Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
3 votes
0 answers
120 views

How can I progress reverse engineering this Novatek NT96650 firmware

I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core. I have copies of the firmware, I have extracted the contents of flash, and have a pretty ...
Observer42's user avatar
3 votes
0 answers
127 views

format-string + ret2libc (or format string only)?

I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
98m16's user avatar
  • 31
3 votes
0 answers
279 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
ElenaKarimi's user avatar
3 votes
0 answers
291 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
Linus's user avatar
  • 31
3 votes
0 answers
443 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
Tom Seddon's user avatar
3 votes
0 answers
100 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,850
3 votes
0 answers
644 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
sharma21's user avatar
3 votes
0 answers
1k views

Ghidra not decompiling very simple ARM64 program

I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64) My Assembly code looks like this: .global _start _start: ...
JohnnyBoy's user avatar
3 votes
0 answers
657 views

How to deal with this Ghidra decompile error?

I'm getting the following Ghidra decompile error on one function: Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space I don't see anything unusual about the ...
Phil Strenski's user avatar
3 votes
0 answers
656 views

Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
MonsterDruide1's user avatar
3 votes
0 answers
1k views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
xiaoyao Don's user avatar
3 votes
0 answers
952 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
auspicious99's user avatar
3 votes
0 answers
1k views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...
Perikl Femidi's user avatar
3 votes
0 answers
917 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
solumnant's user avatar
  • 173
3 votes
1 answer
2k views

Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?

I have opened an executable with Ghidra, IDA and x64dbg (runtime). It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra. When hooking through ...
Irbis77's user avatar
  • 326
3 votes
1 answer
2k views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
AndiYo's user avatar
  • 49
2 votes
1 answer
1k views

[Ghidra]How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
rec's user avatar
  • 475
2 votes
2 answers
3k views

Understanding a C code including CRT functions, decompiled with Ghidra

I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code: <typeName> <...
Foad's user avatar
  • 189
2 votes
1 answer
2k views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
Logan's user avatar
  • 71
2 votes
2 answers
555 views

Template code with 0xcccccccc in every ghidra decompiled function for some executables

I often have some code like this on the beginning of every function of a decompiled program: iVar1 = 0x42; puVar2 = local_10c; while (iVar1 != 0) { iVar1 = iVar1 + -1; *puVar2 = ...
Phil L.'s user avatar
  • 169
2 votes
1 answer
1k views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
three2zero's user avatar
2 votes
1 answer
5k views

Ghidra add data types from open source project

I know that the program I am decompiling uses openSSL. I'd like to add the types from the include folder of the project to the data types. To do that, I use File => Parse C Source. I then select ...
lblenner's user avatar
  • 123
2 votes
1 answer
906 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
Calvin9's user avatar
  • 63
2 votes
1 answer
858 views

Ghidra: Prepend memory segment in assembly listing view

Ida prepends the memory segment before each instruction. How can it be added in Ghidra ? I've already tried to edit the listing fields without success as no option fits my need. What I would like ....
shxdow's user avatar
  • 164
2 votes
1 answer
491 views

How to search a sequence of instructions in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function: What I'm looking for so is (for the same DLL, decompiled in ...
markzzz's user avatar
  • 87
2 votes
2 answers
2k views

Access data at memory address that is part of a struct

Problem I have a struct of some type, say the DOS header at the beginning of a typical PE file: /DOS/IMAGE_DOS_HEADER pack(disabled) Structure IMAGE_DOS_HEADER { 0 char[2] 2 e_magic "...
Florian Magin's user avatar
2 votes
1 answer
2k views

8086 Function Calling Conventions

I am reversing an old DOS game from 1989. What are the function calling conventions for the 16-bit 8086 processor that is used to run this type of program? How it works on Windows x64 By function ...
RedDragonWebDesign's user avatar
2 votes
3 answers
880 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
C0DER's user avatar
  • 51
2 votes
2 answers
2k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
Nederealm's user avatar
  • 277
2 votes
2 answers
1k views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
Rui Oliveira's user avatar
2 votes
1 answer
5k views

Why does Ghidra show no references to any strings?

I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
watkipet's user avatar
  • 171
2 votes
1 answer
291 views

Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?

This is the window that appears when you press Shift + /. Example:
zzt's user avatar
  • 33
2 votes
1 answer
1k views

How to propagate re-typed variables to functions signatures automatically?

In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
gr0k's user avatar
  • 205
2 votes
1 answer
194 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
rbe's user avatar
  • 51
2 votes
2 answers
413 views

C++ structure containing a RTTI getter function?

I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
user3238415's user avatar
2 votes
1 answer
2k views

Ghidra python - get string x-refs in a binary

In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location. I want to access the strings from Ghidra Python, and to get all the x-refs to those strings. ...
macro_controller's user avatar
2 votes
1 answer
9k views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
Johnson Ploobnis's user avatar
2 votes
1 answer
228 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
macro_controller's user avatar
2 votes
1 answer
2k views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
hippietrail's user avatar
2 votes
1 answer
5k views

Is it possible to define an array of variable size in Ghidra (size in the struct itself)

I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra? 16 | Size of array ...
Alex Osheter's user avatar
2 votes
1 answer
1k views

Ghidra function pointers to another file in project

Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...
Konrads's user avatar
  • 193
2 votes
2 answers
246 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
2 votes
1 answer
146 views

How to define a 28-bit integer in Ghidra

I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra. I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
Vincent Guttmann's user avatar
2 votes
1 answer
153 views

Ghidra Shows Structure Strange

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
Pytai's user avatar
  • 23
2 votes
1 answer
533 views

How to get hexadecimal of instruction and distinct value(token) of opcode by ghidra script?

From disassembled code, I want to extract the hexadecimal of instruction, as boxed in the figure below plus, I want to get distinct value of each opcode and its operand, which means sort of mov => ...
rabbit's user avatar
  • 23
2 votes
1 answer
98 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
Anis LOUNIS aka AnixPasBesoin's user avatar
2 votes
1 answer
450 views

Is there a way to show/enable mnemonic description in Ghidra?

I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg. For e.g bipush - Push byte
BabyProgrammer's user avatar
2 votes
1 answer
1k views

Ghidra Debugger not working

When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors: Launch failed for {args=/C:/Users/abc/Desktop/...
julfl9's user avatar
  • 21
2 votes
1 answer
808 views

Configuring Ghidra to use the Keil 8051 ABI for analysis

I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect ...
Jason's user avatar
  • 21
2 votes
1 answer
2k views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
Fei T's user avatar
  • 41

1 2
3
4 5
9