Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1
vote
2answers
58 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
1
vote
1answer
48 views

How can I debug Ghidra Python scripts in IDE?

I'd like to debug Ghidra python scripts using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin). With the plugin ...
0
votes
0answers
26 views

Get Unaffected and KilledByCall Registers from CompilerSpec using Ghidra's Java API

Is there a way to get the volatile and non-volatile registers from Ghidra's CompilerSpec? For instance, when I look into the ARM.cspec I get the following information: <unaffected> <register ...
0
votes
0answers
29 views

Volatile data Ghidra

Is it possible to set a local stack variable volatile? I'm trying to reverse a program full of concurrent threads which exploit this mechanism: https://en.wikipedia.org/wiki/Setcontext to obfuscate ...
0
votes
0answers
36 views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
1
vote
1answer
40 views

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean: 048 ...
1
vote
1answer
63 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
1answer
65 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
0
votes
0answers
17 views

why does ghidra ignores .debug information for certain binaries?

I am using debin project to recover symbols in stripped binaries. This project leverages machine learning approach to reverse engineer variables, types and variable names from stripped binaries. It ...
0
votes
1answer
64 views

8086 Function Calling Conventions

I am reversing an old DOS game from 1989. What are the function calling conventions for the 16-bit 8086 processor that is used to run this type of program? How it works on Windows x64 By function ...
1
vote
1answer
46 views

ghidra scripting: how to distinguish between function and global symbol

I have a following program: int b2[4]; int foo() { static int b2[10]; b2[5] = 4; } int main() { static int b2[10]; int b[5]; b[0] = 1; b2[9] = 4; int *ptr = b; int c = *(ptr + 10); ...
-1
votes
1answer
125 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
24 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
37 views

How to create an uninitialized variable in Ghidra?

The code under inspection is a native Android library used in an Android application. The decompiler is showing me a lot of lines in the style DAT_12345678 = 0x12345678 with ascending addresses. I ...
0
votes
1answer
54 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
1
vote
1answer
50 views

How to enlarge block in Ghidra's Function Graph View?

I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of ...). There does ...
1
vote
0answers
36 views

Compare ELF files using Ghidra+Bindiff based on dwarf debug info

So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway. I have an embedded ARM cortex-M C++ project and I ...
0
votes
2answers
98 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
0answers
37 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
1answer
83 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
2
votes
0answers
46 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
0
votes
0answers
35 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
1
vote
1answer
99 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
0
votes
0answers
82 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
48 views

Is there any way to get predicted variables using python script?

I have a simple program: #include <stdio.h> int main() { int a; a = func(15, 3); return a; } int func(int i, int j) { int b1[5], b2[10]; b2[i] = 1; printf("%d\n", b1[j]);...
2
votes
0answers
51 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
1
vote
1answer
177 views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
2
votes
1answer
70 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
1answer
140 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
1answer
33 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
3
votes
0answers
258 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
5
votes
2answers
189 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
2
votes
0answers
104 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
1
vote
1answer
144 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
150 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
3
votes
2answers
94 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1
vote
1answer
72 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
0
votes
0answers
81 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
2
votes
1answer
238 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
0
votes
1answer
198 views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
0
votes
0answers
45 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
6
votes
1answer
190 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
0
votes
0answers
28 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
1
vote
1answer
65 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...
2
votes
0answers
36 views

How do I implement register pages in Sleigh?

I'm working on creating a processor definition for the Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that. The HC12 ...
1
vote
0answers
64 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
125 views

Ghidra export to C header, how to remove “.conflict”?

When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it ...
1
vote
0answers
47 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...