Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

78 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

im trying to clear all the ghidra instances in my machine before reinstalling it and im seeing some anomalies

i downloaded 3 different instances of Ghidra without realizing, and after i did the 'locate ghidra command it returned; i restarted my computer to see if it would still be there and it is. i also see ...
0
votes
0answers
86 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
0
votes
0answers
74 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
0
votes
1answer
103 views

How do I execute “File -> Add To Program…” in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
0
votes
1answer
61 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
0answers
22 views

Ghidra SDK Register TypeFlags are not populated

I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
0
votes
0answers
50 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
87 views

Ghidra: What are “hash” function variables in the listing view

The variables at the bottom prefixed with HASH:xxxxx:8, what are these variables and why are they here? When I delete them Ghidra insists on re-adding them when I Commit local names so I'm guessing ...
0
votes
0answers
25 views

How to link a field in a structure to a static address in Ghidra?

I have a field in a structure that is a pointer to a static array. Is there a way to link this static array to the field so that the values of the static array appear in its in place?
0
votes
1answer
63 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
0answers
162 views

Ghidra analysis speed very slow compared to Hopper

I'm disassembling a large ARM binary with Ghidra and the analysis takes a couple of hours. The (decrypted) binary is from iOS (ARM64) and contains both Objective-C and Swift modules. Disassembling the ...
0
votes
0answers
54 views

Few questions about Ghidra

I have a few questions to those are using Ghidra: Is there any option to write notes only in the Decompiler window, for like that for example: printf("Test") // Printing some data -> ...
0
votes
0answers
95 views

In which program do I reverse engineer UEFI firmwares

I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
0
votes
0answers
91 views

Show full name in symbols panel of Ghidra

Do you know how to show the full names of symbols in the Symbols panel of Ghidra ? Like in the figure, the name "character" is shown like "Ch..." can someone know how to extend it ...
0
votes
0answers
30 views

Get Unaffected and KilledByCall Registers from CompilerSpec using Ghidra's Java API

Is there a way to get the volatile and non-volatile registers from Ghidra's CompilerSpec? For instance, when I look into the ARM.cspec I get the following information: <unaffected> <register ...
0
votes
0answers
58 views

Volatile data Ghidra

Is it possible to set a local stack variable volatile? I'm trying to reverse a program full of concurrent threads which exploit this mechanism: https://en.wikipedia.org/wiki/Setcontext to obfuscate ...
0
votes
0answers
31 views

why does ghidra ignores .debug information for certain binaries?

I am using debin project to recover symbols in stripped binaries. This project leverages machine learning approach to reverse engineer variables, types and variable names from stripped binaries. It ...
0
votes
0answers
53 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
0answers
60 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
0
votes
0answers
178 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
1answer
325 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
0
votes
0answers
88 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
0
votes
0answers
55 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
0
votes
2answers
266 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
365 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
-1
votes
0answers
58 views

Export / Convert Ghidra database (GZF) to IDA database (IDB)

I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions. I have found ...
-1
votes
1answer
42 views

Call function more times with other args

I want call same function more times but with other args, I can't add new instructions so how can I call?
-1
votes
1answer
133 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?

1
2