Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1
vote
0answers
7 views

How do relocations work for imported functions in SH4 ELF?

I build very simple hello world code with sh4 gcc compiler as shared library: #include <stdio.h> void hello() { printf("Hello world!\n"); } But when I load .so file into the ...
0
votes
0answers
4 views

Ghidra on Arch Linux opens only a blank window

My problem is that whenever i open Ghidra on Arch Linux it first opens a loading screen, then shows the tip of the day window and then shows only a blank window. I have tried the default ghidra binary ...
1
vote
1answer
59 views

Finding AES Key in binary using Ghidra and FindCrypt

I would like to learn more about RE. I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB. Here is the C code (I intentionally ...
1
vote
1answer
104 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
0answers
47 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
0answers
37 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
1
vote
0answers
58 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
0answers
48 views

Convert Arm64 Assembly Trace To C

I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format. I've already ...
4
votes
1answer
90 views

Install Ghidra plugin without GUI

I have a plugin that I want to install for Ghidra. The current way to install the plugin is to go to the file->Install Extension in the project window, and add my plugin there. However, in my ...
0
votes
0answers
28 views

Ghidra: Adding Static Register value for pcode and XREF

If a register is the same value throughout the firmware and is used as a base data pointer, is there a way of defining that value for pcode analysis and adding correct XREFs to memory locations ?
1
vote
0answers
49 views

Forcing Ghidra's decompiler to show unused stack variables

I'm reversing an ARM64 bootloader using Ghidra. The bootloader doesn't use the MMU and so works exclusively with physical addresses, which on this particular chip all fit in 32 bits (the memory map is ...
0
votes
0answers
28 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
48 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
1answer
152 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
2
votes
2answers
112 views

Access data at memory address that is part of a struct

Problem I have a struct of some type, say the DOS header at the beginning of a typical PE file: /DOS/IMAGE_DOS_HEADER pack(disabled) Structure IMAGE_DOS_HEADER { 0 char[2] 2 e_magic "...
3
votes
1answer
69 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...
2
votes
2answers
224 views

Ghidra: equivalent to IDA-Pro's "Reset desktop"

I have nearly ruined my Ghidra layout, and was wondering if there is an equivalent to IDA-Pro's Windows->Reset Desktop, which would reset the code browser's layout to its default form. I am aware ...
0
votes
1answer
52 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
1
vote
0answers
85 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
0
votes
1answer
65 views

Adding signatures to Ghidra

I have a couple of questions about the Ghidra I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "...
2
votes
0answers
83 views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
1
vote
1answer
51 views

Ghidra showing pointer being given as size argument of calloc

I'm attempting to figure out the structure of a "God object". I found where it's being initialized, but I've never seen calloc used like this before: god = (God *)calloc(1,(size_t)&...
0
votes
0answers
58 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
1
vote
1answer
122 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
1
vote
1answer
95 views

Configuring Ghidra to use the Keil 8051 ABI for analysis

I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect ...
0
votes
0answers
48 views

Display hex values the Python way in Ghidra

When I have an int value that I want to be displayed as an hex in the disassembly, it's not formatted the same way according to it's an operand or a data : movea.l #0x1a4, A1 but : dw 9500h I'd like ...
3
votes
1answer
91 views

Sharing variable between scripts

I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script). Is ...
-1
votes
1answer
100 views

How to see the function definition of a function pointer in Ghidra

i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
0
votes
0answers
83 views

Is this native code possible for further static analysis?

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
1
vote
2answers
284 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
51 views

Java says "ghidra" is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
2
votes
1answer
271 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
2
votes
1answer
63 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
3
votes
1answer
59 views

alignment in Ghidra and IDA

I see in my IDA it does automatically "align 10" after the end of a fucntion. I wanted to know how to make the same in Ghidra manually like IDA does. Thanks
0
votes
2answers
71 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
0
votes
0answers
37 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
3
votes
1answer
79 views

Printing all strings in a Ghidra project with python

I got the string objects from a Ghidra project using this code: l = list() def callback(s): l.append(s) ss = StringSearcher(currentProgram, 5, 1, False, True) ss.search(None, callback, True, ...
0
votes
0answers
35 views

what do these assembly codes doing? [duplicate]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
0answers
160 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
0
votes
1answer
89 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
2
votes
1answer
242 views

How to make ghidra display the real offset from rbp

How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi I want to see the actual offset from rbp instead of local_c In ...
-1
votes
1answer
96 views

Why is is ghidra representing mips move instruction as _or?

Now of course I keep trying to change it but once I get to the end of patching it says its invalid and wont let me change it. So if you have a way to do that let me know.
0
votes
2answers
129 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
0
votes
0answers
28 views

Ghidra Using __stdcall for all my Mips64 functions do I have to manually change them all?

Compiled in mips4 this is a unix driver elf object. ************************************************************* * ...
1
vote
0answers
109 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
2
votes
1answer
96 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
1
vote
2answers
175 views

Ghidra headless + bindiff (binexport)

I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless. ida_haru does essentially everything that I need, but ...
0
votes
0answers
72 views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
0
votes
0answers
69 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
5
votes
2answers
194 views

How to add a new CompilerSpec from a .cspec file to Ghidra?

Ghidra uses .cspec files like x86win.cspec to define compiler related information, which are imported in the .ldef files like x86.ldef that define a processor language. How can I add a new ...

1
2 3 4 5 6