Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
5 votes
2 answers
681 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
2 votes
0 answers
605 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
2 votes
1 answer
1k views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1 vote
0 answers
529 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
  • 316
3 votes
2 answers
204 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1 vote
1 answer
316 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
  • 13
3 votes
1 answer
2k views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
  • 43
3 votes
1 answer
2k views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
  • 239
0 votes
1 answer
2k views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
9 votes
1 answer
3k views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
2 votes
1 answer
263 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...
2 votes
0 answers
158 views

How do I implement register pages in Sleigh?

I'm working on creating a processor definition for the Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that. The HC12 ...
  • 171
1 vote
0 answers
301 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1 vote
0 answers
543 views

Ghidra export to C header, how to remove ".conflict"?

When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it ...
1 vote
0 answers
143 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
  • 11
6 votes
1 answer
716 views

Is there documentation on the Ghidra 9.1 SleighDevTools?

I am working on adding a processor to Ghidra (I have no idea what I'm doing, just working my way through based off the documentation). I've seen SleighDevTools mentioned in the 9.1 release as being "...
  • 63
1 vote
1 answer
596 views

Compiled binary functional comparison through different versions / assembled functions

Good Day! I've not hit upon a solution to compare different compiled binaries for identical functions. Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
  • 168
-1 votes
1 answer
554 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
  • 136
0 votes
2 answers
811 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
  • 163
1 vote
2 answers
316 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
  • 136
2 votes
1 answer
144 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
5 votes
1 answer
2k views

How to improve Ghidra decompilation of SSE instructions?

In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
-2 votes
1 answer
554 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...
2 votes
1 answer
1k views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2 votes
0 answers
189 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
3 votes
0 answers
668 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
1 vote
1 answer
718 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
2 votes
1 answer
3k views

Is it possible to define an array of variable size in Ghidra (size in the struct itself)

I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra? 16 | Size of array ...
1 vote
3 answers
566 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
1 vote
2 answers
528 views

Renaming a function globally

I have decompiled a DLL, and in the Symbol tree, I have clicked a function. This function looks like this in the Decompile window: undefined4 process_something(undefined4 param_1,undefined4 param_2) {...
user avatar
1 vote
1 answer
882 views

Ghidra scripting get information from decompile window

I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
  • 71
3 votes
1 answer
1k views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
  • 49
1 vote
0 answers
125 views

Force Format/Analyser on obfuscated/anti-disassembly file

I have a clear .class file, which is likely obfuscated. However, Ghidra is not detecting it as Java, and shows it as Raw binary, which prevents me from using the Java Class Analyzer on the file. How ...
3 votes
1 answer
2k views

Is it possible to load multiple files into a single Ghidra memory map?

1980s arcade video games generally had multiple ROM chips. I suppose these often mapped into a single address space and often may have been bank switched in and out of sections of a single address ...
2 votes
2 answers
1k views

Ghidra renaming EAX

Ghidra is renaming EAX as param_1. Why is this happening? I find it very confusing since it is clearly not a parameter and different uses of EAX are named as if they held the same value.
2 votes
1 answer
2k views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
  • 71
0 votes
0 answers
927 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
  • 23
0 votes
1 answer
979 views

Ghidra Python - Get Decompile Line Text by RVA

Is there a way in Ghidra Python to get the corresponding decompile line by RVA? Or the opposite - get the corresponding RVA from a given line in a decompile?
-1 votes
2 answers
1k views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
  • 261
1 vote
2 answers
845 views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
  • 13
1 vote
3 answers
2k views

Ghidra Python - Get x-refs of a specific function

What is the best way to get calling x-refs for a specific function? I am aware of the following method: func = getFirstFunction() while func is not None: func_name = func.getName() if ...
4 votes
2 answers
2k views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
  • 261
1 vote
1 answer
2k views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
  • 261
2 votes
1 answer
2k views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
  • 141
0 votes
1 answer
177 views

"check:" keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
  • 3
1 vote
0 answers
63 views

PowerPC executable doesn't show debugging symbols in Ghidra

I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box. In Ghidra ...
  • 239
3 votes
1 answer
3k views

Ghidra interpreting stack pointers wrongly

Why is Ghidra interpreting this incorrectly? The example is very simple. In this stack: 0019FF58 $-8 0019FF58 00000002 LOCAL 2 0019FF5C $-4 0019FF5C 00000001 LOCAL ...
4 votes
3 answers
2k views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
  • 261
2 votes
1 answer
675 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
  • 63
3 votes
0 answers
860 views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...

1
3 4
5
6 7