Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1
vote
0answers
21 views

ghidra-python: create struct with big endian field

Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is. ...
0
votes
0answers
14 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
0
votes
1answer
103 views

Ghidra function pointers to another file in project

Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...
0
votes
1answer
42 views

Conditional to check bytes against user input [ELF 32-bit]

I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra. undefined4 check_serial(char *code) { size_t sVar1; undefined4 ...
1
vote
1answer
45 views

Convert .cpu / .opc to sleigh

Is there a tool to automatically convert binutils cpu definitions (.cpu / .opc files) to sleigh for use in Ghidra? ... or do I need to hand craft a cpu definition for Synopsys DesignWare ARC 625D?
1
vote
1answer
131 views

Understanding ghidra disassembly

I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line Mov dword PTR [ESP] => local_70 , eax I get we are moving eax into the left side but I'm not ...
3
votes
1answer
261 views

Ghidra can't see basic functions in my files?

I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong. My program is simple: ...
1
vote
1answer
50 views

empty .data section in AARCH64 elf binaries

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). ghidra/JEB contradict me by showing that ...
3
votes
1answer
95 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
1
vote
1answer
129 views

How do I read this decompiled code?

I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called ParseCommandLine, but I don't understand what it is doing. I ...
0
votes
2answers
88 views

Ghidra analyzing hardcoded indirect jumps

I'm currently analyzing a function that has a lot of indirect jumps looking like the following. LEA R10,[0x142000000] (some instructions that dont change R10) JMP R10 The Ghidra decompiler just ...
4
votes
1answer
883 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
1answer
212 views

Ghidra what's the meaning of _0_4_

What does _0_4_ mean in ghidra?
2
votes
2answers
196 views

Why Ghidra doesn't load the disassembly correctly while radare2 does?

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary. When I open it with r2 it automatically recognizes the ...
0
votes
1answer
84 views

Ghidra can't Decompile kernelbase.dll exported functions?

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
3
votes
1answer
91 views

Ghidra Headless Analyzer - Create Functions

I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI). I know what is the architecture of the file, so I pass it as a ...
1
vote
1answer
129 views

Weird Ghidra decompiler output for simple crack me

Here is the Ghidra decompiler output for a crackme problem. Specifically, this one: Code: undefined8 entry(undefined8 param_1,char *param_2) { int iVar1; size_t sVar2; char *pcVar3; char *...
1
vote
1answer
66 views

Type inference inconsistency

I'm testing several decompilers against the following C code static int bar(int i) { return ++i; } static int apply(int (*fun)(int), int i) { return i % fun(i); } static int foo(int (*app)(...
7
votes
2answers
2k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
2
votes
1answer
63 views

Function's signature with unmatching parameters

I have following code disassembled by ghidra: PUSH EBX PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf PUSH u_%s\%s_0040eb88 size_t ...
2
votes
1answer
75 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
1
vote
1answer
147 views

Ghidra does not display whole strings

It's pretty annoying. I think I might have changed some setting somewhere... Here's a screenshot of what I'm talking about. See all those "..." ? How do I turn that off ? Thanks in advance.
2
votes
2answers
274 views

CPU support by ghidra

Where can I see all the CPUs supported by Ghidra? Does Ghidra support more CPUs than IDA Pro?
1
vote
1answer
210 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
2
votes
0answers
106 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
1
vote
3answers
123 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
0
votes
1answer
81 views

MIPS Router Firmware

I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security. Project-based learning has always worked well for me,...
2
votes
4answers
1k views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
1
vote
1answer
62 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
1answer
62 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
1
vote
0answers
60 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
3
votes
1answer
342 views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
1
vote
0answers
119 views

Ghidra: How to display the contents of an array

I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format ...
1
vote
2answers
431 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
716 views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
1
vote
3answers
242 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
2
votes
0answers
272 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
4
votes
0answers
515 views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
1
vote
0answers
86 views

Reverse Engineering GUI programs

I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
1
vote
1answer
209 views

Ghidra: Prepend memory segment in assembly listing view

Ida prepends the memory segment before each instruction. How can it be added in Ghidra ? I've already tried to edit the listing fields without success as no option fits my need. What I would like ....
-1
votes
1answer
183 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
3
votes
0answers
187 views

How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
2
votes
0answers
188 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
2
votes
1answer
271 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
0answers
195 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
2
votes
2answers
234 views

Save Ghidra's control flow graph into a parsable format

I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control ...
5
votes
1answer
592 views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
1
vote
3answers
378 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
3
votes
1answer
1k views

ghidra: how to run a python 3 script with headless analyzer

I read the documentation of headleass analyzer. It is used to perform analysis on existing binaries. I know that -postscript flag allows to enter the analysis script. I have a java script which works ...
2
votes
2answers
278 views

Template code with 0xcccccccc in every ghidra decompiled function for some executables

I often have some code like this on the beginning of every function of a decompiled program: iVar1 = 0x42; puVar2 = local_10c; while (iVar1 != 0) { iVar1 = iVar1 + -1; *puVar2 = ...