All Questions
Tagged with decompilation ghidra
64 questions
1
vote
2
answers
73
views
What is CARRY2 in Ghidra?
I decompiled a 16-bit Windows 3.1 program with Ghidra 11.0.3 and part of it looks like this:
if ((uVar6 = local_8 + local_a + 0xa46b, uVar6 + local_10 == -0xded &&
((uint)CARRY2(local_8,...
- 111
0
votes
1
answer
51
views
Ghidra user scripts location
Ghidra: what is default location (path) for custom scripts? Same question for custom .fidb files.
- 235
0
votes
0
answers
136
views
Extract flag from .exe file
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I ...
0
votes
0
answers
78
views
Make a reverse engineering for dead app
Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
1
vote
1
answer
95
views
Reverse engineering AES128 Key Derrivation from MAC Address
Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped.
From this decompilation I ...
- 11
1
vote
0
answers
32
views
wWinMainCRTStartup and wWinMain are filled with uninitialized memory
I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
- 11
0
votes
0
answers
78
views
Resizing variables to improve decompilation results
Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results:
As you can see, we have what ...
- 101
1
vote
0
answers
308
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
2
votes
1
answer
164
views
How to define a 28-bit integer in Ghidra
I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra.
I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
- 121
2
votes
0
answers
60
views
How to find where an instance variable of some object is set to some concrete value?
I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
2
votes
1
answer
250
views
How to map a decompiled c program back into original source code
I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).
So is ...
- 39
2
votes
1
answer
105
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 21
4
votes
3
answers
599
views
Help disassembling a simple 16-bit NE function
I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required.
I would assume ...
- 165
2
votes
0
answers
220
views
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
- 21
2
votes
1
answer
113
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
4
votes
0
answers
558
views
How to list all references to memory from selected memory region in ghidra?
I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
- 141
9
votes
1
answer
4k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 91
2
votes
0
answers
259
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 309
2
votes
0
answers
245
views
How to correct decompiled output with `in_stack_` (ppc BE)?
So I have something like:
*************************************************************
* SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con ..
...
- 475
0
votes
1
answer
586
views
Missing mnemonics '??' in Ghidra Assembly Code
I was just trying to google and search for "??" Ghidra with no luck.
I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
- 101
1
vote
1
answer
88
views
How to utilize `FillOutStructureCmd`?
Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables.
It looks something like this:
public class ...
- 475
1
vote
0
answers
781
views
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
- 11
2
votes
0
answers
5k
views
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:
This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as ...
- 35
0
votes
1
answer
597
views
How to reference an address set by 2 instructions in Ghidra
I encountered the following 2 instructions while reversing Tricore assembly:
These 2 instructions load the final address: 0x804A9474. Where a global symbol resides.
Is there a way to hint Ghidra the ...
- 43
3
votes
1
answer
2k
views
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)
My Assembly code looks like this:
.global _start
_start:
...
- 43
0
votes
1
answer
156
views
How to make Ghidra don't brake mid token with triple dots?
So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ...
Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
- 475
1
vote
1
answer
3k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
1
vote
3
answers
1k
views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
2
votes
1
answer
1k
views
convert C++ code to python code
while I'm doing RE using ghidra i saw this code
byte bVar1;
byte bVar2;
uint uVar3;
uVar3 = 0;
while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') {
bVar1 = *(byte *)(uVar3 + param_1) ^...
1
vote
1
answer
3k
views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
- 121
0
votes
0
answers
1k
views
Improving Ghidra's Auto-Structure creator
I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
- 113
0
votes
2
answers
410
views
convert code to python
i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc..
the first code:
void one(int param_1,int param_2) {
int ...
1
vote
2
answers
208
views
what does an integer modulus 32 cast to (byte *) points to?
As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag.
I used GHIDRA to decompile the binary.
The encryption ...
- 11
1
vote
1
answer
1k
views
ghidra rename fails
With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L.
Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
- 123
0
votes
1
answer
371
views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
1
vote
0
answers
149
views
Ghidra SDK Register TypeFlags are not populated
I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
- 11
4
votes
2
answers
1k
views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
- 1,589
0
votes
1
answer
220
views
How do i identify parameters function of md5sum of specific binary?
So, i downloaded the binary. Here are some details before moving forward:
revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
- 103
0
votes
2
answers
180
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
0
votes
1
answer
2k
views
How to make Ghidra recognize bit fields?
Suppose we have the following C source:
typedef struct {
int bit0 : 1;
int bit1 : 1;
int bit2 : 1;
int bit3 : 1;
} bit_struct;
bit_struct a;
void setBit3()
{
a.bit3 = 1;
}
When we compile ...
- 103
2
votes
0
answers
244
views
Ghidra is mishandling a field access
I have a program which decompiles in Ghidra to include the line
temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2);
temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
- 121
5
votes
2
answers
1k
views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
- 75
1
vote
1
answer
518
views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
- 13
4
votes
1
answer
3k
views
How to prevent Ghidra from removing unreachable blocks?
I am using this extension for loading PS-X executables:
https://github.com/lab313ru/ghidra_psx_ldr
During decompilation, Ghidra shows some of these warnings:
WARNING: Removing unreachable block (...
- 249
1
vote
0
answers
501
views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
- 111
1
vote
1
answer
1k
views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
- 156
0
votes
2
answers
2k
views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
- 163
1
vote
2
answers
472
views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
- 156
2
votes
1
answer
246
views
Ghidra Python - cancel decompilation task
The way to decompile a function in Ghidra Python is:
decomp = DecompInterface()
decomp.openProgram(currentProgram)
decompile = decomp.decompileFunction(func, 1000, monitor)
However, in ...
- 1,858
5
votes
1
answer
3k
views
How to improve Ghidra decompilation of SSE instructions?
In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
- 51