Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

51 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
148 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
3
votes
0answers
236 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
0answers
383 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
3
votes
1answer
387 views

How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
3
votes
0answers
263 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
3
votes
0answers
113 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
2
votes
0answers
37 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
2
votes
0answers
44 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
2
votes
0answers
83 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
2
votes
0answers
34 views

How do I implement register pages in Sleigh?

I'm working on creating a processor definition for the Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that. The HC12 ...
2
votes
0answers
69 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
2
votes
0answers
132 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
0answers
203 views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...
2
votes
1answer
91 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
2
votes
0answers
584 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
2
votes
0answers
334 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
2
votes
0answers
282 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
1
vote
0answers
28 views

Compare ELF files using Ghidra+Bindiff based on dwarf debug info

So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway. I have an embedded ARM cortex-M C++ project and I ...
1
vote
1answer
89 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
1answer
101 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
56 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
105 views

Ghidra export to C header, how to remove “.conflict”?

When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it ...
1
vote
0answers
45 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
0answers
94 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
1
vote
0answers
34 views

Force Format/Analyser on obfuscated/anti-disassembly file

I have a clear .class file, which is likely obfuscated. However, Ghidra is not detecting it as Java, and shows it as Raw binary, which prevents me from using the Java Class Analyzer on the file. How ...
1
vote
0answers
36 views

PowerPC executable doesn't show debugging symbols in Ghidra

I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box. In Ghidra ...
1
vote
0answers
124 views

How do I use GnuDisassembler (gdis) in Ghidra?

I have managed to compile the GnuDisassembler Ghidra extension, but I only got a single executable, gdis. My questions: Do I have to 'install' gdis in Ghidra, and if yes, how? How do I use gdis from ...
1
vote
0answers
211 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
1
vote
1answer
478 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
1
vote
0answers
95 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1
vote
0answers
313 views

Ghidra: How to display the contents of an array

I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format ...
1
vote
0answers
135 views

Reverse Engineering GUI programs

I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
1
vote
0answers
174 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
1
vote
0answers
401 views

How to export to *.so file after patching in ghidra

I'm using ghidra to patch an *.so file in the Android APK. While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
1
vote
0answers
466 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
1
vote
0answers
254 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
1
vote
1answer
112 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
0
votes
0answers
19 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
0
votes
1answer
27 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
0
votes
0answers
35 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
0answers
32 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
0
votes
0answers
75 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
1answer
119 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
0
votes
0answers
64 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
0
votes
0answers
38 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
0
votes
0answers
21 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
0
votes
1answer
230 views

Is it possible to define an array of variable size in Ghidra (size in the struct itself)

I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra? 16 | Size of array ...
0
votes
1answer
82 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
34 views

radare2 set data type at address

I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2. I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
0answers
159 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...