Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1 vote
1 answer
65 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
0 votes
0 answers
21 views

Can Ghidra load a directory and translate the binary files within it into assembly code?

Can Ghidra load a directory and automatically convert the binary files within it into assembly code? If not, is there a pre-defined script available, or do I need to write one myself? If Ghidra isn't ...
0xh3xa's user avatar
  • 111
1 vote
1 answer
74 views

Ghidra not displaying member function call

On lines 67, 70 and 77 ghidra makes a call to what I assume is a member function, but it does not show me which member function. Why is that? Example from line 70: (**(code **)(*(longlong *)metaStream ...
Proton's user avatar
  • 13
0 votes
0 answers
20 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
notabot's user avatar
0 votes
0 answers
26 views

Ghidra HCS12X Configuration

i have the problem to configure ghidra for hcs12x correctly. can someone give me some support ? I have a 256kb bin file. (MC9S12XS256)
M3C's user avatar
  • 1
1 vote
1 answer
53 views

Ghidra API: Getting the parameter storage locations given a FunctionSignature

I want to create a tool that help analyzing certain code. One feature is analyzing calls that are made through a global function pointer. The first parameter is usually a constant pointer, which I ...
Michael Karcher's user avatar
0 votes
1 answer
86 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
1 vote
1 answer
93 views

Ghidra 11.0 - What does Function > Analyze Stack option do?

Greetings ladies & gentlemen, I am but a novice at both Ghidra and Reverse Engineering in general. Forgive me if you think this question is dumb or obvious to answer :) While attempting to solve a ...
dvmbCateDoinAStroll's user avatar
0 votes
1 answer
49 views

Symbols in Ghidra based on r/w possible?

Is it possible to have a symbol file with different names for an address based on whether a instruction is accessing the address read or write? For example, I have a hardware address $FF8800 for a ...
Trevor Acton's user avatar
0 votes
0 answers
39 views

Patch binary while documenting original at the same time in Ghidra

I'm starting work on a simultaneous documentation and patching project on a single binary. Some of the code to be documented will also be overwritten by the patch, but most of it won't, so I need a ...
inakilbss's user avatar
  • 101
0 votes
1 answer
119 views

Ghidra decompiler does not recognize rsp being subtracted

while i'm reversing a PE binary, i got some weird decompiler output. return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame ...
msh's user avatar
  • 1
0 votes
0 answers
59 views

Resizing variables to improve decompilation results

Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results: As you can see, we have what ...
F.Webber's user avatar
  • 101
0 votes
0 answers
43 views

Unknown Mitsubishi automotive MCUs - are these using unknown architecture?

Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares I've revealed that the MH8501F is ...
Andy's user avatar
  • 1
0 votes
0 answers
40 views

How to use Ghidra modify a PLT Function return a fixed value with automatically execute python scripts?

I'm trying to use python script in Ghidra to let a plt function named as memcmp return a fix value, But i have no idea for that. like this: .text:10006E84 .text:10006E88 89 21 00 08 ...
jdir.s's user avatar
  • 1
0 votes
1 answer
148 views

How can I locate where a specific function is being called within the Program using Ghidra?

Let says my Program use this FUN_180811be0 function, discovered by disassembling the code within Ghidra: Where do I locate the points of the program where this call is being called? If I search for ...
markzzz's user avatar
  • 87
2 votes
1 answer
611 views

How to search a sequence of instructions in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function: What I'm looking for so is (for the same DLL, decompiled in ...
markzzz's user avatar
  • 87
0 votes
0 answers
57 views

Need SOME help decrypt xxtea encrypted Lua file from cocos2D game LIBRARY

iam trying from a while to figure out the key this cocos2dx game but couldn't figure it out if someone could abit help with the way to find these keys you check the the file from here https://github....
SHADOWDIANA's user avatar
0 votes
0 answers
38 views

How does it calculate a backup checksum

in Ghidra I found a function that calculates a checksum and checks it against a checksum in a protobuf I'm stuck in this function for days and I tried using frida to get the ret value but it doesn't ...
Arito No's user avatar
0 votes
0 answers
118 views

cannot get Ghidra's Function ID tool worked properly

I found a difficulty in using Ghidra's Function ID as following: First of all, this would be some kind of testing the capability of the Function ID. For this reason I have a test binary file and I ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
70 views

Does Ghidra expose any local code to remote servers?

I wanted to experiment with the graphing capabilities of reverse engineering tools to attempt to debug a complex memory corruption issue. Specifically trying to discover the possible sources of ...
Chuu's user avatar
  • 101
0 votes
0 answers
72 views

Find offset to parameter not listed in objdump in vmlinux (which contains debug symbols)

I have a series of address offsets for ubuntu that are used in a custom toolset. I'd like to build a set of offsets for another kernel, but I can't find some ubuntu offset addresses in the debug ...
indigo's user avatar
  • 1
0 votes
0 answers
143 views

Why ghidra does not use label variables and uses constants to represent code local variables?

so the question is in the title I had a simple C program to understand how global and local variables(struct) are stored in the stack. The problem is I don't know if this is good or bad or if I'm ...
raw's user avatar
  • 1
3 votes
1 answer
421 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
1 vote
1 answer
116 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
Ajadaz's user avatar
  • 11
0 votes
0 answers
114 views

How to decompile data segment in ghidra

I have a code in data segment in my bin. Is there a way how to make a ghidra treat some data as a code for decompilation?
TrojakJan's user avatar
0 votes
0 answers
195 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
The one word assaulter's user avatar
1 vote
0 answers
52 views

Tool for reverse-engineering M7702 binary?

I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read. The CPU has 16-bit registers A, B (data), X, ...
fgrieu's user avatar
  • 186
1 vote
1 answer
591 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
0 votes
2 answers
131 views

What does adding to a function pointer do?

i'm dissassembling an arm shared object and i'm seeing this line: iVar1 = SecurityAccess(param_2,SeedEncrypt + 1,0x1); the SecurityAccess SeedEncrypt is: int SecurityAccess(int param_1,void *param_2,...
Espeto_Power's user avatar
2 votes
1 answer
276 views

MachO chained fixups parsing

I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases? My question originated from wanting to parse all the Objective-C classes inside a ...
Jorayen's user avatar
  • 185
0 votes
1 answer
232 views

Extracting obj-c class list from a machO

I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
Jorayen's user avatar
  • 185
1 vote
0 answers
77 views

Global variables as Functions in JEB

I was using Ghidra trying decompile a .sys driver. Kinda newbie, but getting some help. I see decompiler outputs a lot of "artifacts" (code weird or hard to understand). At least I have ...
Mr_LinDowsMac's user avatar
0 votes
0 answers
111 views

Ghidra - Mach-O failed to load external libraries

I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
pudi's user avatar
  • 180
1 vote
0 answers
247 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar
0 votes
2 answers
529 views

Ghidra scripting: get indirect operand address

I tried several hours to find a way to get the operand address which is displayed in the ghidra listing, but without success: I know at least that the OperandType is "Address". import ...
karsten's user avatar
  • 103
1 vote
1 answer
608 views

Identifying C/C++ Library Functions

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time. When opening the executable in Ghidra no imports are ...
jttri777's user avatar
  • 165
0 votes
0 answers
35 views

EBX Relative references are not recognized by ghidra

String references are not recognized by ghidra on PIC .so file The calls are calculated by a relative offset from the EBX register. On entry to the function, EBX is set relative offset is added (for ...
webman1337's user avatar
1 vote
1 answer
430 views

How can I tell ghidra what structure an address register points to?

I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
user103675's user avatar
0 votes
0 answers
97 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 51
1 vote
0 answers
164 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 83
2 votes
2 answers
252 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
0 votes
0 answers
130 views

Disassembling an executable that is packaged with vercel's pkg

I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
Yusuf2020's user avatar
0 votes
0 answers
103 views

How to make a Signature of a Global Variable in Ghidra?

currently im trying to rebuild a function. I am using makesig.py to create function signatures which I am using for rebuilding. It works fine. Now im trying to make a signature of a global variable: ...
guyguy9's user avatar
0 votes
0 answers
55 views

Can I limit Ghidra's analysis to a particular Program Trees subfolder (block)?

Is there a way to limit Ghidra's analysis to a particular identified subfolder in the Program Trees view? I'm very new to Ghidra and trying to use it to investigate a large library. I've attempted to ...
Landstander's user avatar
1 vote
0 answers
359 views

Read value from frida hooked native method Jlong parameter

I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
hanan's user avatar
  • 309
1 vote
1 answer
212 views

Removing Ghidra auto-generated labels and create function. Overlapping namespace error

I am attempting to write a script to parse a function table containing structs that look like this: struct func_table_entry { void (* func)(void *); byte unknown1; byte unknown2; byte ...
Cole's user avatar
  • 11
2 votes
1 answer
151 views

How to define a 28-bit integer in Ghidra

I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra. I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
Vincent Guttmann's user avatar
2 votes
1 answer
316 views

Marking DAT section as shellcode in ghidra

I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
0x150's user avatar
  • 121
1 vote
1 answer
169 views

Merge two function arguments

I have a function with a signature: int func(undefined8 param_1,int param_2,char *pData,int nDataSize) I know from a header file that the first two arguments are actually one, a struct that I know ...
Gábor's user avatar
  • 111
1 vote
1 answer
818 views

Ghidra with Swift/Objective-C datatypes (NSString)

I'm new to using Ghidra, so apologies if this has been asked before, but I couldn't find an answer. I'm looking at an iOS app, and I can see a function signature that looks like this: ID Class::...
Tony's user avatar
  • 133

1
2 3 4 5
9