Questions tagged [ghidra]
Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.
386
questions
0
votes
0
answers
59
views
Why ghidra does not use label variables and uses constants to represent code local variables?
so the question is in the title I had a simple C program to understand how global and local variables(struct) are stored in the stack. The problem is I don't know if this is good or bad or if I'm ...
- 1
2
votes
1
answer
142
views
convert a memory location to string in Ghidra
I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well.
I would like to have a decompiled pseudo-code in Ghidra like:
...
1
vote
1
answer
84
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
- 11
0
votes
0
answers
58
views
How to decompile data segment in ghidra
I have a code in data segment in my bin. Is there a way how to make a ghidra treat some data as a code for decompilation?
0
votes
0
answers
105
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
1
vote
0
answers
41
views
Tool for reverse-engineering M7702 binary?
I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read.
The CPU has 16-bit registers A, B (data), X, ...
- 186
1
vote
1
answer
140
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
- 11
0
votes
2
answers
106
views
What does adding to a function pointer do?
i'm dissassembling an arm shared object and i'm seeing this line:
iVar1 = SecurityAccess(param_2,SeedEncrypt + 1,0x1);
the SecurityAccess SeedEncrypt is:
int SecurityAccess(int param_1,void *param_2,...
2
votes
1
answer
144
views
MachO chained fixups parsing
I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases?
My question originated from wanting to parse all the Objective-C classes inside a ...
- 185
0
votes
1
answer
121
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
- 185
1
vote
0
answers
55
views
Global variables as Functions in JEB
I was using Ghidra trying decompile a .sys driver. Kinda newbie, but getting some help.
I see decompiler outputs a lot of "artifacts" (code weird or hard to understand). At least I have ...
- 111
0
votes
0
answers
65
views
Ghidra - Mach-O failed to load external libraries
I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
- 180
1
vote
0
answers
123
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
0
votes
2
answers
211
views
Ghidra scripting: get indirect operand address
I tried several hours to find a way to get the operand address which is displayed in the ghidra listing, but without success:
I know at least that the OperandType is "Address".
import ...
- 103
1
vote
1
answer
227
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 165
0
votes
0
answers
31
views
EBX Relative references are not recognized by ghidra
String references are not recognized by ghidra on PIC .so file
The calls are calculated by a relative offset from the EBX register.
On entry to the function, EBX is set
relative offset is added (for ...
0
votes
1
answer
185
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
0
votes
0
answers
43
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
1
vote
0
answers
90
views
Where can I find the files from Ghidra symbol tree?
I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
- 83
2
votes
2
answers
209
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
0
votes
0
answers
54
views
Disassembling an executable that is packaged with vercel's pkg
I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
- 11
0
votes
0
answers
72
views
How to make a Signature of a Global Variable in Ghidra?
currently im trying to rebuild a function.
I am using makesig.py to create function signatures which I am using for rebuilding. It works fine.
Now im trying to make a signature of a global variable:
...
- 1
0
votes
0
answers
34
views
Can I limit Ghidra's analysis to a particular Program Trees subfolder (block)?
Is there a way to limit Ghidra's analysis to a particular identified subfolder in the Program Trees view?
I'm very new to Ghidra and trying to use it to investigate a large library. I've attempted to ...
1
vote
0
answers
171
views
Read value from frida hooked native method Jlong parameter
I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
- 309
1
vote
1
answer
102
views
Removing Ghidra auto-generated labels and create function. Overlapping namespace error
I am attempting to write a script to parse a function table containing structs that look like this:
struct func_table_entry {
void (* func)(void *);
byte unknown1;
byte unknown2;
byte ...
- 11
2
votes
1
answer
108
views
How to define a 28-bit integer in Ghidra
I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra.
I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
- 121
2
votes
1
answer
171
views
Marking DAT section as shellcode in ghidra
I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
- 121
1
vote
1
answer
119
views
Merge two function arguments
I have a function with a signature:
int func(undefined8 param_1,int param_2,char *pData,int nDataSize)
I know from a header file that the first two arguments are actually one, a struct that I know ...
- 111
1
vote
1
answer
386
views
Ghidra with Swift/Objective-C datatypes (NSString)
I'm new to using Ghidra, so apologies if this has been asked before, but I couldn't find an answer.
I'm looking at an iOS app, and I can see a function signature that looks like this:
ID Class::...
- 133
1
vote
1
answer
75
views
Installation problem with gotools extension for Ghidra: Extension version for [gotools-master.zip] is incompatible with Ghidra
I'm getting the following error when I try to install the following extension https://github.com/felberj/gotools
Installation Error
Extension version for [gotools-master.zip] is incompatible with ...
1
vote
2
answers
275
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
- 11
2
votes
0
answers
50
views
How to find where an instance variable of some object is set to some concrete value?
I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
1
vote
1
answer
726
views
Increase font size in Ghidra
For the record, this is a question I often see:
Especially when using a high-resolution display, fonts and other UI elements can appear extremely small. How can they be enlarged?
- 309
1
vote
0
answers
132
views
How to get Ghidra to show `PUSH LAB_xxx` in Decompile view
I am new to using Ghidra and I am trying to reverse engineer an x86 Windows executable written in Delphi Pascal.
I believe I am seeing a problem with the analysis of Try Finally blocks and I'd like to ...
1
vote
0
answers
144
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
2
votes
1
answer
166
views
How to map a decompiled c program back into original source code
I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).
So is ...
- 39
2
votes
1
answer
229
views
Ghidra function pointer calling conventions
I'm reverse engineering some ColdFire MCF5206 (68K-like) code that makes heavy use of function pointers, e.g.:
000006e0 46 fc 27 00 move #0x2700,SR
000006e4 4f ef ff f0 ...
- 121
2
votes
0
answers
165
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
2
votes
0
answers
66
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
- 21
3
votes
1
answer
1k
views
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.
Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
- 31
2
votes
1
answer
86
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 21
4
votes
1
answer
381
views
Ghidra 16-Bit DOS Strings
I am attempting to reverse-engineer a 16-Bit DOS MZ executable.
The file contains many different strings, most of which are printed out to the console at various points.
IDA seems to be able to pick ...
- 165
4
votes
1
answer
169
views
Debug problem with Ghidra 3rd party language
I want to reverse engineer some 65816 code using Ghidra. Unfortunately the third-party 65816 language is broken. No problem, I can fix it myself. However, looking at the Ghidra error gives me no clue ...
- 183
3
votes
0
answers
65
views
Using "map to another variable" in IDA
I am using in IDA. There is a feature which is called "map to another variable".
but it asks from me to map from the variable from a list. How do u know the exact variable to map into ? (I ...
- 31
4
votes
3
answers
358
views
Help disassembling a simple 16-bit NE function
I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required.
I would assume ...
- 165
4
votes
0
answers
297
views
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,
I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
- 185
1
vote
0
answers
170
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
1
vote
0
answers
273
views
How to patch instruction with a call to a thunk function?
I started to use ghidra to begin doing some crackmes, and I need to change an instruction to a call to a thunk function. However, when I export the program back, I get a segfault.
Inspecting it with ...
- 111
4
votes
1
answer
172
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
2
votes
1
answer
134
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
- 23