Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
10
votes
2answers
5k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
9
votes
1answer
3k views

Ghidra define c++ string

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree. Now I want to define a std::...
8
votes
1answer
3k views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
8
votes
1answer
1k views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
8
votes
1answer
568 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
8
votes
1answer
4k views

How do I make a hex literal a decimal literal in Ghidra?

There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
8
votes
1answer
3k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
6
votes
1answer
403 views

Is there documentation on the Ghidra 9.1 SleighDevTools?

I am working on adding a processor to Ghidra (I have no idea what I'm doing, just working my way through based off the documentation). I've seen SleighDevTools mentioned in the 9.1 release as being "...
6
votes
1answer
1k views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
6
votes
1answer
173 views

Can Ghidra show a function footer in the Listing window

In both IDA and Ghidra have a very nice beginning of function marker text Ghidra: ************************************************************** * FUNCTION ...
5
votes
1answer
1k views

Ghidra can't see basic functions in my files?

I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong. My program is simple: ...
5
votes
1answer
5k views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
5
votes
2answers
302 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
5
votes
1answer
2k views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
5
votes
1answer
6k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
4
votes
4answers
5k views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
4
votes
2answers
680 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
4
votes
1answer
186 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
4
votes
2answers
1k views

CPU support by ghidra

Where can I see all the CPUs supported by Ghidra? Does Ghidra support more CPUs than IDA Pro?
4
votes
2answers
210 views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
4
votes
1answer
3k views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
4
votes
1answer
6k views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
4
votes
1answer
437 views

Ghidra Headless Analyzer - Create Functions

I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI). I know what is the architecture of the file, so I pass it as a ...
4
votes
2answers
934 views

Renaming shadowed variables in Ghidra

I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?
4
votes
1answer
478 views

Handling pointer to middle of struct in Ghidra

Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code. This can result in assembly that looks like this, using MIPS as an example ...
4
votes
1answer
58 views

How to add a new CompilerSpec from a .cspec file to Ghidra?

Ghidra uses .cspec files like x86win.cspec to define compiler related information, which are imported in the .ldef files like x86.ldef that define a processor language. How can I add a new ...
4
votes
1answer
729 views

How to improve Ghidra decompilation of SSE instructions?

In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
4
votes
1answer
298 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
4
votes
0answers
710 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
3
votes
3answers
809 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
3
votes
2answers
1k views

Why Ghidra doesn't load the disassembly correctly while radare2 does?

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary. When I open it with r2 it automatically recognizes the ...
3
votes
1answer
563 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
3
votes
2answers
2k views

Can Ghidra show me the p-code generated for an instruction?

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of ...
3
votes
1answer
2k views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
3
votes
2answers
198 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
3
votes
1answer
861 views

Ghidra interpreting stack pointers wrongly

Why is Ghidra interpreting this incorrectly? The example is very simple. In this stack: 0019FF58 $-8 0019FF58 00000002 LOCAL 2 0019FF5C $-4 0019FF5C 00000001 LOCAL ...
3
votes
1answer
387 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
3
votes
2answers
128 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
3
votes
1answer
4k views

ghidra: how to run a python 3 script with headless analyzer

I read the documentation of headleass analyzer. It is used to perform analysis on existing binaries. I know that -postscript flag allows to enter the analysis script. I have a java script which works ...
3
votes
2answers
1k views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
185 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
3
votes
1answer
591 views

ghidra-python: create struct with big endian field

Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is. ...
3
votes
2answers
919 views

GHIDRA: How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
3
votes
0answers
489 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
0answers
394 views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...
3
votes
1answer
358 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
3
votes
0answers
124 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
3
votes
1answer
399 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
2
votes
1answer
838 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
2
votes
1answer
818 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...

1
2 3 4 5