Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
4 votes
1 answer
136 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
1 vote
1 answer
70 views

Ghidra Shows Structure Strange

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
  • 13
1 vote
0 answers
49 views

Understanding pointer indirection for accessing static variables in Cortex M0 firmware

I'm reverse engineering some firmware from a device running an ARM Cortex M0 (specifically, Nordic nrf51802). For reference, the pertinent part of the memory map looks like this: I'm trying to add ...
2 votes
0 answers
96 views

Ghidra view stack frame values

I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this. I'...
  • 121
2 votes
0 answers
62 views

How can I progress reverse engineering this Novatek NT96650 firmware

I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core. I have copies of the firmware, I have extracted the contents of flash, and have a pretty ...
1 vote
0 answers
42 views

Merge HEX file into existing ELF file in ghidra

I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
  • 243
2 votes
0 answers
64 views

format-string + ret2libc (or format string only)?

I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
  • 21
0 votes
1 answer
77 views

How to get hexadecimal of instruction and distinct value(token) of opcode by ghidra script?

From disassembled code, I want to extract the hexadecimal of instruction, as boxed in the figure below plus, I want to get distinct value of each opcode and its operand, which means sort of mov => ...
  • 13
1 vote
0 answers
157 views

incorrect Ghidra decompile functions parameters

I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID) I saw someone wrote here about this ...
  • 31
3 votes
0 answers
50 views

Cutter failing to XREF even a simple 1 line 'Hello world'

The disassembler yields 0 reference to the "Hello world" string! Anyone knows what might be the issue? IDA 8.2 Free and Ghidra find and shows the XREF as they are supposed to.
1 vote
1 answer
111 views

What is the best solution to load the correct gpio mapping for atmega328p in ghidra

All the tutorials I found, use the default AVR8 default 16 little gcc configuration when importing the binary. After importing the file with this configuration the gpio register mapping is completely ...
  • 19
3 votes
0 answers
103 views

Cannot find references to functions in vtables

First time doing RE work and I am working on a rather large C++ binary. In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
2 votes
0 answers
66 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
1 vote
0 answers
91 views

ghidra assigns local variable to register

im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from this is ...
3 votes
1 answer
74 views

Ghidra support for older AOUT executable format

Does Ghidra 10.2.2 support loading the older a.out executable format? This format (sometimes rendered as "AOUT") was used on various UNIX-like systems such as SunOS and BSD, and was the ...
  • 91
1 vote
0 answers
76 views

How to Decompile HP LaserJet Pro M12w firmware in Ghidra

I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra, after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
2 votes
1 answer
247 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
1 vote
1 answer
48 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
2 answers
335 views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
2 votes
0 answers
94 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
  • 21
1 vote
0 answers
44 views

Ghidra: Ignoring partial resolution of indirect

The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile: uint ...
1 vote
0 answers
94 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
  • 111
3 votes
0 answers
162 views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
2 votes
0 answers
160 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
4 votes
1 answer
166 views

Reversing Tenda N300 Router Firmware with Ghidra

Hey I got interested in SRE so I picked up Binwalk and Ghidra though I have some issues. I was reversing a simple bin for Tenda router I did some information gathering: Tenda Router & bin file ...
  • 61
1 vote
0 answers
80 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
  • 1,738
3 votes
0 answers
193 views

Ghidra: Reference to external symbols not resolved in decompile

In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly: The other functions of the same application are fine, and the ...
1 vote
0 answers
68 views

Ghidra python - retrieve the name of the called method

I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
  • 11
2 votes
1 answer
249 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
  • 131
0 votes
0 answers
184 views

ZTE F680L V6.0 GPON firmware extraction JFFS2 decrypt AES key

Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2 You can find the firmware image here. Inside we have an /etc folder with some db_default_cfg.xml which ...
0 votes
1 answer
134 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
0 votes
0 answers
138 views

Reinterpreting local function strings in Ghidra (ARM)

The program I'm working with has stuff like this all over: strbuf = 0x20746567; local_824 = (undefined *)0x6863616d; local_820 = (undefined *)0x20656e69; local_81c = (undefined ...
1 vote
0 answers
224 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
4 votes
0 answers
1k views

Decompiling an executable compiled by vercel/pkg

I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg I tried using pkg-unpacker however the output is ...
  • 41
2 votes
1 answer
137 views

Is there a way to show/enable mnemonic description in Ghidra?

I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg. For e.g bipush - Push byte
0 votes
1 answer
453 views

ghidra returning wrong function address

I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook const ghidraImageBase = 0x00100000; const ...
0 votes
1 answer
285 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
3 votes
1 answer
129 views

View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
1 vote
2 answers
225 views

In Ghidra can I have two binaries loaded into tabs and create a new struct that I can use in both?

I'm using Ghidra to work out the structure of some binary files. No code. I can use the Structure Editor to define a struct, such as the header of the file format. But I can only find a way to create ...
5 votes
2 answers
891 views

Can I import a C struct into Ghidra?

Either by pasting from a text file or typing it out into a dialog box, which is still much faster than using Ghidra's Structure editor.
1 vote
0 answers
92 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
  • 219
0 votes
1 answer
228 views

Using IDA pro decompiler in Ghidra

Is it possible to use IDA pro decompiler in Ghidra ? I know the opposite is possible.
  • 31
1 vote
1 answer
121 views

Assign a constant value to an ARM register

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this: ...
  • 219
1 vote
0 answers
94 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
  • 425
1 vote
1 answer
92 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
2 votes
0 answers
303 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
1 vote
0 answers
485 views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
  • 219
0 votes
0 answers
201 views

How can I hook structure members in frida

I have a code like this: class CURLNetRequest : public CNetRequestBase { DEFINE_LOGCLASS; struct ProxySettings { void initFromConfig(); String host; ...
  • 219
0 votes
0 answers
318 views

What is the most effective tool to analyze apk file

I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes. However, I am facing an issue for ...
  • 1
1 vote
0 answers
247 views

Ghidra graphing questions

I'm trying to learn RE with Ghidra, and have a few Ghidra-specific questions. Exceeded limit of 500 nods - any way to increase this threshold? Any other way to choose which section of the code is ...
  • 21

1
2 3 4 5
7