Questions tagged [ghidra]
Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.
386
questions
2
votes
1
answer
173
views
Marking DAT section as shellcode in ghidra
I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
CommunityBot
- 1
1
vote
1
answer
84
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
CommunityBot
- 1
1
vote
1
answer
120
views
Merge two function arguments
I have a function with a signature:
int func(undefined8 param_1,int param_2,char *pData,int nDataSize)
I know from a header file that the first two arguments are actually one, a struct that I know ...
CommunityBot
- 1
1
vote
1
answer
142
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
- 10.9k
2
votes
1
answer
144
views
convert a memory location to string in Ghidra
I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well.
I would like to have a decompiled pseudo-code in Ghidra like:
...
- 158
0
votes
0
answers
62
views
Why ghidra does not use label variables and uses constants to represent code local variables?
so the question is in the title I had a simple C program to understand how global and local variables(struct) are stored in the stack. The problem is I don't know if this is good or bad or if I'm ...
- 1
0
votes
2
answers
106
views
What does adding to a function pointer do?
i'm dissassembling an arm shared object and i'm seeing this line:
iVar1 = SecurityAccess(param_2,SeedEncrypt + 1,0x1);
the SecurityAccess SeedEncrypt is:
int SecurityAccess(int param_1,void *param_2,...
CommunityBot
- 1
0
votes
1
answer
121
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
CommunityBot
- 1
0
votes
0
answers
58
views
How to decompile data segment in ghidra
I have a code in data segment in my bin. Is there a way how to make a ghidra treat some data as a code for decompilation?
- 2,629
0
votes
0
answers
106
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
6
votes
4
answers
3k
views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
- 143
3
votes
1
answer
1k
views
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.
Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
- 220
4
votes
0
answers
766
views
Extract disassembly from Ghidra for reassembling
How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
- 220
1
vote
0
answers
41
views
Tool for reverse-engineering M7702 binary?
I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read.
The CPU has 16-bit registers A, B (data), X, ...
- 186
2
votes
1
answer
1k
views
How to mark data as pointer to external functions in ghidra
I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
CommunityBot
- 1
2
votes
1
answer
144
views
MachO chained fixups parsing
I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases?
My question originated from wanting to parse all the Objective-C classes inside a ...
- 1,401
0
votes
2
answers
211
views
Ghidra scripting: get indirect operand address
I tried several hours to find a way to get the operand address which is displayed in the ghidra listing, but without success:
I know at least that the OperandType is "Address".
import ...
- 915
3
votes
1
answer
1k
views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
CommunityBot
- 1
0
votes
1
answer
185
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
CommunityBot
- 1
1
vote
0
answers
55
views
Global variables as Functions in JEB
I was using Ghidra trying decompile a .sys driver. Kinda newbie, but getting some help.
I see decompiler outputs a lot of "artifacts" (code weird or hard to understand). At least I have ...
- 111
0
votes
0
answers
65
views
Ghidra - Mach-O failed to load external libraries
I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
- 180
1
vote
0
answers
123
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
1
vote
1
answer
233
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 579
0
votes
0
answers
31
views
EBX Relative references are not recognized by ghidra
String references are not recognized by ghidra on PIC .so file
The calls are calculated by a relative offset from the EBX register.
On entry to the function, EBX is set
relative offset is added (for ...
1
vote
2
answers
275
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
CommunityBot
- 1
0
votes
0
answers
43
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
2
votes
2
answers
209
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 257
1
vote
0
answers
90
views
Where can I find the files from Ghidra symbol tree?
I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
- 83
0
votes
0
answers
55
views
Disassembling an executable that is packaged with vercel's pkg
I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
- 188
0
votes
0
answers
72
views
How to make a Signature of a Global Variable in Ghidra?
currently im trying to rebuild a function.
I am using makesig.py to create function signatures which I am using for rebuilding. It works fine.
Now im trying to make a signature of a global variable:
...
- 1
0
votes
0
answers
34
views
Can I limit Ghidra's analysis to a particular Program Trees subfolder (block)?
Is there a way to limit Ghidra's analysis to a particular identified subfolder in the Program Trees view?
I'm very new to Ghidra and trying to use it to investigate a large library. I've attempted to ...
1
vote
1
answer
102
views
Removing Ghidra auto-generated labels and create function. Overlapping namespace error
I am attempting to write a script to parse a function table containing structs that look like this:
struct func_table_entry {
void (* func)(void *);
byte unknown1;
byte unknown2;
byte ...
- 10.9k
2
votes
1
answer
154
views
Understanding pointer indirection for accessing static variables in Cortex M0 firmware
I'm reverse engineering some firmware from a device running an ARM Cortex M0 (specifically, Nordic nrf51802). For reference, the pertinent part of the memory map looks like this:
I'm trying to add ...
- 11
1
vote
0
answers
171
views
Read value from frida hooked native method Jlong parameter
I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
- 309
2
votes
1
answer
109
views
How to define a 28-bit integer in Ghidra
I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra.
I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
- 1,401
3
votes
1
answer
224
views
Java says "ghidra" is unknown protocol when creating project on linux
Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
- 257
1
vote
1
answer
387
views
Ghidra with Swift/Objective-C datatypes (NSString)
I'm new to using Ghidra, so apologies if this has been asked before, but I couldn't find an answer.
I'm looking at an iOS app, and I can see a function signature that looks like this:
ID Class::...
1
vote
1
answer
75
views
Installation problem with gotools extension for Ghidra: Extension version for [gotools-master.zip] is incompatible with Ghidra
I'm getting the following error when I try to install the following extension https://github.com/felberj/gotools
Installation Error
Extension version for [gotools-master.zip] is incompatible with ...
- 1,769
2
votes
0
answers
50
views
How to find where an instance variable of some object is set to some concrete value?
I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
1
vote
1
answer
729
views
Increase font size in Ghidra
For the record, this is a question I often see:
Especially when using a high-resolution display, fonts and other UI elements can appear extremely small. How can they be enlarged?
- 309
1
vote
0
answers
132
views
How to get Ghidra to show `PUSH LAB_xxx` in Decompile view
I am new to using Ghidra and I am trying to reverse engineer an x86 Windows executable written in Delphi Pascal.
I believe I am seeing a problem with the analysis of Try Finally blocks and I'd like to ...
1
vote
0
answers
146
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
2
votes
1
answer
166
views
How to map a decompiled c program back into original source code
I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).
So is ...
- 9,178
4
votes
1
answer
1k
views
GHIDRA: Create an array of strings that are padded
I'm working on decompiling a DOS .exe that was written in Pascal or Delphi. When looking at the decompiled code, there appears to be many strings that are are padded with 00. Example:
06 53 54 52 49 ...
- 915
3
votes
1
answer
1k
views
ghidra scripting: how to distinguish between function and global symbol
I have a following program:
int b2[4];
int foo()
{
static int b2[10];
b2[5] = 4;
}
int main()
{
static int b2[10];
int b[5];
b[0] = 1;
b2[9] = 4;
int *ptr = b;
int c = *(ptr + 10);
...
- 915
2
votes
1
answer
86
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 368
2
votes
1
answer
230
views
Ghidra function pointer calling conventions
I'm reverse engineering some ColdFire MCF5206 (68K-like) code that makes heavy use of function pointers, e.g.:
000006e0 46 fc 27 00 move #0x2700,SR
000006e4 4f ef ff f0 ...
- 368
1
vote
1
answer
920
views
I'm trying to clear all the Ghidra instances in my machine before reinstalling it and I'm seeing some anomalies
I downloaded 3 different instances of Ghidra without realizing, and after I did the locate Ghidra command, it returned:
The second folder ghidra_scripts is unimportant and doesn't contain any ...
CommunityBot
- 1
2
votes
0
answers
166
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
2
votes
0
answers
66
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
- 21