Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1 vote
1 answer
31 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
0 answers
41 views

STM32 and Ghidra: REing an ARM Cortex (Thumb) firmware doesn't get the entry-point right

I'm reverse engineering a firmware used on an STM32 microcontroler. With the datasheet and some help I managed to find the entry point (Reset vector): MasterStackPointer ...
1 vote
2 answers
41 views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
2 votes
0 answers
34 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
  • 21
1 vote
0 answers
25 views

Ghidra: Ignoring partial resolution of indirect

The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile: uint ...
1 vote
0 answers
21 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
  • 111
3 votes
0 answers
38 views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
1 vote
0 answers
34 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
4 votes
1 answer
71 views

Reversing Tenda N300 Router Firmware with Ghidra

Hey I got interested in SRE so I picked up Binwalk and Ghidra though I have some issues. I was reversing a simple bin for Tenda router I did some information gathering: Tenda Router & bin file ...
  • 61
1 vote
0 answers
68 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
  • 1,708
3 votes
0 answers
72 views

Ghidra: Reference to external symbols not resolved in decompile

In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly: The other functions of the same application are fine, and the ...
1 vote
0 answers
32 views

Ghidra python - retrieve the name of the called method

I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
  • 11
1 vote
1 answer
88 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
  • 111
0 votes
0 answers
61 views

ZTE F680L V6.0 GPON firmware extraction JFFS2 decrypt AES key

Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2 You can find the firmware image here. Inside we have an /etc folder with some db_default_cfg.xml which ...
0 votes
1 answer
54 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
0 votes
0 answers
55 views

Reinterpreting local function strings in Ghidra (ARM)

The program I'm working with has stuff like this all over: strbuf = 0x20746567; local_824 = (undefined *)0x6863616d; local_820 = (undefined *)0x20656e69; local_81c = (undefined ...
1 vote
0 answers
103 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
3 votes
0 answers
322 views

Decompiling an executable compiled by vercel/pkg

I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg I tried using pkg-unpacker however the output is ...
  • 31
2 votes
1 answer
87 views

Is there a way to show/enable mnemonic description in Ghidra?

I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg. For e.g bipush - Push byte
0 votes
1 answer
226 views

ghidra returning wrong function address

I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook const ghidraImageBase = 0x00100000; const ...
0 votes
1 answer
110 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
3 votes
1 answer
75 views

View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
1 vote
2 answers
127 views

In Ghidra can I have two binaries loaded into tabs and create a new struct that I can use in both?

I'm using Ghidra to work out the structure of some binary files. No code. I can use the Structure Editor to define a struct, such as the header of the file format. But I can only find a way to create ...
4 votes
2 answers
359 views

Can I import a C struct into Ghidra?

Either by pasting from a text file or typing it out into a dialog box, which is still much faster than using Ghidra's Structure editor.
1 vote
0 answers
63 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
  • 189
0 votes
1 answer
149 views

Using IDA pro decompiler in Ghidra

Is it possible to use IDA pro decompiler in Ghidra ? I know the opposite is possible.
  • 21
1 vote
1 answer
77 views

Assign a constant value to an ARM register

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this: ...
  • 189
1 vote
0 answers
50 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
  • 425
1 vote
1 answer
88 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
2 votes
0 answers
169 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
1 vote
0 answers
295 views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
  • 189
0 votes
0 answers
93 views

How can I hook structure members in frida

I have a code like this: class CURLNetRequest : public CNetRequestBase { DEFINE_LOGCLASS; struct ProxySettings { void initFromConfig(); String host; ...
  • 189
0 votes
0 answers
128 views

What is the most effective tool to analyze apk file

I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes. However, I am facing an issue for ...
  • 1
1 vote
0 answers
129 views

Ghidra graphing questions

I'm trying to learn RE with Ghidra, and have a few Ghidra-specific questions. Exceeded limit of 500 nods - any way to increase this threshold? Any other way to choose which section of the code is ...
  • 21
0 votes
1 answer
251 views

How to import Ghidra DB into IDA?

I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?
0 votes
1 answer
150 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
1 vote
0 answers
279 views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
1 vote
1 answer
361 views

[Ghidra]How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
  • 425
1 vote
1 answer
29 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
  • 425
0 votes
0 answers
57 views

Assign function type to a pointer in ghidra

In the project I'm currently working on, I have found the following obfuscated access to functions in various libraries. In the following example, libdl is referenced. if (libdl_string_literal[8] != ...
  • 101
2 votes
1 answer
209 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
  • 21
1 vote
0 answers
177 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
0 votes
1 answer
82 views

Ghidra internal work

I have a question about working with variables in Ghidra. Often variables are being used with many different purposes. I understood it is possible to overcome this issue with commit param. Does anyone ...
  • 1
0 votes
0 answers
63 views

not called functions

trying to reverse a Cortex-M0 bin file using Ghidra. There are functions that are Never Called any where in the code! (but actually should be called somewhere !) What could be the reasons? Tnx
1 vote
0 answers
1k views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file - which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
  • 73
0 votes
2 answers
159 views

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other. Based on asking others ...
  • 125
1 vote
1 answer
259 views

Help with Ghidra and rewriting assembly

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
3 votes
1 answer
673 views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
0 votes
0 answers
94 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
0 votes
1 answer
157 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...

1
2 3 4 5
7