Questions tagged [ghidra]

Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool.

Filter by
Sorted by
Tagged with
0
votes
0answers
98 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
0
votes
0answers
67 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
20 views

How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
0
votes
0answers
28 views

How to link a field in a structure to a static address in Ghidra?

I have a field in a structure that is a pointer to a static array. Is there a way to link this static array to the field so that the values of the static array appear in its in place?
0
votes
1answer
65 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
0answers
202 views

Ghidra analysis speed very slow compared to Hopper

I'm disassembling a large ARM binary with Ghidra and the analysis takes a couple of hours. The (decrypted) binary is from iOS (ARM64) and contains both Objective-C and Swift modules. Disassembling the ...
0
votes
0answers
56 views

Few questions about Ghidra

I have a few questions to those are using Ghidra: Is there any option to write notes only in the Decompiler window, for like that for example: printf("Test") // Printing some data -> ...
0
votes
1answer
206 views

Analyzing raw binary without ELF header in IDA Pro

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro. I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
0
votes
0answers
104 views

In which program do I reverse engineer UEFI firmwares

I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
0
votes
0answers
111 views

Show full name in symbols panel of Ghidra

Do you know how to show the full names of symbols in the Symbols panel of Ghidra ? Like in the figure, the name "character" is shown like "Ch..." can someone know how to extend it ...
0
votes
0answers
32 views

Get Unaffected and KilledByCall Registers from CompilerSpec using Ghidra's Java API

Is there a way to get the volatile and non-volatile registers from Ghidra's CompilerSpec? For instance, when I look into the ARM.cspec I get the following information: <unaffected> <register ...
0
votes
0answers
61 views

Volatile data Ghidra

Is it possible to set a local stack variable volatile? I'm trying to reverse a program full of concurrent threads which exploit this mechanism: https://en.wikipedia.org/wiki/Setcontext to obfuscate ...
0
votes
1answer
95 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
0
votes
0answers
36 views

why does ghidra ignores .debug information for certain binaries?

I am using debin project to recover symbols in stripped binaries. This project leverages machine learning approach to reverse engineer variables, types and variable names from stripped binaries. It ...
0
votes
0answers
56 views

ghidra, change decompilation for some instructions

I am decompiling MIPS code and default decompilation of INS/EXT opcodes is less readable than assembly. Can i tell ghidra to emit smth like __asm_ext(...) instead?
0
votes
1answer
306 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
0
votes
0answers
68 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
0
votes
0answers
201 views

N64 Ghidra setup: missing MIPS instructions?

I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does not recognize valid instructions with the default ...
0
votes
1answer
117 views

Is there any way to get predicted variables using python script?

I have a simple program: #include <stdio.h> int main() { int a; a = func(15, 3); return a; } int func(int i, int j) { int b1[5], b2[10]; b2[i] = 1; printf("%d\n", b1[j]);...
0
votes
1answer
368 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
0
votes
2answers
292 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
413 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
1answer
343 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
-1
votes
1answer
77 views

Why is is ghidra representing mips move instruction as _or?

Now of course I keep trying to change it but once I get to the end of patching it says its invalid and wont let me change it. So if you have a way to do that let me know.
-1
votes
1answer
83 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...
-1
votes
2answers
638 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
-1
votes
1answer
50 views

Call function more times with other args

I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
-1
votes
1answer
153 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
-1
votes
1answer
50 views

How to see the function definition of a function pointer in Ghidra

i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
-2
votes
1answer
311 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...

1 2 3 4
5