Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
2 votes
1 answer
42 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
1 vote
2 answers
149 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
5 votes
1 answer
3k views

Ghidra does not display whole strings

It's pretty annoying. I think I might have changed some setting somewhere. Here's a screenshot of what I'm talking about. See all those "..." ? How do I turn that off?
1 vote
1 answer
86 views

Ghidra internal work

I have a question about working with variables in Ghidra. Often variables are being used with many different purposes. I understood it is possible to overcome this issue with commit param. Does anyone ...
1 vote
1 answer
32 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
2 answers
48 views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
3 votes
1 answer
655 views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
2 votes
1 answer
188 views

Odd jsr destination in SuperH disassembly w/ Ghidra

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
2 votes
0 answers
36 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
1 vote
0 answers
26 views

Ghidra: Ignoring partial resolution of indirect

The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile: uint ...
1 vote
0 answers
24 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
2 votes
1 answer
214 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
3 votes
0 answers
39 views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
1 vote
0 answers
69 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
1 vote
0 answers
35 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
3 votes
0 answers
74 views

Ghidra: Reference to external symbols not resolved in decompile

In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly: The other functions of the same application are fine, and the ...
4 votes
1 answer
76 views

Reversing Tenda N300 Router Firmware with Ghidra

Hey I got interested in SRE so I picked up Binwalk and Ghidra though I have some issues. I was reversing a simple bin for Tenda router I did some information gathering: Tenda Router & bin file ...
4 votes
2 answers
382 views

Can I import a C struct into Ghidra?

Either by pasting from a text file or typing it out into a dialog box, which is still much faster than using Ghidra's Structure editor.
1 vote
0 answers
33 views

Ghidra python - retrieve the name of the called method

I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
1 vote
1 answer
90 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
0 votes
0 answers
62 views

ZTE F680L V6.0 GPON firmware extraction JFFS2 decrypt AES key

Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2 You can find the firmware image here. Inside we have an /etc folder with some db_default_cfg.xml which ...
0 votes
1 answer
60 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
0 votes
0 answers
55 views

Reinterpreting local function strings in Ghidra (ARM)

The program I'm working with has stuff like this all over: strbuf = 0x20746567; local_824 = (undefined *)0x6863616d; local_820 = (undefined *)0x20656e69; local_81c = (undefined ...
0 votes
1 answer
234 views

ghidra returning wrong function address

I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook const ghidraImageBase = 0x00100000; const ...
1 vote
1 answer
517 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
3 votes
1 answer
75 views

View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
1 vote
0 answers
108 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
3 votes
0 answers
347 views

Decompiling an executable compiled by vercel/pkg

I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg I tried using pkg-unpacker however the output is ...
1 vote
1 answer
370 views

[Ghidra]How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
1 vote
3 answers
566 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0 votes
1 answer
373 views

I'm trying to clear all the Ghidra instances in my machine before reinstalling it and I'm seeing some anomalies

I downloaded 3 different instances of Ghidra without realizing, and after I did the locate Ghidra command, it returned: The second folder ghidra_scripts is unimportant and doesn't contain any ...
2 votes
1 answer
88 views

Is there a way to show/enable mnemonic description in Ghidra?

I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg. For e.g bipush - Push byte
0 votes
1 answer
113 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
1 vote
2 answers
130 views

In Ghidra can I have two binaries loaded into tabs and create a new struct that I can use in both?

I'm using Ghidra to work out the structure of some binary files. No code. I can use the Structure Editor to define a struct, such as the header of the file format. But I can only find a way to create ...
1 vote
1 answer
319 views

Ghidra: Reading all registers contents at chosen instruction

Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
0 votes
1 answer
1k views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
1 vote
1 answer
80 views

Assign a constant value to an ARM register

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this: ...
1 vote
0 answers
65 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
0 votes
1 answer
153 views

Using IDA pro decompiler in Ghidra

Is it possible to use IDA pro decompiler in Ghidra ? I know the opposite is possible.
3 votes
1 answer
2k views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
1 vote
0 answers
53 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
1 vote
1 answer
88 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
2 votes
0 answers
173 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
1 vote
0 answers
305 views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
0 votes
0 answers
100 views

How can I hook structure members in frida

I have a code like this: class CURLNetRequest : public CNetRequestBase { DEFINE_LOGCLASS; struct ProxySettings { void initFromConfig(); String host; ...
0 votes
0 answers
132 views

What is the most effective tool to analyze apk file

I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes. However, I am facing an issue for ...
1 vote
0 answers
132 views

Ghidra graphing questions

I'm trying to learn RE with Ghidra, and have a few Ghidra-specific questions. Exceeded limit of 500 nods - any way to increase this threshold? Any other way to choose which section of the code is ...
1 vote
1 answer
190 views

Make Ghidra recognize thread-local variables

I am trying to reverse an ELF binary that makes use of thread-local variables. I can't figure out how to make Ghidra display them in a friendlier way (something like declaring a struct or similar). ...
1 vote
1 answer
261 views

Help with Ghidra and rewriting assembly

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
0 votes
1 answer
259 views

How to import Ghidra DB into IDA?

I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?

1
2 3 4 5
7