Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
4
votes
1answer
6k views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
4
votes
4answers
5k views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
6
votes
1answer
173 views

Can Ghidra show a function footer in the Listing window

In both IDA and Ghidra have a very nice beginning of function marker text Ghidra: ************************************************************** * FUNCTION ...
5
votes
1answer
2k views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
0
votes
1answer
334 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
8
votes
1answer
3k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
0answers
507 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
1
vote
1answer
876 views

Get stack references in Ghidra of a function from the java api

How can one access all references to the stack (also outside of its frame) a function has via the Java Plugin API? Example: This instructions write values outside of the stack frame of the function: ...
10
votes
2answers
5k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
5
votes
1answer
5k views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
5
votes
1answer
6k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
2
votes
2answers
1k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
2
votes
1answer
823 views

How to increase decompilation timeout in ghidra?

I'm trying to decompile a function with ghidra 9.0. After a (short) while, I get : Exception while decompiling 140062b00: process: timeout I already "succesfully" decompiled this function using IDA ...
9
votes
1answer
3k views

Ghidra define c++ string

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree. Now I want to define a std::...
3
votes
2answers
1k views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
2k views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...

1 2 3 4
5