Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
10
votes
2answers
5k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
9
votes
1answer
3k views

Ghidra define c++ string

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree. Now I want to define a std::...
8
votes
1answer
2k views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
8
votes
1answer
1k views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
8
votes
1answer
4k views

How do I make a hex literal a decimal literal in Ghidra?

There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
8
votes
1answer
2k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
7
votes
1answer
404 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
6
votes
1answer
347 views

Is there documentation on the Ghidra 9.1 SleighDevTools?

I am working on adding a processor to Ghidra (I have no idea what I'm doing, just working my way through based off the documentation). I've seen SleighDevTools mentioned in the 9.1 release as being "...
6
votes
1answer
1k views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
6
votes
1answer
165 views

Can Ghidra show a function footer in the Listing window

In both IDA and Ghidra have a very nice beginning of function marker text Ghidra: ************************************************************** * FUNCTION ...
5
votes
1answer
1k views

Ghidra can't see basic functions in my files?

I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong. My program is simple: ...
5
votes
1answer
5k views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
5
votes
2answers
271 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
5
votes
1answer
2k views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
5
votes
1answer
6k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
4
votes
4answers
4k views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
4
votes
2answers
493 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
4
votes
1answer
151 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
4
votes
2answers
1k views

CPU support by ghidra

Where can I see all the CPUs supported by Ghidra? Does Ghidra support more CPUs than IDA Pro?
4
votes
2answers
173 views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
4
votes
1answer
3k views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
4
votes
1answer
5k views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
4
votes
1answer
401 views

Ghidra Headless Analyzer - Create Functions

I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI). I know what is the architecture of the file, so I pass it as a ...
4
votes
2answers
837 views

Renaming shadowed variables in Ghidra

I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?
4
votes
1answer
429 views

Handling pointer to middle of struct in Ghidra

Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code. This can result in assembly that looks like this, using MIPS as an example ...
4
votes
1answer
574 views

How to improve Ghidra decompilation of SSE instructions?

In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
4
votes
1answer
158 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
4
votes
0answers
595 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
3
votes
3answers
662 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
3
votes
2answers
875 views

Why Ghidra doesn't load the disassembly correctly while radare2 does?

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary. When I open it with r2 it automatically recognizes the ...
3
votes
1answer
2k views

Can Ghidra show me the p-code generated for an instruction?

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of ...
3
votes
1answer
2k views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
3
votes
1answer
650 views

Ghidra interpreting stack pointers wrongly

Why is Ghidra interpreting this incorrectly? The example is very simple. In this stack: 0019FF58 $-8 0019FF58 00000002 LOCAL 2 0019FF5C $-4 0019FF5C 00000001 LOCAL ...
3
votes
1answer
343 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
3
votes
2answers
112 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
3
votes
1answer
4k views

ghidra: how to run a python 3 script with headless analyzer

I read the documentation of headleass analyzer. It is used to perform analysis on existing binaries. I know that -postscript flag allows to enter the analysis script. I have a java script which works ...
3
votes
2answers
1k views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
154 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
3
votes
1answer
500 views

ghidra-python: create struct with big endian field

Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is. ...
3
votes
2answers
721 views

GHIDRA: How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
3
votes
0answers
398 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
1answer
326 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
3
votes
0answers
123 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
3
votes
1answer
268 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
2
votes
1answer
433 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
2
votes
1answer
619 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
2
votes
2answers
372 views

Template code with 0xcccccccc in every ghidra decompiled function for some executables

I often have some code like this on the beginning of every function of a decompiled program: iVar1 = 0x42; puVar2 = local_10c; while (iVar1 != 0) { iVar1 = iVar1 + -1; *puVar2 = ...
2
votes
1answer
756 views

How to increase decompilation timeout in ghidra?

I'm trying to decompile a function with ghidra 9.0. After a (short) while, I get : Exception while decompiling 140062b00: process: timeout I already "succesfully" decompiled this function using IDA ...
2
votes
2answers
149 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
2
votes
1answer
314 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...