Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
0
votes
0answers
54 views

Few questions about Ghidra

I have a few questions to those are using Ghidra: Is there any option to write notes only in the Decompiler window, for like that for example: printf("Test") // Printing some data -> ...
0
votes
1answer
164 views

Analyzing raw binary without ELF header in IDA Pro

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro. I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
0
votes
0answers
96 views

In which program do I reverse engineer UEFI firmwares

I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
0
votes
0answers
94 views

Show full name in symbols panel of Ghidra

Do you know how to show the full names of symbols in the Symbols panel of Ghidra ? Like in the figure, the name "character" is shown like "Ch..." can someone know how to extend it ...
3
votes
2answers
198 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
1
vote
1answer
476 views

How can I debug Ghidra plugin Python scripts in IDE?

I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
0
votes
0answers
30 views

Get Unaffected and KilledByCall Registers from CompilerSpec using Ghidra's Java API

Is there a way to get the volatile and non-volatile registers from Ghidra's CompilerSpec? For instance, when I look into the ARM.cspec I get the following information: <unaffected> <register ...
0
votes
0answers
58 views

Volatile data Ghidra

Is it possible to set a local stack variable volatile? I'm trying to reverse a program full of concurrent threads which exploit this mechanism: https://en.wikipedia.org/wiki/Setcontext to obfuscate ...
0
votes
1answer
637 views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
1
vote
1answer
61 views

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean: 048 ...
1
vote
1answer
171 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
1answer
92 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
0
votes
0answers
31 views

why does ghidra ignores .debug information for certain binaries?

I am using debin project to recover symbols in stripped binaries. This project leverages machine learning approach to reverse engineer variables, types and variable names from stripped binaries. It ...
0
votes
1answer
249 views

8086 Function Calling Conventions

I am reversing an old DOS game from 1989. What are the function calling conventions for the 16-bit 8086 processor that is used to run this type of program? How it works on Windows x64 By function ...
1
vote
1answer
108 views

ghidra scripting: how to distinguish between function and global symbol

I have a following program: int b2[4]; int foo() { static int b2[10]; b2[5] = 4; } int main() { static int b2[10]; int b[5]; b[0] = 1; b2[9] = 4; int *ptr = b; int c = *(ptr + 10); ...
2
votes
1answer
838 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
1
vote
1answer
342 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
104 views

How to create an uninitialized variable in Ghidra?

The code under inspection is a native Android library used in an Android application. The decompiler is showing me a lot of lines in the style DAT_12345678 = 0x12345678 with ascending addresses. I ...
0
votes
1answer
176 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
1
vote
1answer
101 views

How to enlarge block in Ghidra's Function Graph View?

I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of ...). There does ...
1
vote
0answers
133 views

Compare ELF files using Ghidra+Bindiff based on dwarf debug info

So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway. I have an embedded ARM cortex-M C++ project and I ...
0
votes
2answers
126 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
0answers
53 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
1answer
262 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
2
votes
0answers
65 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
0
votes
0answers
63 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
1
vote
1answer
276 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
2
votes
3answers
3k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
0
votes
0answers
179 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
2answers
92 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
100 views

Is there any way to get predicted variables using python script?

I have a simple program: #include <stdio.h> int main() { int a; a = func(15, 3); return a; } int func(int i, int j) { int b1[5], b2[10]; b2[i] = 1; printf("%d\n", b1[j]);...
2
votes
0answers
145 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
1
vote
1answer
608 views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
2
votes
1answer
255 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
1answer
326 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
1answer
45 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
3
votes
0answers
489 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
5
votes
2answers
302 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
2
votes
0answers
260 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
1
vote
1answer
690 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
260 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
3
votes
2answers
128 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1
vote
1answer
110 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
1
vote
0answers
462 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
3
votes
1answer
563 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
0
votes
1answer
720 views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
0
votes
0answers
90 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
8
votes
1answer
568 views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
0
votes
0answers
55 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
2
votes
1answer
114 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...