Questions tagged [ghidra]
Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.
405
questions
3
votes
0
answers
120
views
How can I progress reverse engineering this Novatek NT96650 firmware
I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core.
I have copies of the firmware,
I have extracted the contents of flash,
and have a pretty ...
3
votes
0
answers
127
views
format-string + ret2libc (or format string only)?
I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
3
votes
0
answers
279
views
Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code
I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
3
votes
0
answers
291
views
Next steps for android native library RE (JNI_OnLoad, root check)
I'm trying to RE an Android app that detects root on a system.
Using frida to backtrace 'access' calls I found out that the root check happens natively:
access(/system/xbin/su, 0x0)
Interceptor ...
3
votes
0
answers
443
views
Specifying struct offsets in Ghidra
I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view.
Here's one instruction I'm looking at.
...
3
votes
0
answers
100
views
How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?
I am looking at the following CTF challenge:
0x56555779 <+0>: lea ecx,[esp+0x4]
0x5655577d <+4>: and esp,0xfffffff0
0x56555780 <+7>: push DWORD PTR [ecx-0x4]
...
3
votes
0
answers
644
views
Disassembly of raw binary of AARCH64 using Ghidra not complete
I am trying to disassemble a raw binary with AARCH64:LE:64:v8A:default (as per below mentioned specs).
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 8
On-...
3
votes
0
answers
1k
views
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)
My Assembly code looks like this:
.global _start
_start:
...
3
votes
0
answers
657
views
How to deal with this Ghidra decompile error?
I'm getting the following Ghidra decompile error on one function:
Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space
I don't see anything unusual about the ...
3
votes
0
answers
656
views
Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?
I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
3
votes
0
answers
1k
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
0
answers
952
views
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
3
votes
0
answers
1k
views
For some reason Ghidra SRE cannot determine some imports
After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect:
DAT_00aea270 FUN_004ae180:004ae1ee,
...
3
votes
0
answers
917
views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
3
votes
1
answer
2k
views
Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?
I have opened an executable with Ghidra, IDA and x64dbg (runtime).
It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra.
When hooking through ...
3
votes
1
answer
2k
views
Fixing ghidra decompilation
i am working a little bit with Ghidra.
My assembly code doesn't match with the decompiled code:
* FUNCTION *
...
2
votes
1
answer
1k
views
[Ghidra]How to set global variable type?
I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of.
However I can't seem to find a way to do this - ...
2
votes
2
answers
3k
views
Understanding a C code including CRT functions, decompiled with Ghidra
I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code:
<typeName> <...
2
votes
1
answer
2k
views
IDA and Ghidra Reversing
I have several questions about IDA and Ghidra (for MIPS and ARM):
Is there any option to load an executable file with all its libraries?
For example, I want to enter inside a function which its ...
2
votes
2
answers
555
views
Template code with 0xcccccccc in every ghidra decompiled function for some executables
I often have some code like this on the beginning of every function of a decompiled program:
iVar1 = 0x42;
puVar2 = local_10c;
while (iVar1 != 0) {
iVar1 = iVar1 + -1;
*puVar2 = ...
2
votes
1
answer
1k
views
How can I find an external function code correctly in Ghidra and Radare2?
This is a code to call an external function(get_random_name) in the main function
push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]
str r1, [fp, -0x1dc]
sub r3, fp, 0x44
...
2
votes
1
answer
5k
views
Ghidra add data types from open source project
I know that the program I am decompiling uses openSSL.
I'd like to add the types from the include folder of the project to the data types.
To do that, I use File => Parse C Source.
I then select ...
2
votes
1
answer
906
views
Tons of error bookmark on Ghidra
I'm new to Ghidra so go easy on me. Running it on Windows.
After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
2
votes
1
answer
858
views
Ghidra: Prepend memory segment in assembly listing view
Ida prepends the memory segment before each instruction. How can it be added in Ghidra ? I've already tried to edit the listing fields without success as no option fits my need.
What I would like
....
2
votes
1
answer
491
views
How to search a sequence of instructions in Ghidra?
I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:
What I'm looking for so is (for the same DLL, decompiled in ...
2
votes
2
answers
2k
views
Access data at memory address that is part of a struct
Problem
I have a struct of some type, say the DOS header at the beginning of a typical PE file:
/DOS/IMAGE_DOS_HEADER
pack(disabled)
Structure IMAGE_DOS_HEADER {
0 char[2] 2 e_magic "...
2
votes
1
answer
2k
views
8086 Function Calling Conventions
I am reversing an old DOS game from 1989. What are the function calling conventions for the 16-bit 8086 processor that is used to run this type of program?
How it works on Windows x64
By function ...
2
votes
3
answers
880
views
Open a NEC binary in Ghidra
I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors.
Does Ghidra support NEC processors? Is there anything I ...
2
votes
2
answers
2k
views
NSA Ghidra 9 - Is the decompiler open source?
I recently downloaded Ghidra (link) ver 9 on windows.
The decompiler feature is presumable found at
<GHIDRA_HOME>\Ghidra\Features\Decompiler
There is a lib folder containing the Java code. ...
2
votes
2
answers
1k
views
ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file
I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
2
votes
1
answer
5k
views
Why does Ghidra show no references to any strings?
I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
2
votes
1
answer
291
views
Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?
This is the window that appears when you press Shift + /.
Example:
2
votes
1
answer
1k
views
How to propagate re-typed variables to functions signatures automatically?
In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
2
votes
1
answer
194
views
Ghidra throws error when creating DWARFProgram
I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram.
The constructor prints the following ...
2
votes
2
answers
413
views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
2
votes
1
answer
2k
views
Ghidra python - get string x-refs in a binary
In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location.
I want to access the strings from Ghidra Python, and to get all the x-refs to those strings.
...
2
votes
1
answer
9k
views
Getting Ghidra project to recognize referenced DLL
I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls
I do however not see one of the DLLs the game uses to wrap various client ...
2
votes
1
answer
228
views
Ghidra Python - cancel decompilation task
The way to decompile a function in Ghidra Python is:
decomp = DecompInterface()
decomp.openProgram(currentProgram)
decompile = decomp.decompileFunction(func, 1000, monitor)
However, in ...
2
votes
1
answer
2k
views
How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?
Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra.
I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
1
answer
5k
views
Is it possible to define an array of variable size in Ghidra (size in the struct itself)
I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra?
16 | Size of array ...
2
votes
1
answer
1k
views
Ghidra function pointers to another file in project
Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...
2
votes
2
answers
246
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
2
votes
1
answer
146
views
How to define a 28-bit integer in Ghidra
I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra.
I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
2
votes
1
answer
153
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
2
votes
1
answer
533
views
How to get hexadecimal of instruction and distinct value(token) of opcode by ghidra script?
From disassembled code, I want to extract the hexadecimal of instruction, as boxed in the figure below
plus, I want to get distinct value of each opcode and its operand,
which means sort of
mov => ...
2
votes
1
answer
98
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
2
votes
1
answer
450
views
Is there a way to show/enable mnemonic description in Ghidra?
I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg.
For e.g
bipush - Push byte
2
votes
1
answer
1k
views
Ghidra Debugger not working
When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors:
Launch failed for {args=/C:/Users/abc/Desktop/...
2
votes
1
answer
808
views
Configuring Ghidra to use the Keil 8051 ABI for analysis
I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect ...
2
votes
1
answer
2k
views
I want to insert instructions but don't have enough space to do so
Sorry if it is a very basic question/bad place to ask/for my bad english.
I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...