Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
7
votes
1answer
893 views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
1
vote
1answer
204 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
3
votes
1answer
3k views

ghidra: how to run a python 3 script with headless analyzer

I read the documentation of headleass analyzer. It is used to perform analysis on existing binaries. I know that -postscript flag allows to enter the analysis script. I have a java script which works ...
3
votes
1answer
377 views

How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
1
vote
1answer
33 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
5
votes
1answer
2k views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
3
votes
1answer
2k views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
2
votes
0answers
332 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
2
votes
0answers
130 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
1
vote
1answer
75 views

Type inference inconsistency

I'm testing several decompilers against the following C code static int bar(int i) { return ++i; } static int apply(int (*fun)(int), int i) { return i % fun(i); } static int foo(int (*app)(...
0
votes
1answer
88 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allow you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...