything. This is due to Ghidra viewing everything as part of the .ram memory map section I think. I tell both that it is an x86 based binary.

See screenshot for comparison of how the different tools loaded the same stripped binary. I used default analysis settings for both tools. Any thoughts on how to get Ghidra to see the code within the binary properly so I can get the PCODE?

Tool Analysis Comparison

5
  • Can you share that file so I can test it on my machine?
    – SuperUser
    Commented May 17 at 7:50
  • This file is a peice of sterilized malware I am hosting on a VM. I do not think I can share it due to this fact. The result above can be mimiced by taking any PE file and removing the header, converting it back to a binary, and feeding it into theses programs.
    – Teijen
    Commented May 20 at 20:51
  • By "stripped header" do you mean the file header was completely removed? Ghidra relies on the PE header to parse the binary, as this header provides a "map" of how information in a binary is arranged. No PE header, no analysis.
    – julian
    Commented May 22 at 15:39
  • Yes, the header was completly stripped out. Binary Ninja was able to identify certain code sections and I wanted to compare Ghidra's analysis, so I was hoping to find a setting that allowed limited analysis on obfuscated binaries
    – Teijen
    Commented May 22 at 18:33
  • If the main goal is studying lifting and IR, the simplest solution is to study binaries with intact PE headers. Obfuscated malware with intact PE headers can be acquired from VirusTotal, vx-underground, and many other places. Removing the header is not an obfuscation technique, it's a measure taken to prevent binary execution by ensuring no OS loader can parse the binary.
    – julian
    Commented May 22 at 21:08

1 Answer 1

2

Judging from some GitHub issues, it seems like Ghidra relies on PE headers for analysis and is sensitive to corrupt headers. https://github.com/NationalSecurityAgency/ghidra/issues/327

One solution would be to use a header reconstruction tool such as PE-bear. Creating a valid header for the PE will allow more tools to load the file correctly. https://github.com/hasherezade/pe-bear

Another solution would be to use Cutter, an open-source static analysis tool like Ghidra which also features a decompiler. https://cutter.re

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.