Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?

I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c. Note that I believe DAT_804818d0 is the seed, ...
0
votes
1answer
64 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
2
votes
2answers
182 views

How to load shellcode into Ghidra

I'm trying to learn more about reverse engineering, and I've found some shellcode embedded in a C program: unsigned char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\...
0
votes
0answers
57 views

What do these offsets in the function calls mean?

I am using Ghidra to reverse enigneer a PE file, and I found a lot of function calls that look like this: (**(code **)(*(longlong *) inBunch + 0x30))(inBunch, local_res18, 4); I am very confused, ...
1
vote
2answers
83 views

Does Microsoft's C++ compiler add functions?

I'm working on reverse engineering a classic game (early 2000s) and am fortunate enough to have debug symbols for a different platform other than PC for reference. I've noticed that the same functions ...
1
vote
0answers
28 views

CR16C architecture code pointers in Ghidra?

On CompactRISC CR16C architecture, because instructions only start at even-numbered addresses, code pointers (as used by JAL, JUMP, Jcond) are shifted one bit to the right. These are distinct from ...
0
votes
0answers
40 views

Why does Ghidra save a function return value to a different variable?

I've started learning how to work with Ghidra and I've stumbled upon a problem that I don't know how to solve. The program that I am disassembling calls a function argc_check, which returns a result ...
1
vote
0answers
50 views

Constructor takes it's own class pointer as param

So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp. The constructor itself by Ghidra: void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$....
1
vote
1answer
95 views

How to import x86asm into Ghidra?

I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this): 00000003 E8D001 call 0x1d6 00000006 A08000 mov al,[0x80] 00000009 0C00 ...
2
votes
1answer
69 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
2
votes
1answer
111 views

Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?

This is the window that appears when you press Shift + /. Example:
0
votes
0answers
21 views

Missing definition of `FuncDefn`

So I used latest (10.0.4) Ghidra to decompile a x86 binary to c file and h header/ then I preprocessed it with the msvc cl compiler but in the result, while parsing it - turns out the typedefs for ...
1
vote
0answers
38 views

I need to make a dominance tree using Ghidra headless

I need to make a dominator tree where I need to tell a function(a) dominates function(b). There is an API in GraphAlgorithms which needs GDirected graph and "vertex from" parameters, but I ...
1
vote
1answer
125 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit-generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstracts away over many ...
1
vote
0answers
82 views

What is happening with this *param_1?

I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far). I have a function that seems to read like it is a Constructor. But ...
0
votes
1answer
51 views

Ghidra: Iterating over function's codeUnits returns only 1st instruction

public void run() throws Exception { var cp = currentProgram; var nsSymbols = ghidra.app.util.NamespaceUtils.getSymbols("myNameSpace", cp); var glNS = nsSymbols.get(0)...
0
votes
0answers
35 views

Write data to / patch uninitialized memory segment in Ghidra - possible?

Working on a loader for a fw in ghidra (10.0.4_PUBLIC). I've created an uninitialized memory segment for the stack, but at some point I need to write/copy some data into this segment (some hundred ...
0
votes
0answers
83 views

Access file path using raw address

I am reversing a MIPS .cgi with Ghidra which has an external function call. I opened that library file to view the function decompilation, and it was using the open() function with a hex value instead ...
2
votes
1answer
184 views

How to propagate re-typed variables to functions signatures automatically?

In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
0
votes
0answers
32 views

Improving Ghidra decompilation of 32-bit arithmetic in 8-bit CPU

I am reversing a control system written for 8-bit PIC18. The firmware has a lot of 32-bit math. Each 32-bit operations are compiled into quite a lot of instructions due to the limitation of working ...
2
votes
1answer
117 views

What does Ghidra mean by ._0_3_?

What does ._0_3_ mean in the Ghidra decompiler? my_string[0]._0_3_ = CONCAT12(DAT_14123b1f6,DAT_14123b1f4);
2
votes
1answer
176 views

Is there a way to name a flag for a bit field in Ghidra?

In a line like this: if ((my_variable & 0x80000000) == 0) { Is there a way to label 0x80000000 as e.g. FLAG_HAS_PROPERTY_GREEN, or would I have to rely on comments for that?
0
votes
1answer
45 views

Does psVar[-6] refer to 6*sizeof(psVar) bytes before psVar? Can you avoid the negative index?

In this decompiled code, does psVar8[-6] refer to 6*sizeof(psVar8) == 12 bytes before psVar8? psVar8 = (short *)(&DAT_1412345b4 + named_index * 0x20); do { if (psVar8[-6] == 0) break; // ... } ...
1
vote
3answers
127 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
1
vote
1answer
314 views

Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?

I have opened an executable with Ghidra, IDA and x64dbg (runtime). It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra. When hooking through ...
2
votes
0answers
51 views

How do relocations work for imported functions in SH4 ELF?

I build very simple hello world code with sh4 gcc compiler as shared library: #include <stdio.h> void hello() { printf("Hello world!\n"); } But when I load .so file into the ...
2
votes
1answer
276 views

Finding AES Key in binary using Ghidra and FindCrypt

I would like to learn more about RE. I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB. Here is the C code (I intentionally ...
1
vote
1answer
194 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
0answers
63 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
0answers
45 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
1
vote
0answers
66 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
0answers
105 views

Convert Arm64 Assembly Trace To C

I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format. I've already ...
4
votes
1answer
183 views

Install Ghidra plugin without GUI

I have a plugin that I want to install for Ghidra. The current way to install the plugin is to go to the file->Install Extension in the project window, and add my plugin there. However, in my ...
0
votes
0answers
47 views

Ghidra: Adding Static Register value for pcode and XREF

If a register is the same value throughout the firmware and is used as a base data pointer, is there a way of defining that value for pcode analysis and adding correct XREFs to memory locations ?
1
vote
0answers
100 views

Forcing Ghidra's decompiler to show unused stack variables

I'm reversing an ARM64 bootloader using Ghidra. The bootloader doesn't use the MMU and so works exclusively with physical addresses, which on this particular chip all fit in 32 bits (the memory map is ...
0
votes
0answers
47 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
68 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
1answer
463 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
2
votes
2answers
224 views

Access data at memory address that is part of a struct

Problem I have a struct of some type, say the DOS header at the beginning of a typical PE file: /DOS/IMAGE_DOS_HEADER pack(disabled) Structure IMAGE_DOS_HEADER { 0 char[2] 2 e_magic "...
3
votes
1answer
90 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...
3
votes
2answers
596 views

Ghidra: equivalent to IDA-Pro's "Reset desktop"

I have nearly ruined my Ghidra layout, and was wondering if there is an equivalent to IDA-Pro's Windows->Reset Desktop, which would reset the code browser's layout to its default form. I am aware ...
0
votes
1answer
59 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
1
vote
0answers
124 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
0
votes
1answer
188 views

Adding signatures to Ghidra

I have a couple of questions about the Ghidra I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "...
2
votes
0answers
174 views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
1
vote
1answer
64 views

Ghidra showing pointer being given as size argument of calloc

I'm attempting to figure out the structure of a "God object". I found where it's being initialized, but I've never seen calloc used like this before: god = (God *)calloc(1,(size_t)&...
0
votes
0answers
144 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
1
vote
1answer
198 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
2
votes
1answer
180 views

Configuring Ghidra to use the Keil 8051 ABI for analysis

I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect ...
0
votes
0answers
65 views

Display hex values the Python way in Ghidra

When I have an int value that I want to be displayed as an hex in the disassembly, it's not formatted the same way according to it's an operand or a data : movea.l #0x1a4, A1 but : dw 9500h I'd like ...

1
2 3 4 5 6