Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Display hex values the Python way in Ghidra

When I have an int value that I want to be displayed as an hex in the disassembly, it's not formatted the same way according to it's an operand or a data : movea.l #0x1a4, A1 but : dw 9500h I'd like ...
3
votes
1answer
78 views

Sharing variable between scripts

I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script). Is ...
-1
votes
1answer
50 views

How to see the function definition of a function pointer in Ghidra

i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
0
votes
0answers
67 views

Is this native code possible for further static analysis?

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
1
vote
2answers
92 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
32 views

Java says “ghidra” is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
2
votes
1answer
191 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
2
votes
1answer
60 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
3
votes
1answer
45 views

alignment in Ghidra and IDA

I see in my IDA it does automatically "align 10" after the end of a fucntion. I wanted to know how to make the same in Ghidra manually like IDA does. Thanks
0
votes
2answers
39 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
0
votes
0answers
23 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
1answer
42 views

Printing all strings in a Ghidra project with python

I got the string objects from a Ghidra project using this code: l = list() def callback(s): l.append(s) ss = StringSearcher(currentProgram, 5, 1, False, True) ss.search(None, callback, True, ...
0
votes
0answers
34 views

what do these assembly codes doing? [duplicate]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
0answers
82 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
0
votes
1answer
82 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
2
votes
1answer
173 views

How to make ghidra display the real offset from rbp

How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi I want to see the actual offset from rbp instead of local_c In ...
-1
votes
1answer
77 views

Why is is ghidra representing mips move instruction as _or?

Now of course I keep trying to change it but once I get to the end of patching it says its invalid and wont let me change it. So if you have a way to do that let me know.
0
votes
2answers
119 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
0
votes
0answers
24 views

Ghidra Using __stdcall for all my Mips64 functions do I have to manually change them all?

Compiled in mips4 this is a unix driver elf object. ************************************************************* * ...
1
vote
0answers
42 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
2
votes
1answer
77 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
0
votes
1answer
74 views

Ghidra headless + bindiff (binexport)

I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless. ida_haru does essentially everything that I need, but ...
0
votes
0answers
56 views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
0
votes
0answers
41 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
5
votes
2answers
129 views

How to add a new CompilerSpec from a .cspec file to Ghidra?

Ghidra uses .cspec files like x86win.cspec to define compiler related information, which are imported in the .ldef files like x86.ldef that define a processor language. How can I add a new ...
0
votes
0answers
17 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
0answers
68 views

Can I ignore this Ghidra USTACK var?

I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
2
votes
1answer
96 views

GHIDRA: Create an array of strings that are padded

I'm working on decompiling a DOS .exe that was written in Pascal or Delphi. When looking at the decompiled code, there appears to be many strings that are are padded with 00. Example: 06 53 54 52 49 ...
-1
votes
1answer
83 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...
-1
votes
1answer
50 views

Call function more times with other args

I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
0
votes
2answers
57 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
0
votes
2answers
88 views

Use enum for switch case values in ghidra

Is there a way in ghidra to change decompiled switch statement case values to their names? I'm looking at a WndProc function, with a prototype of LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM ...
1
vote
0answers
94 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
1
vote
1answer
60 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
1
vote
1answer
103 views

Specify which analyses to perform in Ghidra headless mode

Basically, Ghidra in headless mode is divided into three phases: preScript, analysis, and postScript. Pre/post scripts are written extending the GhidraScript class, while analysis ones extend the ...
0
votes
1answer
32 views

Wrap-around MCU memory map definition with negative addresses

I figured it'd be more appropriate to ask this question here: https://github.com/NationalSecurityAgency/ghidra/issues/2530#issuecomment-785007613 Given this linear address space a particular MCU: It'...
0
votes
0answers
94 views

Replacing a memory block in Ghidra

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
1answer
52 views

im trying to clear all the ghidra instances in my machine before reinstalling it and im seeing some anomalies

i downloaded 3 different instances of Ghidra without realizing, and after i did the 'locate ghidra command it returned; i restarted my computer to see if it would still be there and it is. i also see ...
1
vote
1answer
376 views

Ghidra add data types from open source project

I know that the program I am decompiling uses openSSL. I'd like to add the types from the include folder of the project to the data types. To do that, I use File => Parse C Source. I then select ...
0
votes
0answers
87 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
12
votes
4answers
4k views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
0
votes
0answers
98 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
2
votes
1answer
168 views

How do I execute “File -> Add To Program…” in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
0
votes
1answer
80 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
1
vote
1answer
269 views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
4
votes
1answer
240 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
1
vote
0answers
29 views

Ghidra SDK Register TypeFlags are not populated

I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
1
vote
1answer
57 views

CC3200 Firmware - gaining information about - Registers / Memory (Ghidra) - SVD / CMSIS

I am currently reversing a firmware for the TI CC3200 (ARM Cortex M4) via ghidra. For other ARM chips I have learned that I may use a SVD-Loader to load all information about the registers and memory ...
0
votes
0answers
67 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
20 views

How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...

1
2 3 4 5