Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

1
vote
0answers
26 views

How to export to *.so file after patching in ghidra

I'm using ghidra to patch an *.so file in the Android APK. While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
2
votes
0answers
46 views

Renaming shadowed variables in Ghidra

I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?
2
votes
0answers
36 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
2
votes
1answer
139 views

Can Ghidra show me the p-code generated for an instruction?

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of ...
1
vote
0answers
66 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
1
vote
0answers
43 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
2
votes
1answer
93 views

How do I make a hex literal a decimal literal in Ghidra?

There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
1
vote
0answers
58 views

Handling pointer to middle of struct in Ghidra

Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code. This can result in assembly that looks like this, using MIPS as an example ...
3
votes
0answers
86 views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
0
votes
0answers
57 views

Ghidra pseudocode to Java/C

I have this piece of code generated from Ghidra void __cdecl FUNCTION(uint *key,uint *text) { undefined uVar1; ushort uVar2; uint *puVar3; uint *puVar4; uint *puVar5; int iVar6; uint ...
1
vote
0answers
25 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
3
votes
1answer
191 views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
1
vote
0answers
89 views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
3
votes
0answers
57 views

Can Ghidra show a function footer in the Listing window

In both IDA and Ghidra have a very nice beginning of function marker text Ghidra: ************************************************************** * FUNCTION ...
3
votes
1answer
102 views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
0
votes
1answer
84 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
4
votes
1answer
165 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
0answers
135 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
1
vote
1answer
95 views

Get stack references in Ghidra of a function from the java api

How can one access all references to the stack (also outside of its frame) a function has via the Java Plugin API? Example: This instructions write values outside of the stack frame of the function: ...
3
votes
0answers
295 views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
2
votes
1answer
533 views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
1
vote
0answers
757 views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
2
votes
1answer
420 views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
1
vote
1answer
171 views

How to increase decompilation timeout in ghidra?

I'm trying to decompile a function with ghidra 9.0. After a (short) while, I get : Exception while decompiling 140062b00: process: timeout I already "succesfully" decompiled this function using IDA ...
6
votes
1answer
774 views

Ghidra define c++ string

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree. Now I want to define a std::...
2
votes
2answers
271 views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
398 views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...