Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1
vote
1answer
15 views

ghidra scripting: how to distinguish between function and global symbol

I have a following program: int b2[4]; int foo() { static int b2[10]; b2[5] = 4; } int main() { static int b2[10]; int b[5]; b[0] = 1; b2[9] = 4; int *ptr = b; int c = *(ptr + 10); ...
-1
votes
1answer
92 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
19 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
32 views

How to create an uninitialized variable in Ghidra?

The code under inspection is a native Android library used in an Android application. The decompiler is showing me a lot of lines in the style DAT_12345678 = 0x12345678 with ascending addresses. I ...
0
votes
1answer
27 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
1
vote
1answer
47 views

How to enlarge block in Ghidra's Function Graph View?

I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of ...). There does ...
1
vote
0answers
28 views

Compare ELF files using Ghidra+Bindiff based on dwarf debug info

So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway. I have an embedded ARM cortex-M C++ project and I ...
0
votes
2answers
92 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
0answers
35 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
1answer
79 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
2
votes
0answers
37 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
0
votes
0answers
32 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
1
vote
1answer
89 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
0
votes
0answers
75 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
46 views

Is there any way to get predicted variables using python script?

I have a simple program: #include <stdio.h> int main() { int a; a = func(15, 3); return a; } int func(int i, int j) { int b1[5], b2[10]; b2[i] = 1; printf("%d\n", b1[j]);...
2
votes
0answers
44 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
1
vote
1answer
126 views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
2
votes
1answer
62 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
1answer
119 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
1answer
33 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
3
votes
0answers
236 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
5
votes
2answers
177 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
2
votes
0answers
83 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
1
vote
1answer
101 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
136 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
3
votes
2answers
92 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1
vote
1answer
68 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
0
votes
0answers
64 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
2
votes
1answer
201 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
0
votes
1answer
165 views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
0
votes
0answers
38 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
5
votes
0answers
149 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
0
votes
0answers
21 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
1
vote
1answer
49 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...
2
votes
0answers
34 views

How do I implement register pages in Sleigh?

I'm working on creating a processor definition for the Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that. The HC12 ...
1
vote
0answers
56 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
105 views

Ghidra export to C header, how to remove “.conflict”?

When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it ...
1
vote
0answers
45 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
6
votes
1answer
214 views

Is there documentation on the Ghidra 9.1 SleighDevTools?

I am working on adding a processor to Ghidra (I have no idea what I'm doing, just working my way through based off the documentation). I've seen SleighDevTools mentioned in the 9.1 release as being "...
1
vote
1answer
63 views

Compiled binary functional comparison through different versions / assembled functions

Good Day! I've not hit upon a solution to compare different compiled binaries for identical functions. Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
-1
votes
1answer
68 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
0
votes
2answers
109 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
1
vote
2answers
134 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
2
votes
1answer
60 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
4
votes
1answer
262 views

How to improve Ghidra decompilation of SSE instructions?

In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
-2
votes
1answer
129 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...
0
votes
1answer
91 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allow you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
0answers
69 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...