Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

23 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
469 views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
4
votes
1answer
781 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
3
votes
0answers
164 views

How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
3
votes
0answers
302 views

Renaming shadowed variables in Ghidra

I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?
3
votes
0answers
215 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
3
votes
0answers
90 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
2
votes
0answers
73 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
2
votes
0answers
228 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
2
votes
0answers
164 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
2
votes
0answers
203 views

Handling pointer to middle of struct in Ghidra

Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code. This can result in assembly that looks like this, using MIPS as an example ...
2
votes
0answers
2k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
1
vote
1answer
174 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
1
vote
0answers
56 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1
vote
1answer
57 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
1
vote
0answers
98 views

Ghidra: How to display the contents of an array

I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format ...
1
vote
0answers
78 views

Reverse Engineering GUI programs

I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
1
vote
0answers
183 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
1
vote
0answers
118 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
1
vote
0answers
121 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
0answers
254 views

How to export to *.so file after patching in ghidra

I'm using ghidra to patch an *.so file in the Android APK. While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
1
vote
0answers
305 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
1
vote
0answers
151 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
0
votes
1answer
75 views

Ghidra function pointers to another file in project

Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...