Skip to main content

Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1 vote
0 answers
32 views

Is there a way to sync symbol labels in Ghidra Disassembler with its Decompiler?

I swear that in IDA Pro, when I renamed a stack var in the disassembler, that name would port over to the decompiled view, but this doesn't seem to occur in Ghidra. In fact, in Ghidra, when I try to ...
the_endian's user avatar
  • 1,880
0 votes
0 answers
14 views

Ghidra user scripts location

Ghidra: what is default location (path) for custom scripts? Same question for custom .fidb files.
minto's user avatar
  • 215
0 votes
0 answers
27 views

Reading and interpreting code functions in Ghidra

I'm analyzing raw MIPS32 binary code in Ghidra (RAM dump). How to read code and interpret functions in code fragments below? in Listing window: 00734ca8 76 61 6c 69 jalx SUB_0985b1a4 ...
minto's user avatar
  • 215
0 votes
0 answers
79 views

Extract flag from .exe file

I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag. I ...
RandomUser's user avatar
0 votes
0 answers
24 views

How to set up Control Flow Guard function calls for proper decompilation with Ghidra?

Say, I have the following x64 assembly code that runs on Windows: MOV EDX ,dword ptr [RSI ] ; 2nd param TEST EDX ,EDX JZ lbl_out_1 ...
c00000fd's user avatar
  • 1,711
0 votes
1 answer
38 views

What is the "Fallthrough" option in Ghidra for?

If you right-click on the assembly window in Ghidra, one of the last options shown will be "Fallthrough": Can someone explain in plain English what is that option for?
c00000fd's user avatar
  • 1,711
0 votes
0 answers
30 views

disassemble a 76F0085 processor

Hello has anyone tried to disassemble a 76f0085 processor for a Denso ecu ? Do you know the ram address ?
Whallab1's user avatar
3 votes
1 answer
115 views

Ghidra is missing known code sections found in Binary Ninja. What settings to change in analysis?

I am studying binary lifting and the impacts of intermediate language representations. I have a binary that is an x86 PE file with a stripped header. I have many of these files so I need a more sample ...
Teijen's user avatar
  • 31
0 votes
0 answers
47 views

How to get which Tedit is referenced when retrieving text

Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv Now, the two parameters for the function are: LEA param_2=>local_8,[EBP + -0x4] MOV param_1,...
mark's user avatar
  • 1
0 votes
0 answers
65 views

Make a reverse engineering for dead app

Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
AWS NEBRAS's user avatar
1 vote
1 answer
55 views

How can I define a custom pointer data type in Ghidra?

I have a Motorola 68K binary file that contains a table of a few hundred function pointers. If I set their data type to Pointer32, Ghidra interprets them as pointers as shown: 00100000 01 20 96 94 ...
End User's user avatar
1 vote
1 answer
88 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
1 vote
1 answer
85 views

Ghidra not displaying member function call

On lines 67, 70 and 77 ghidra makes a call to what I assume is a member function, but it does not show me which member function. Why is that? Example from line 70: (**(code **)(*(longlong *)metaStream ...
Proton's user avatar
  • 13
0 votes
0 answers
23 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
notabot's user avatar
0 votes
0 answers
27 views

Ghidra HCS12X Configuration

i have the problem to configure ghidra for hcs12x correctly. can someone give me some support ? I have a 256kb bin file. (MC9S12XS256)
M3C's user avatar
  • 1
1 vote
1 answer
59 views

Ghidra API: Getting the parameter storage locations given a FunctionSignature

I want to create a tool that help analyzing certain code. One feature is analyzing calls that are made through a global function pointer. The first parameter is usually a constant pointer, which I ...
Michael Karcher's user avatar
0 votes
1 answer
113 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
1 vote
1 answer
129 views

Ghidra 11.0 - What does Function > Analyze Stack option do?

Greetings ladies & gentlemen, I am but a novice at both Ghidra and Reverse Engineering in general. Forgive me if you think this question is dumb or obvious to answer :) While attempting to solve a ...
dvmbCateDoinAStroll's user avatar
0 votes
1 answer
51 views

Symbols in Ghidra based on r/w possible?

Is it possible to have a symbol file with different names for an address based on whether a instruction is accessing the address read or write? For example, I have a hardware address $FF8800 for a ...
Trevor Acton's user avatar
0 votes
0 answers
48 views

Patch binary while documenting original at the same time in Ghidra

I'm starting work on a simultaneous documentation and patching project on a single binary. Some of the code to be documented will also be overwritten by the patch, but most of it won't, so I need a ...
inakilbss's user avatar
  • 101
0 votes
1 answer
153 views

Ghidra decompiler does not recognize rsp being subtracted

while i'm reversing a PE binary, i got some weird decompiler output. return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame ...
msh's user avatar
  • 1
0 votes
0 answers
66 views

Resizing variables to improve decompilation results

Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results: As you can see, we have what ...
F.Webber's user avatar
  • 101
0 votes
0 answers
46 views

Unknown Mitsubishi automotive MCUs - are these using unknown architecture?

Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares I've revealed that the MH8501F is ...
Andy's user avatar
  • 1
0 votes
0 answers
48 views

How to use Ghidra modify a PLT Function return a fixed value with automatically execute python scripts?

I'm trying to use python script in Ghidra to let a plt function named as memcmp return a fix value, But i have no idea for that. like this: .text:10006E84 .text:10006E88 89 21 00 08 ...
jdir.s's user avatar
  • 1
0 votes
1 answer
276 views

How can I locate where a specific function is being called within the Program using Ghidra?

Let says my Program use this FUN_180811be0 function, discovered by disassembling the code within Ghidra: Where do I locate the points of the program where this call is being called? If I search for ...
markzzz's user avatar
  • 87
2 votes
1 answer
947 views

How to search a sequence of instructions in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function: What I'm looking for so is (for the same DLL, decompiled in ...
markzzz's user avatar
  • 87
0 votes
0 answers
70 views

Need SOME help decrypt xxtea encrypted Lua file from cocos2D game LIBRARY

iam trying from a while to figure out the key this cocos2dx game but couldn't figure it out if someone could abit help with the way to find these keys you check the the file from here https://github....
SHADOWDIANA's user avatar
0 votes
0 answers
42 views

How does it calculate a backup checksum

in Ghidra I found a function that calculates a checksum and checks it against a checksum in a protobuf I'm stuck in this function for days and I tried using frida to get the ret value but it doesn't ...
Arito No's user avatar
0 votes
0 answers
151 views

cannot get Ghidra's Function ID tool worked properly

I found a difficulty in using Ghidra's Function ID as following: First of all, this would be some kind of testing the capability of the Function ID. For this reason I have a test binary file and I ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
73 views

Does Ghidra expose any local code to remote servers?

I wanted to experiment with the graphing capabilities of reverse engineering tools to attempt to debug a complex memory corruption issue. Specifically trying to discover the possible sources of ...
Chuu's user avatar
  • 101
0 votes
0 answers
83 views

Find offset to parameter not listed in objdump in vmlinux (which contains debug symbols)

I have a series of address offsets for ubuntu that are used in a custom toolset. I'd like to build a set of offsets for another kernel, but I can't find some ubuntu offset addresses in the debug ...
indigo's user avatar
  • 1
0 votes
0 answers
165 views

Why ghidra does not use label variables and uses constants to represent code local variables?

so the question is in the title I had a simple C program to understand how global and local variables(struct) are stored in the stack. The problem is I don't know if this is good or bad or if I'm ...
raw's user avatar
  • 1
3 votes
1 answer
648 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
1 vote
1 answer
120 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
Ajadaz's user avatar
  • 11
0 votes
0 answers
134 views

How to decompile data segment in ghidra

I have a code in data segment in my bin. Is there a way how to make a ghidra treat some data as a code for decompilation?
TrojakJan's user avatar
0 votes
0 answers
220 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
The one word assaulter's user avatar
1 vote
0 answers
54 views

Tool for reverse-engineering M7702 binary?

I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read. The CPU has 16-bit registers A, B (data), X, ...
fgrieu's user avatar
  • 186
1 vote
1 answer
904 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
0 votes
2 answers
135 views

What does adding to a function pointer do?

i'm dissassembling an arm shared object and i'm seeing this line: iVar1 = SecurityAccess(param_2,SeedEncrypt + 1,0x1); the SecurityAccess SeedEncrypt is: int SecurityAccess(int param_1,void *param_2,...
Espeto_Power's user avatar
2 votes
1 answer
320 views

MachO chained fixups parsing

I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases? My question originated from wanting to parse all the Objective-C classes inside a ...
Jorayen's user avatar
  • 185
0 votes
1 answer
268 views

Extracting obj-c class list from a machO

I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
Jorayen's user avatar
  • 185
1 vote
0 answers
83 views

Global variables as Functions in JEB

I was using Ghidra trying decompile a .sys driver. Kinda newbie, but getting some help. I see decompiler outputs a lot of "artifacts" (code weird or hard to understand). At least I have ...
Mr_LinDowsMac's user avatar
0 votes
0 answers
118 views

Ghidra - Mach-O failed to load external libraries

I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
pudi's user avatar
  • 180
1 vote
0 answers
287 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar
0 votes
2 answers
642 views

Ghidra scripting: get indirect operand address

I tried several hours to find a way to get the operand address which is displayed in the ghidra listing, but without success: I know at least that the OperandType is "Address". import ...
karsten's user avatar
  • 103
1 vote
1 answer
777 views

Identifying C/C++ Library Functions

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time. When opening the executable in Ghidra no imports are ...
jttri777's user avatar
  • 165
0 votes
0 answers
36 views

EBX Relative references are not recognized by ghidra

String references are not recognized by ghidra on PIC .so file The calls are calculated by a relative offset from the EBX register. On entry to the function, EBX is set relative offset is added (for ...
webman1337's user avatar
1 vote
1 answer
571 views

How can I tell ghidra what structure an address register points to?

I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
user103675's user avatar
0 votes
0 answers
105 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 61
1 vote
0 answers
179 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 83

1
2 3 4 5
9