Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
2
votes
1answer
59 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
2
votes
1answer
205 views

Ghidra function pointers to another file in project

Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
2
votes
1answer
444 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
2
votes
2answers
387 views

Save Ghidra's control flow graph into a parsable format

I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control ...
2
votes
1answer
1k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
2
votes
1answer
59 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
2
votes
2answers
130 views

Ghidra renaming EAX

Ghidra is renaming EAX as param_1. Why is this happening? I find it very confusing since it is clearly not a parameter and different uses of EAX are named as if they held the same value.
2
votes
1answer
69 views

Convert .cpu / .opc to sleigh

Is there a tool to automatically convert binutils cpu definitions (.cpu / .opc files) to sleigh for use in Ghidra? ... or do I need to hand craft a cpu definition for Synopsys DesignWare ARC 625D?
2
votes
1answer
87 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
2
votes
0answers
36 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
2
votes
0answers
42 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
2
votes
0answers
77 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
2
votes
0answers
32 views

How do I implement register pages in Sleigh?

I'm working on creating a processor definition for the Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that. The HC12 ...
2
votes
0answers
68 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
2
votes
0answers
125 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
0answers
196 views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...
2
votes
1answer
197 views

Function's signature with unmatching parameters

I have following code disassembled by ghidra: PUSH EBX PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf PUSH u_%s\%s_0040eb88 size_t ...
2
votes
1answer
91 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
2
votes
0answers
574 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
2
votes
0answers
331 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
2
votes
0answers
281 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
1
vote
2answers
134 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
1
vote
1answer
201 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
2answers
167 views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
1
vote
1answer
531 views

How do I read this decompiled code?

I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called ParseCommandLine, but I don't understand what it is doing. I ...
1
vote
3answers
813 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
1
vote
1answer
22 views

How to create an uninitialized variable in Ghidra?

The code under inspection is a native Android library used in an Android application. The decompiler is showing me a lot of lines in the style DAT_12345678 = 0x12345678 with ascending addresses. I ...
1
vote
1answer
111 views

Segmentation fault after export binary file in Ghidra even without any changes [closed]

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
1
vote
1answer
33 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
1
vote
1answer
62 views

Compiled binary functional comparison through different versions / assembled functions

Good Day! I've not hit upon a solution to compare different compiled binaries for identical functions. Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
1
vote
3answers
145 views

Ghidra Python - Get x-refs of a specific function

What is the best way to get calling x-refs for a specific function? I am aware of the following method: func = getFirstFunction() while func is not None: func_name = func.getName() if ...
1
vote
1answer
232 views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
1
vote
1answer
307 views

Understanding ghidra disassembly

I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line Mov dword PTR [ESP] => local_70 , eax I get we are moving eax into the left side but I'm not ...
1
vote
1answer
303 views

Weird Ghidra decompiler output for simple crack me

Here is the Ghidra decompiler output for a crackme problem. Specifically, this one: Code: undefined8 entry(undefined8 param_1,char *param_2) { int iVar1; size_t sVar2; char *pcVar3; char *...
1
vote
3answers
173 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
1
vote
1answer
45 views

How to enlarge block in Ghidra's Function Graph View?

I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of ...). There does ...
1
vote
1answer
49 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...
1
vote
2answers
48 views

Renaming a function globally

I have decompiled a DLL, and in the Symbol tree, I have clicked a function. This function looks like this in the Decompile window: undefined4 process_something(undefined4 param_1,undefined4 param_2) {...
1
vote
1answer
157 views

Ghidra scripting get information from decompile window

I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
1
vote
1answer
272 views

Is it possible to load multiple files into a single Ghidra memory map?

1980s arcade video games generally had multiple ROM chips. I suppose these often mapped into a single address space and often may have been bank switched in and out of sections of a single address ...
1
vote
1answer
78 views

empty .data section in AARCH64 elf binaries

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). ghidra/JEB contradict me by showing that ...
1
vote
1answer
75 views

Type inference inconsistency

I'm testing several decompilers against the following C code static int bar(int i) { return ++i; } static int apply(int (*fun)(int), int i) { return i % fun(i); } static int foo(int (*app)(...
1
vote
2answers
998 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
1
vote
1answer
737 views

Get stack references in Ghidra of a function from the java api

How can one access all references to the stack (also outside of its frame) a function has via the Java Plugin API? Example: This instructions write values outside of the stack frame of the function: ...
1
vote
0answers
28 views

Compare ELF files using Ghidra+Bindiff based on dwarf debug info

So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway. I have an embedded ARM cortex-M C++ project and I ...
1
vote
1answer
86 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
1answer
96 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
127 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
68 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...