Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
1
vote
0answers
56 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
104 views

Ghidra export to C header, how to remove “.conflict”?

When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it ...
1
vote
0answers
45 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
0answers
92 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
1
vote
0answers
34 views

Force Format/Analyser on obfuscated/anti-disassembly file

I have a clear .class file, which is likely obfuscated. However, Ghidra is not detecting it as Java, and shows it as Raw binary, which prevents me from using the Java Class Analyzer on the file. How ...
1
vote
0answers
36 views

PowerPC executable doesn't show debugging symbols in Ghidra

I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box. In Ghidra ...
1
vote
0answers
124 views

How do I use GnuDisassembler (gdis) in Ghidra?

I have managed to compile the GnuDisassembler Ghidra extension, but I only got a single executable, gdis. My questions: Do I have to 'install' gdis in Ghidra, and if yes, how? How do I use gdis from ...
1
vote
0answers
210 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
1
vote
1answer
476 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
1
vote
0answers
94 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1
vote
0answers
313 views

Ghidra: How to display the contents of an array

I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format ...
1
vote
0answers
135 views

Reverse Engineering GUI programs

I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
1
vote
0answers
174 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
1
vote
0answers
401 views

How to export to *.so file after patching in ghidra

I'm using ghidra to patch an *.so file in the Android APK. While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
1
vote
0answers
465 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
1
vote
0answers
254 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
1
vote
0answers
469 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
1
vote
1answer
112 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
0
votes
1answer
164 views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
0
votes
2answers
109 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
0
votes
1answer
299 views

Ghidra can't Decompile kernelbase.dll exported functions?

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
0
votes
2answers
92 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
1answer
89 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allow you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
0
votes
1answer
105 views

Ghidra Python - Get Decompile Line Text by RVA

Is there a way in Ghidra Python to get the corresponding decompile line by RVA? Or the opposite - get the corresponding RVA from a given line in a decompile?
0
votes
1answer
80 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
0
votes
1answer
95 views

Conditional to check bytes against user input [ELF 32-bit]

I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra. undefined4 check_serial(char *code) { size_t sVar1; undefined4 ...
0
votes
3answers
570 views

Ghidra analyzing hardcoded indirect jumps

I'm currently analyzing a function that has a lot of indirect jumps looking like the following. LEA R10,[0x142000000] (some instructions that dont change R10) JMP R10 The Ghidra decompiler just ...
0
votes
1answer
107 views

MIPS Router Firmware

I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security. Project-based learning has always worked well for me,...
0
votes
1answer
99 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
0
votes
1answer
1k views

Ghidra pseudocode to Java/C

I have this piece of code generated from Ghidra void __cdecl FUNCTION(uint *key,uint *text) { undefined uVar1; ushort uVar2; uint *puVar3; uint *puVar4; uint *puVar5; int iVar6; uint ...
0
votes
0answers
19 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
0
votes
1answer
25 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
0
votes
0answers
35 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
1answer
79 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
0
votes
0answers
32 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
0
votes
0answers
75 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
46 views

Is there any way to get predicted variables using python script?

I have a simple program: #include <stdio.h> int main() { int a; a = func(15, 3); return a; } int func(int i, int j) { int b1[5], b2[10]; b2[i] = 1; printf("%d\n", b1[j]);...
0
votes
1answer
119 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
0
votes
0answers
64 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
0
votes
0answers
38 views

Ghidra API: using the GraphAlgorithms and Dominator classes

I would like to compute dominators of basic blocks in the CFG using the Ghidra API. The documentation seems to offer functions to do this, such as findDominance() in GraphAlgorithms or the whole ...
0
votes
0answers
21 views

Ghidra : incorrect decompiled address for relative jumps with AVR8 microcontroller

I am new to Ghidra toolkit and trying to analyze firmware for AVR8 microcontroller (to be more specific - for ATmega8535). Ghidra in some cases generates incorrect address for relative jumps commands ...
0
votes
1answer
230 views

Is it possible to define an array of variable size in Ghidra (size in the struct itself)

I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra? 16 | Size of array ...
0
votes
1answer
82 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
34 views

radare2 set data type at address

I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2. I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
0answers
158 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
1answer
264 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
-1
votes
1answer
91 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
-1
votes
1answer
194 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
-1
votes
1answer
955 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...