Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
2
votes
1answer
53 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
0
votes
0answers
33 views

Ghidra headless + bindiff (binexport)

I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless. ida_haru does essentially everything that I need, but ...
0
votes
0answers
35 views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
-1
votes
0answers
48 views

Export / Convert Ghidra database (GZF) to IDA database (IDB)

I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions. I have found ...
0
votes
0answers
27 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
4
votes
1answer
51 views

How to add a new CompilerSpec from a .cspec file to Ghidra?

Ghidra uses .cspec files like x86win.cspec to define compiler related information, which are imported in the .ldef files like x86.ldef that define a processor language. How can I add a new ...
0
votes
0answers
16 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
0answers
48 views

Can I ignore this Ghidra USTACK var?

I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
0
votes
0answers
35 views

GHIDRA: Create an array of strings that are padded

I'm working on decompiling a DOS .exe that was written in Pascal or Delphi. When looking at the decompiled code, there appears to be many strings that are are padded with 00. Example: 06 53 54 52 49 ...
-1
votes
1answer
53 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...
-1
votes
1answer
42 views

Call function more times with other args

I want call same function more times but with other args, I can't add new instructions so how can I call?
0
votes
2answers
55 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
0
votes
2answers
58 views

Use enum for switch case values in ghidra

Is there a way in ghidra to change decompiled switch statement case values to their names? I'm looking at a WndProc function, with a prototype of LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM ...
1
vote
0answers
55 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
1
vote
1answer
48 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
1
vote
1answer
84 views

Specify which analyses to perform in Ghidra headless mode

Basically, Ghidra in headless mode is divided into three phases: preScript, analysis, and postScript. Pre/post scripts are written extending the GhidraScript class, while analysis ones extend the ...
0
votes
1answer
27 views

Wrap-around MCU memory map definition with negative addresses

I figured it'd be more appropriate to ask this question here: https://github.com/NationalSecurityAgency/ghidra/issues/2530#issuecomment-785007613 Given this linear address space a particular MCU: It'...
0
votes
0answers
60 views

Replacing a memory block in Ghidra

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
1answer
48 views

im trying to clear all the ghidra instances in my machine before reinstalling it and im seeing some anomalies

i downloaded 3 different instances of Ghidra without realizing, and after i did the 'locate ghidra command it returned; i restarted my computer to see if it would still be there and it is. i also see ...
1
vote
1answer
168 views

Ghidra add data types from open source project

I know that the program I am decompiling uses openSSL. I'd like to add the types from the include folder of the project to the data types. To do that, I use File => Parse C Source. I then select ...
0
votes
0answers
86 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
4
votes
2answers
209 views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
0
votes
0answers
65 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
0
votes
1answer
87 views

How do I execute “File -> Add To Program…” in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
0
votes
1answer
57 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
1answer
137 views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
4
votes
1answer
179 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
0answers
20 views

Ghidra SDK Register TypeFlags are not populated

I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
1
vote
1answer
53 views

CC3200 Firmware - gaining information about - Registers / Memory (Ghidra) - SVD / CMSIS

I am currently reversing a firmware for the TI CC3200 (ARM Cortex M4) via ghidra. For other ARM chips I have learned that I may use a SVD-Loader to load all information about the registers and memory ...
0
votes
0answers
45 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
20 views

How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
2
votes
1answer
85 views

How do I get the all the basic binary blocks containing a special instruction like 'CALL' or 'RET' using python in Ghidra?

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
2
votes
2answers
86 views

C++ structure containing a RTTI getter function?

I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
1
vote
1answer
95 views

What does the “=>” sign means in ARM assembly LDR?

what does this arm instruction means? LDRB param_1,[r12,r5]=>local_b0 In particular I don't understand the "=>local_b0" part. Ghidra decompiles it to local_b0._0_1_ = *(byte *)((int)&...
1
vote
1answer
160 views

Ghidra wrong function arguments and returns

I'm a newbie here but I'm stuck with this problem. I'm trying to decompile a function that in turns call another function (named charTranslateToHex). This is the charTranslateToHex assembly code ...
0
votes
0answers
85 views

Ghidra: What are “hash” function variables in the listing view

The variables at the bottom prefixed with HASH:xxxxx:8, what are these variables and why are they here? When I delete them Ghidra insists on re-adding them when I Commit local names so I'm guessing ...
0
votes
1answer
62 views

mmap with file descriptor -1 in disassembled output

I am reversing a binary using Ghidra. In the disassembled output, I have the following lines in the main function: (code *)mmap((void *)0x0,0x55,7,0x22,-1,0) I am quite confused here since the file ...
1
vote
0answers
48 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
2
votes
1answer
333 views

Correct way to understand local_ in ghidra disassembly

Attached is the part of a disassembled main from a x86 binary file, generated by ghidra. ************************************************************** ...
1
vote
1answer
148 views

Ghidra python - get string x-refs in a binary

In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location. I want to access the strings from Ghidra Python, and to get all the x-refs to those strings. ...
4
votes
1answer
259 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
1
vote
1answer
161 views

Defining all undefined functions

I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions ...
1
vote
1answer
139 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
25 views

How to link a field in a structure to a static address in Ghidra?

I have a field in a structure that is a pointer to a static array. Is there a way to link this static array to the field so that the values of the static array appear in its in place?
0
votes
1answer
62 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
0answers
150 views

Ghidra analysis speed very slow compared to Hopper

I'm disassembling a large ARM binary with Ghidra and the analysis takes a couple of hours. The (decrypted) binary is from iOS (ARM64) and contains both Objective-C and Swift modules. Disassembling the ...
1
vote
1answer
167 views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
0
votes
0answers
53 views

Few questions about Ghidra

I have a few questions to those are using Ghidra: Is there any option to write notes only in the Decompiler window, for like that for example: printf("Test") // Printing some data -> ...
0
votes
1answer
151 views

Analyzing raw binary without ELF header in IDA Pro

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro. I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
0
votes
0answers
89 views

In which program do I reverse engineer UEFI firmwares

I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...

1
2 3 4 5