Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
user avatar
  • 415
1 vote
1 answer
50 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
user avatar
2 votes
0 answers
30 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
user avatar
1 vote
0 answers
29 views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
user avatar
  • 199
0 votes
0 answers
28 views

How can I hook structure members in frida

I have a code like this: class CURLNetRequest : public CNetRequestBase { DEFINE_LOGCLASS; struct ProxySettings { void initFromConfig(); String host; ...
user avatar
  • 199
0 votes
0 answers
30 views

What is the most effective tool to analyze apk file

I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes. However, I am facing an issue for ...
user avatar
  • 1
1 vote
0 answers
59 views

Ghidra graphing questions

I'm trying to learn RE with Ghidra, and have a few Ghidra-specific questions. Exceeded limit of 500 nods - any way to increase this threshold? Any other way to choose which section of the code is ...
user avatar
  • 11
0 votes
1 answer
56 views

How to import Ghidra DB into IDA?

I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?
user avatar
0 votes
1 answer
76 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
user avatar
1 vote
0 answers
52 views

Srec file for SH2A family with ghidra

I'm trying to analyse a SREC file for a processor from SH2A family with ghidra. I have the datasheet of the processor from Renesas but I think I did the address mapping wrong. https://www.renesas.com/...
user avatar
  • 11
1 vote
0 answers
75 views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
user avatar
1 vote
1 answer
128 views

[Ghidra]How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
user avatar
  • 415
1 vote
1 answer
24 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
user avatar
  • 415
0 votes
0 answers
23 views

Assign function type to a pointer in ghidra

In the project I'm currently working on, I have found the following obfuscated access to functions in various libraries. In the following example, libdl is referenced. if (libdl_string_literal[8] != ...
user avatar
  • 101
0 votes
1 answer
105 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
user avatar
  • 1
1 vote
0 answers
74 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
user avatar
0 votes
1 answer
69 views

Ghidra internal work

I am having question about working in Ghidra with variables. There are many times the variables are being used with many different purposes. I understood it is possible to overcome this issued with ...
user avatar
  • 1
0 votes
0 answers
47 views

not called functions

trying to reverse a Cortex-M0 bin file using Ghidra. There are functions that are Never Called any where in the code! (but actually should be called somewhere !) What could be the reasons? Tnx
user avatar
1 vote
0 answers
433 views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file - which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
user avatar
  • 63
0 votes
2 answers
97 views

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other. Based on asking others ...
user avatar
  • 125
1 vote
1 answer
162 views

Help with Ghidra and rewriting assembly

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
user avatar
3 votes
1 answer
193 views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
user avatar
0 votes
0 answers
71 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
user avatar
0 votes
1 answer
82 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...
user avatar
0 votes
0 answers
155 views

Basic buffer-overflow on a remote program with Python/pwntools

I work on a online program in which I should do a buffer Overflow. When I run the program, I have to complete a sum of two numbers generated randomly) : >>> 451389913 + 1587598959 = If I put ...
user avatar
  • 101
1 vote
1 answer
149 views

Strange DWORD/QWORD C++ Strings in decompilation

I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like: local_14 = DAT_00404004 ^...
user avatar
  • 23
0 votes
0 answers
67 views

ADD right before CMP?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block: CALL _strcmp MOV dword ptr [EBP + local_1c], EAX MOV EAX, dword ptr [...
user avatar
  • 11
0 votes
0 answers
55 views

PUSH x VS MOV [ESP], x?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction right before a call: MOV dword ptr [ESP], 0x3c Where 0x3c is the offset to ...
user avatar
0 votes
1 answer
78 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
user avatar
0 votes
0 answers
91 views

Ghidra resolving ordinals (WS2_32.DLL)

I think I have done this in the past but I cannot remember anymore. What are the steps to make Ghidra in Linux recognise the import names instead of using the Ordinals? (They are recognised ...
user avatar
1 vote
0 answers
261 views

Ghidra not decompiling very simple ARM64 program

I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64) My Assembly code looks like this: .global _start _start: ...
user avatar
1 vote
0 answers
121 views

How to deal with this Ghidra decompile error?

I'm getting the following Ghidra decompile error on one function: Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space I don't see anything unusual about the ...
user avatar
2 votes
1 answer
336 views

Ghidra Debugger not working

When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors: Launch failed for {args=/C:/Users/abc/Desktop/...
user avatar
  • 21
1 vote
1 answer
85 views

loading symbols into Ghidra after analysis

I have a question about loading symbols. I have a analyzed a binary and it downloaded relevant symbols for the binary I check from symbol server, and I see for example it does not recognize a ...
user avatar
  • 11
0 votes
1 answer
271 views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
user avatar
0 votes
1 answer
137 views

Ghidra: Reading all registers contents at chosen instruction

Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
user avatar
0 votes
0 answers
118 views

Ghidra "WARNING: Could not recover jumptable"

I get the title warning often when Ghidra is examining code that is pretty clearly coming from C switch block, and as a result many blocks of code are missing from decompile. The assembly pattern is ...
user avatar
3 votes
1 answer
104 views

How to use linux .debug file with Ghidra

I have an ELF64 binary that comes with *.sym and .debug. From my understanding this is something akin to PDB. While IDA loads it automatically, it fails to process it. I was wondering if Ghidra will ...
user avatar
  • 33
2 votes
2 answers
477 views

Understanding a C code including CRT functions, decompiled with Ghidra

I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code: <typeName> <...
user avatar
  • 159
0 votes
1 answer
69 views

How to make Ghidra don't brake mid token with triple dots?

So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ... Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
user avatar
  • 415
1 vote
1 answer
117 views

Make Ghidra recognize thread-local variables

I am trying to reverse an ELF binary that makes use of thread-local variables. I can't figure out how to make Ghidra display them in a friendlier way (something like declaring a struct or similar). ...
user avatar
  • 89
0 votes
1 answer
267 views

(Ghidra) How to get the parameter name given a Function object and the storage location as a register string?

Given an instance of something that implements ghidra.program.model.listing.Function, and the register as a string (e.g. x0) how can I get the name of the argument (e.g. param1)?
user avatar
0 votes
1 answer
169 views

SQLite access from Ghidra script

I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
user avatar
1 vote
1 answer
731 views

Why does Ghidra show no references to any strings?

I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
user avatar
  • 151
0 votes
1 answer
88 views

How do I make Ghidra propagate modified functon signatures to other programs in that project?

I have imported several programs to my Ghidra project and retyped a few function parameters in one of them. Now I am working on a different program, which imports these functions. However, the ...
user avatar
  • 3
1 vote
1 answer
468 views

How to define "code" variable type in Ghidra

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
user avatar
2 votes
1 answer
392 views

How to type data as a relative address in Ghidra?

A jump table I am reversing uses relative offsets to both data and functions. These relative offsets are 32-bit integers added to the address that the value is stored at. Does Ghidra support typing ...
user avatar
0 votes
0 answers
73 views

What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?

I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c. Note that I believe DAT_804818d0 is the seed, ...
user avatar
0 votes
1 answer
89 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
user avatar
3 votes
2 answers
398 views

How to load shellcode into Ghidra

I'm trying to learn more about reverse engineering, and I've found some shellcode embedded in a C program: unsigned char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\...
user avatar

1
2 3 4 5
7